Privacy Policy
Who We Are
ESLeCollege is an educational platform providing exam preparation resources for secondary-school English learners (such as IB English B, IGCSE ESL, Cambridge B2 First, A2 Key and B1 Preliminary). The Service is operated by ESLeCollege, based in Phuket, Thailand.
Our website is hosted by SiteGround on servers located in Singapore.
Who This Policy Applies To
This policy applies to all visitors and registered users of ESLeCollege, including:
- Students who register for a full account
- Students who register for a free vocabulary games account
- Parents and guardians who give consent for a child's account
- Teachers who register for content access
- Visitors who use the site without registering
What Data We Collect and Why
| Data type | What it includes | Why we collect it |
|---|---|---|
| Account data | Full name, email address, encrypted password. School students also provide their school name, class, year group, and exam type. | To create and manage your account and personalise your experience. |
| Date of birth | Your date of birth (or, as a fallback, your year group). | To establish your age so we can apply the correct protections and, where required, request a parent or guardian's consent. |
| Parent / guardian details | For students under 13: the name and email address of a parent or guardian, and our record of their consent. | To request, obtain and record verifiable guardian consent before the account is activated. |
| Consent record | The date, time and IP address recorded when you — or your guardian — agree to this policy or give consent, kept as a dated audit log. | To maintain an auditable consent record as required by data protection law. |
| Student work | The written work you submit (essays and short answers) and spoken work (audio recordings of speaking tasks and their transcripts). | To mark your work and give you feedback. See Section 04 for how AI is used. |
| Educational progress | Quiz scores, activity types, percentage scores, raw scores, lesson URLs, and completion dates. | To display your progress dashboard and award milestones. |
| Vocabulary game data | Words studied, game results, XP points, vocabulary strength scores, and login streaks. | To track vocabulary progress and show your leaderboard position. |
| Usage & technical data | IP address, browser type, device type, and pages visited. | To maintain and improve the Service and detect technical issues. |
| Cookies | Session cookies (login), preference cookies (settings), security cookies, and Google Analytics cookies. | To operate the site and understand aggregate usage patterns. |
You can disable cookies in your browser settings, but this may prevent some parts of the Service — including login — from working correctly.
How We Use AI to Mark and Support Learning
Part of the Service marks written and spoken work and gives feedback using artificial-intelligence (AI) tools provided by third parties. This means that when you submit certain work, the content of that work is sent to those providers to be processed:
- Written tasks — the text of essays and short answers is sent to Anthropic (Claude) to generate marks and feedback.
- Speaking tasks — an audio recording is sent to ElevenLabs to produce a transcript, and that transcript is then sent to Anthropic (Claude) for marking and feedback.
These providers process the data on servers in the United States. We use them only to mark your work and give feedback. We do not sell this data, and we do not use it for advertising.
International data transfers
Because these AI providers are located in the United States, using them involves transferring personal data outside Thailand. Where the law requires consent for such transfers, we obtain it before the work is processed:
- For students aged 13 or over, consent is given by the student when they register and agree to this policy.
- For students under 13, consent is given by a parent or guardian before the account is activated (see Section 06).
- For students registered through a school, we may rely on the school's authorisation as described in Section 06.
You can withdraw consent at any time (see Sections 06 and 07). If you do, we will stop sending that student's work to these providers.
Third-Party Services
We use the following third-party services which may process data in connection with the Service:
- Anthropic (Claude AI) Used to mark students' written work and speech transcripts and to generate feedback, and to generate example sentences for vocabulary. Where it is used for marking, the student's submitted work (essay or short-answer text, and speech transcripts) is sent and processed in the United States. See Anthropic's Privacy Policy.
- ElevenLabs Used to transcribe students' speaking-task audio into text (speech-to-text) and to generate audio pronunciations for vocabulary words. Where it is used for speaking tasks, the student's audio recording is sent and processed in the United States. See ElevenLabs' Privacy Policy.
- Google Analytics Tracks site traffic and usage in aggregate. Data is processed by Google. You can opt out using the Google Analytics opt-out browser add-on. See Google's Privacy Policy.
