Privacy policy

Who is responsible

The data controller is: Pooya Haratiannezhadi, sole trader (eenmanszaak), trading as PH Softwares. Product: Esame B1. Postal address: Keurenplein 41, Box C1019, 1069 CD Amsterdam, Netherlands. Email: pooya@esameb1.com. Dutch Chamber of Commerce (KVK) number: 42102236. VAT number: NL005495116B61.

Contact for any privacy question: pooya@esameb1.com.

What we collect

• Account data: your email address and sign-in details, handled by our sign-in provider.
• What you write: practice emails and answers you type.
• What you say: audio from speaking practice, practice conversations and the speaking simulation, and the text made from it.
• Your progress: exercises done, estimated scores, study plan and notes.
• Payment data: Mollie handles your card or bank details. We receive only the status, the amount and an identifier.
• Free correction without an account: a coded form of your browser and your internet address, as described under "The free correction without an account" below.
• Technical data: device and browser type and error reports. How you use the app (the screens you open and the buttons you press) only if you say yes, as described under "Analytics and your choice" below.

Why we use it, and on what legal basis

• To give you the service and the feedback you ask for (contract).
• To take payment and keep the records the law requires (contract and legal duty).
• To count how the service is used, in the browser and app, and to remember a partner's link so we can pay that partner (your consent, which you can change at any time).
• To fix errors, and to count sign-ups, paywall views and sales in our own database (our legitimate interest).
• To stop repeat free tries (our legitimate interest; you can object).
• To send you service emails. Marketing emails only if you agree, and you can stop them at any time (consent).

Who processes it for us

We use these providers. Each one receives only what it needs for its task.

• Sign-in: Clerk, United States (your email address and sign-in details).
• Product analytics, only if you say yes: PostHog, EU, on servers in Frankfurt, Germany (what you do in the app, and what our server records about it). Sales and refunds also go here as plain counts, without saying who you are.
• Error reports: Sentry, EU, on servers in Frankfurt, Germany (technical details of a crash or error).
• Payments: Mollie B.V., Netherlands (your card or bank details, which we never see).
• Voice conversations and the speaking simulation: ElevenLabs, United States (your voice and what is said). The conversation partner's replies are produced by an AI model that ElevenLabs runs for us.
• Turning your spoken answers into text: OpenAI, United States (the audio of your answer).
• Pronunciation scoring: Microsoft Azure Speech, West Europe region, Netherlands (the audio of your answer).
• Feedback on your writing and speech: Anthropic, United States (the text you write and the text of what you say).
• Word lookups and photo translation: Google, United States (Gemini for words you tap; Cloud Vision for a photo, only if you use that feature).
• Email delivery: Resend, sending from its EU region (your email address and the message).
• Hosting and database: Hetzner Online GmbH, Germany (our server is in Nuremberg).

The free correction without an account

You can have one writing correction without an account. To keep that to one, and to keep our costs under control, we turn your browser's identifier and your internet address into coded values (a keyed hash, from which we cannot read the original). We do not store the address or the identifier itself. The coded address is kept for one day. The coded browser value is kept for up to 5 years, so that the free correction stays free once only. Expired records are deleted automatically. Our legal basis is our legitimate interest in preventing abuse and limiting cost, and you can object. We also cap the total number of free corrections per day. If a second person on your connection tries the same day, the free correction may be refused until the next day.

Free tries that need an account (a speaking exam call and a mock exam part) are limited to one per person. For that we keep a coded form of your email address for 12 months, as described under "How long we keep it".

Analytics and your choice

We do not record your screen. Browser and app analytics (PostHog) start only if you say yes in the banner, and nothing is stored on your device for them before that. Saying no changes nothing about the service. You can change your answer at any time in Settings in the app, or with the "Analytics" link at the bottom of this site. We keep two small cookies: one remembers your answer, the other when you gave it. Sign-in also uses the cookies it needs to keep you signed in. If a partner's link brought you here, we keep the partner's code on your device, and then on your account, only if you say yes, so we can pay the partner. If you say no and still want to credit a partner, you can type the partner's code when you sign up. If you say no later, we remove the ad and campaign labels and a partner's code from your account, unless you typed the code yourself or have already paid. In those cases the code stays, so that we can pay the partner or take the share back after a refund. Once we have your answer, our server follows it too: if you say no, it sends nothing about you to PostHog except the plain counts of sales and refunds.

Transfers outside the EU

Some providers (Clerk, ElevenLabs, OpenAI, Anthropic and Google) are in the United States. For them we rely on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's standard contractual clauses. You can ask us at the address above for a copy of the safeguard that applies to a provider.

How long we keep it

We keep account data while your account is open. You can ask us to delete your account and your writing. Speaking conversations and simulations: ElevenLabs keeps the voice recording only until we have marked it. We then delete it, normally within about 10 minutes. If that deletion fails, ElevenLabs deletes it itself after 2 days at most. We keep the text of what was said and your scores in your account. The audio of a short spoken answer in an exercise is sent for transcription and scoring and is not kept by us. We do not keep recordings of short answers. Payment and withdrawal records: 7 years, as Dutch tax law requires, and 10 years for sales under the EU One Stop Shop for VAT.

After you delete your account we delete everything, except what is listed here. We remove your name, your email and your account number from these records.

For each payment: the Mollie payment number, the date, the amount, the VAT, the country, whether it was refunded or charged back, and which version of the "start my access now" wording you accepted. If you withdrew: when you asked, the state of the refund and the refund's Mollie number. If a partner's link brought you: the partner's code on that payment, so that we can pay the partner or take the share back after a refund. Why: tax law makes us keep the books, and we may have to show what you were told about withdrawal. How long: to the end of the 7th year after the year of the sale, or the 10th under the One Stop Shop. Then we delete them. These records can still be matched to you through the payment number, because Mollie keeps its own record of the payment under the rules that apply to it.

We also keep your account number alone on a list of deleted accounts, so that an old sign-in cannot bring the account back. A refund or a bank reversal still works after you delete your account. If a payment you left open goes through after you delete your account, we refund it in full automatically and keep the same records of that payment.

We keep a coded version of your email, which free try you used and the date, for 12 months, to stop repeat free tries. It is still personal data. You can object. After a withdrawal, we count both free tries as used, on this account and on any later account with your email, even if you never used them. We also keep that coded email with the number of practice calls you made on that purchase, for 12 months after the withdrawal, so that withdrawing and buying again does not reset the limits on calls. It is still personal data. You can object.

Your rights

You can ask to see your data, correct it, delete it, limit its use, move it to another service, or object to its use. You can withdraw consent at any time. To use a right, write to the contact above. You can also complain to a data protection authority: our lead authority is the Dutch Autoriteit Persoonsgegevens, and in Italy you can go to the Garante per la protezione dei dati personali.

Children

The service is for adults. You must be 18 or older. We do not knowingly collect data from anyone under 18.

Changes

If we change this policy in a way that matters, we will say so on this page and, if we can, by email.