Privacy

Privacy Policy

Effective 10 May 2026. Last updated 10 May 2026.

Operator note (remove before launch)

This policy is a working draft written to be GDPR-aligned and to reflect the actual data flows in the product as built. It must be reviewed by an Irish data-protection solicitor before going live, particularly the sections on children's data, Stripe and Anthropic processing, and cross-border transfers to the United States.

1. Who we are

English Hub Plus ("we", "us", "our") is operated by English Hub, a sole-trader business registered in Ireland. Our registered contact address is provided on request at hello@lcenglishhub.ie. For the purposes of the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the Irish Data Protection Act 2018, we are the data controller for personal data processed through this service.

2. The personal data we collect

We collect only what we need to run the service.

  • Account data. Name, email address, hashed password, date of birth (used to confirm you are old enough to consent and to determine if parental consent is required), exam year, user type (student, teacher, parent), and school selection.
  • Learning data. Essays you upload, questions you ask, quiz answers, study planner inputs, bookmarks, streak history, XP, badges, and the timestamps of your activity on the platform.
  • Payment data. Billing details are collected by our payment processor, Stripe. We never see or store your card number. We retain only the Stripe customer reference, subscription state, plan, and invoice metadata needed to provide the service.
  • School roster data. Where your school holds a license, we hold the roster information your school provides (name, email, class, year group, teacher assignment).
  • Technical data. IP address (briefly, for security and abuse detection), browser type, device type, and the pages you visit. Captured by our hosting and analytics providers.
  • Communications. Emails you send to us, support tickets, and any feedback you submit.

3. Why we process your data and the lawful basis

  • To deliver the service you signed up for (account creation, content access, AI essay feedback, progress tracking). Lawful basis: performance of a contract.
  • To take payment and manage your subscription. Lawful basis: performance of a contract.
  • To send service emails (welcome, billing, password reset, account changes). Lawful basis: performance of a contract.
  • To send marketing emails (study tips, product updates). Lawful basis: your consent. You can withdraw at any time.
  • To prevent abuse, debug issues, and secure the platform. Lawful basis: legitimate interests.
  • To comply with legal obligations (tax records, responding to lawful requests). Lawful basis: legal obligation.

4. Children and under-16s

The service is designed for students preparing for the Irish Leaving Certificate and Junior Cycle. Some users will be under 16. Where the user is under the digital age of consent in Ireland (16), we require a parent or guardian to confirm the account during signup and to be the contractual party for any paid subscription. Schools holding a class license are responsible for obtaining the appropriate school-level consent before adding pupils to the roster.

We collect only the data needed to deliver age-appropriate study material and progress tracking. We do not profile children for advertising. We do not sell children's data. Parents and guardians may request access, correction, or deletion of their child's data at any time.

5. The third-party processors we use

We use a small number of trusted processors. Each is bound by a data-processing agreement. We have selected providers that offer EU data residency where possible.

  • Supabase (database, authentication). Hosting region: EU (Frankfurt).
  • Vercel (web hosting, edge functions). Hosting region: global edge with EU primary.
  • Stripe Payments Europe (payment processing, subscription billing). Stripe is the controller for the card data it processes.
  • Resend (transactional email).
  • Anthropic (AI essay feedback, AI question drafting). Essay text and question text are sent to Anthropic to generate the response. Anthropic processes this data on our instructions and does not use it to train its models when accessed via the commercial API.
  • Microsoft Clarity and Google Analytics 4 (web analytics on the public marketing site only, where you have consented via the cookie banner).

6. International data transfers

Some of our processors are based outside the European Economic Area, primarily in the United States. Where personal data is transferred to a country that the European Commission has not ruled adequate, we rely on the European Commission's Standard Contractual Clauses, supplemented by the additional safeguards each processor offers (encryption in transit and at rest, role-based access, audit logging).

7. How long we keep your data

  • Active accounts. Held for the lifetime of your subscription plus 30 days after cancellation, after which your account and all linked learning data are deleted.
  • Cancelled or expired accounts. Deleted after 30 days unless you have requested earlier deletion.
  • Billing records. Retained for 6 years to satisfy Irish revenue and accounting law.
  • Email logs. Held for 90 days for deliverability debugging.
  • Marketing list. Held until you unsubscribe, then removed within 7 days.

8. Your rights

Under the GDPR you have the right to access the personal data we hold about you, to ask us to correct it, to ask us to delete it, to ask us to restrict our processing of it, to object to certain processing, and to receive a portable copy of it. You can exercise most of these rights from your account page, or by writing to hello@lcenglishhub.ie.

If you are not satisfied with how we have handled your personal data you have the right to complain to the Irish Data Protection Commission (dataprotection.ie).

9. How we secure your data

We use industry-standard safeguards: encrypted transport (TLS 1.2+), encrypted storage at rest, hashed passwords (bcrypt), row-level security on every database table so that one user cannot read another user's data, role-based admin access, and audit logging of administrative actions. We never transmit unredacted essay text or personal data over insecure channels.

10. Cookies and similar technologies

We use a small number of strictly necessary cookies to keep you signed in and to remember your preferences. These do not require consent. On the public marketing site we additionally use analytics cookies (Microsoft Clarity, Google Analytics 4) only where you have given consent through our cookie banner. You can withdraw consent at any time from the banner footer.

11. Changes to this policy

We will post any material changes here and notify subscribers by email at least 14 days before the change takes effect. The "Last updated" date at the top of this page reflects the most recent revision.

12. Contact us

Email: hello@lcenglishhub.ie. We aim to respond within 5 working days.