- SiteGround Our hosting provider stores all site data including account information, on servers in Singapore. See SiteGround's Privacy Policy.
- Freepik Provides images for vocabulary words. Only search terms are sent — no personal data. See Freepik's Privacy Policy.
- Stripe If paid subscriptions are introduced, payment processing will be handled by Stripe. ESLeCollege will not store card details. See Stripe's Privacy Policy.
Children and Students Under 18
ESLeCollege is used by secondary-school students, including children under the age of 13. We ask every student for their date of birth when they register, and we ask existing students to confirm theirs. How we handle an account depends on the student's age:
Students under 13
The account is created but held inactive until a parent or guardian gives consent. We email the guardian a secure, time-limited link that explains what they are being asked to consent to — the creation of the account, the storage of the student's progress and work, and the processing of the student's written and spoken work by AI providers in the United States (see Section 04). The account is activated only when the guardian clicks to confirm. We keep a dated, logged record of that consent.
Students aged 13 to 17
Students aged 13 and over may register and give consent for themselves, including consent to the AI processing of their work and the related transfer of data to the United States described in Section 04.
Students registered through a school
Where a school registers students as part of its educational provision, we may rely on the school's authorisation and the consent it has obtained from parents and guardians, in line with the school's own privacy arrangements.
Withdrawing consent
A parent or guardian can withdraw consent at any time by contacting us. When consent is withdrawn we will deactivate the account and stop processing the student's data, including stopping any further AI processing of their work.
Consent and How to Withdraw It
We record consent at the point it is given — by a student aged 13 or over at registration, or by a parent or guardian when they confirm a younger student's account. Each consent record includes the date, time and IP address, kept as an auditable log so we can demonstrate that valid consent was obtained.
You can withdraw consent at any time:
- Students aged 13 or over can withdraw consent by deleting their account from their dashboard.
- Parents and guardians can withdraw consent for a child by contacting us.
Withdrawing consent will deactivate the account and stop further processing, including AI processing of submitted work.
Legal Basis for Processing (GDPR)
Where GDPR or UK GDPR applies, our legal bases for processing personal data are:
- Contractual necessity — to provide the Service you have registered for
- Legitimate interests — to maintain the security and integrity of the Service and to improve it
- Consent — recorded at registration; for children below the applicable age of digital consent, consent is given by a parent or guardian. Consent is also the basis on which we transfer student work to AI providers outside Thailand. You may withdraw consent as described in Section 07.
Thailand Personal Data Protection Act (PDPA)
As an operator based in Thailand, we comply with the Personal Data Protection Act B.E. 2562. You have the right to access, correct, delete, and object to the processing of your personal data.
Where we transfer personal data outside Thailand — for example, sending student work to AI providers in the United States (Section 04) — we do so on the basis of the consent described in Sections 06 and 07. To exercise your rights, contact us via our contact page.
Data Retention
We retain your account data and educational progress for as long as your account is active.
- Unverified accounts (registration email never confirmed) are automatically deleted after 30 days
- Accounts awaiting guardian consent that is never given are treated as inactive and may be removed
- If you delete your account, all associated data — quiz results, vocabulary progress, milestones, XP, and submitted work — is permanently deleted immediately
- Consent and guardianship records may be retained after an account closes, for as long as needed to evidence that valid consent was obtained and to meet our legal obligations
- We do not retain backup copies of deleted personal data beyond our standard hosting backup window (typically 30 days)
Your Rights
Depending on your location, you may have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Request deletion of your data — you can do this yourself using the Delete my account button in your dashboard
- Object to or restrict certain processing
- Receive your data in a portable format
To exercise any of these rights, use the self-service deletion option in your dashboard or contact us via our contact page. Parents and guardians may exercise these rights on behalf of a child under 13.
Security
We use industry-standard measures to protect your data, including encrypted password storage, HTTPS throughout the site, and access controls limiting who can view student data. No method of internet transmission is 100% secure, and we cannot guarantee absolute security.
Changes to This Policy
We may update this policy from time to time. We will notify registered users (and, where relevant, parents and guardians) by email of any material changes and update the effective date at the top of this page.