Legal
Privacy Policy
What we collect when you practise for IELTS with Pandawise AI, why we need it, who we share it with and how to control it.
Pandawise AI · Updated · 7 min read
On this page
Pandawise AI is operated by the Pandawise AI team ("we", "us"). We are the data controller for the personal data described in this Privacy Policy, which explains what we collect when you use pandawiseai.com and the Pandawise AI app (the "Service"), why, who we share it with and what your rights are. It is written to meet the EU and UK General Data Protection Regulation (GDPR) and similar laws.
The short version
- We collect what we need to run your IELTS practice: your account, your answers and results, and your payments (through Stripe).
- Your speaking audio is sent to our speech provider to be transcribed in real time. We keep the transcript, not the recording.
- Your essays and transcripts are processed by AI providers to mark them and give feedback.
- We do not sell your personal data and we do not use advertising or tracking cookies.
- You can see, download, correct or delete your data at any time by writing to support@pandawiseai.com.
What we collect
Information you give us
- Account details: name, email address and profile image, through our sign-in provider Clerk (also when you sign in with Google or another provider).
- Study preferences: your IELTS module (Academic or General Training), target band, exam date or timeframe and daily study time, collected during onboarding.
- Your content: answers to questions, essays, speaking transcripts, notes, highlights, saved dictionary and vocabulary words, ratings, problem reports and messages you send us.
- Organisation details: if you apply for or join an organisation, the code you used, the organisation you belong to and, for staff, the information in the application.
Information created when you use the Service
- Learning data: lessons and tests started and completed, scores, estimated bands, AI feedback, time spent and progress.
- Usage and technical data: pages visited, features used, date and time of activity, device and browser type, IP address and error logs, used to keep the Service secure and working.
Speaking and microphone
When you use a speaking feature, the app asks for access to your microphone. Your voice is streamed to our speech provider (Deepgram) to transcribe it and run the AI examiner. We do not store your audio recordings; we store the text transcript of the conversation with your result.
Payment information
Payments are handled by Stripe. Stripe collects your card details directly; we never see or store your full card number. We receive and keep your plan, billing status, the amounts and dates of payments and basic billing details Stripe shares with us (such as your country and card brand), as needed for billing, tax and refunds.
Why we use your data, and our legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Create and manage your account, give you lessons, tests, results and AI feedback | Performance of our contract with you |
| Take payments, manage subscriptions, trials and refunds | Performance of contract; legal obligation (tax and accounting) |
| Share your results with an organisation you chose to join | Performance of contract (the organisation service you asked for) |
| Send service emails (welcome, receipts, security, important changes) | Performance of contract |
| Send progress reminders and product news | Legitimate interest or consent; you can unsubscribe at any time |
| Keep the Service secure, prevent fraud and abuse of trials and limits | Legitimate interest |
| Fix bugs, measure performance and improve content and features | Legitimate interest |
| Comply with the law, respond to authorities, enforce our Terms | Legal obligation; legitimate interest |
Where we rely on legitimate interest, we have weighed it against your rights; you can object at any time (see Your rights below).
AI processing
To mark writing and speaking, check typed answers and give feedback, we send the relevant content (for example your essay, transcript or answer and the question) to AI providers. We send only what is needed for the task and not your name or email. AI output is used to produce your results; it does not lead to decisions with legal or similarly significant effects on you, and bands are estimates for practice only.
Who we share data with
We share personal data only with:
- Service providers (processors) who run parts of the Service for us under data processing agreements, and only for that purpose:
| Provider | What for |
|---|---|
| Clerk | Sign-in, accounts and organisations |
| Stripe | Payments, subscriptions, invoices and fraud prevention |
| Vercel | Hosting, cookieless analytics and performance monitoring |
| Supabase | Database |
| OpenAI | AI marking and feedback |
| Deepgram | Speech-to-text, text-to-speech and the AI speaking examiner |
| UploadThing | File storage (audio, images and PDFs for lessons) |
| Resend | Sending emails |
| Better Stack | Error and server logs |
| Calendly | Booking intro calls for organisations (only if you book one) |
- Your organisation, if you join one using its link or code: its staff can see your name, email, IELTS module, target band, exam date, activity status and your results (read-only), in the app and through its API. They cannot see your payment details. Contact us to leave an organisation.
- Authorities, courts or advisers when the law requires it or to protect our rights, users or the public.
- A buyer or successor if our business or the Service is sold or merged, under the same protections.
We do not sell or rent your personal data and we do not share it for advertising.
International transfers
Some of our providers are located in, or access data from, countries outside the EU, EEA and UK, including the United States. Where that happens we rely on an adequacy decision (such as the EU-US Data Privacy Framework for certified providers) or on the European Commission's Standard Contractual Clauses (and the UK addendum), together with additional safeguards where needed.
How long we keep data
- Account and learning data: for as long as your account exists. When you delete your account, we delete or anonymise it within 30 days, apart from what we must keep.
- Billing records: as long as tax and accounting laws require (usually up to 10 years).
- Logs and security data: for a limited period, normally no more than 90 days, unless needed to investigate an incident.
- Backups: deleted data may remain in encrypted backups for a short time until they are overwritten.
- Anonymised data (which no longer identifies you, for example averaged scores) may be kept to improve the Service.
Your rights
Depending on where you live, you have the right to:
- access your data and get a copy of it;
- correct inaccurate data;
- delete your data ("right to be forgotten");
- restrict or object to our use of it, including for direct marketing;
- data portability: receive your data in a common, machine-readable format;
- withdraw consent at any time, where we rely on consent;
- complain to a data protection authority, in particular in the country where you live or work.
To use any of these rights, email support@pandawiseai.com from the email address of your account. We may need to verify your identity and will reply within one month. Using your rights is free.
You can unsubscribe from non-essential emails with the link at the bottom of every email.
Cookies and browser storage
We only use cookies and browser storage that are strictly necessary for the Service to work: your sign-in session (Clerk), security tokens, your theme choice, and saved exam drafts and notes. Stripe sets cookies on its checkout pages to prevent fraud. For performance and usage insights we use Vercel Analytics and Speed Insights, which are cookieless, aggregated and do not identify you or track you across other websites.
Because we do not set any non-essential or advertising cookies, we do not show a cookie consent banner. If that ever changes, we will ask for your consent first.
Security
We protect your data with industry-standard measures, including encryption in transit (HTTPS) and at rest, access controls, and providers with recognised security certifications. No system is completely secure, so we cannot guarantee absolute security. If a breach affects your data and puts your rights at risk, we will tell you and the authorities as required by law.
Children
The Service is meant for people aged 16 and over. Younger users may only use it with the consent and supervision of a parent or guardian. We do not knowingly collect data from children under the applicable age without that consent; if you believe we have, contact us and we will delete it.
Changes to this policy
We may update this Privacy Policy from time to time. We will post the new version on this page with a new "Updated" date and, for significant changes, tell you by email or in the app.
Contact
For any privacy question or request, write to support@pandawiseai.com.
Questions about this policy?
Write to us and a real person will get back to you, usually within a few working days.
support@pandawiseai.com