Privacy Policy

This Privacy Policy applies to englishtestpractice.com, operated by:

International Test Limited

71–75 Shelton Street, Covent Garden, London, United Kingdom WC2H 9JQ

Company No: 15121723  ·  VAT No: GB506005832

For privacy-related enquiries: hello@englishtestpractice.com

We collect the following categories of personal data:

• Account data: email address and password (hashed) when you register.
• Test results: your answers, section scores, band scores and AI-generated feedback for each practice test you complete.
• Payment information: transaction amount, currency and Stripe payment intent ID. We do not store card numbers — all card processing is handled by Stripe.
• Usage data: pages visited, test sessions started, browser type, device type and IP address (collected via Google Analytics).
• Communications: emails you send to our support address.

We do not collect sensitive personal data (health, ethnicity, religion, etc.).

• Account management: to create and maintain your account, authenticate you and allow access to purchased tests.
• Scoring & feedback: to evaluate your responses, calculate band scores and generate AI written/speaking feedback via ElevenLabs.
• Invoicing & receipts: to generate VAT invoices and send purchase confirmation emails.
• Transactional emails: to deliver your score results and invoice via Resend.
• Analytics & improvement: to understand how users navigate the platform and improve our tests (Google Analytics).
• Legal compliance: to comply with UK/EU tax, accounting and data protection obligations.

We share your data only with trusted processors under appropriate data processing agreements:

• Supabase — database and authentication (EU region). Stores your account data and test results.
• Stripe — payment processing. Handles all card transactions; subject to PCI-DSS compliance.
• ElevenLabs — AI speech evaluation. Your speaking audio is sent for scoring; audio is not retained beyond processing.
• Resend — transactional email delivery (invoice and score emails).
• Google Analytics — anonymised usage analytics. IP addresses are anonymised before storage.
• Google Ads — conversion tracking for advertising campaigns. No personal data beyond conversion events is shared.

• Contract performance: processing necessary to provide the service you purchased (account, tests, scoring).
• Legitimate interests: analytics, platform improvement and fraud prevention.
• Legal obligation: invoicing and tax record-keeping.
• Consent: non-essential cookies and marketing analytics (managed via cookie consent).

• Account and test data: retained while your account is active, and for up to 3 years after deletion to satisfy legal obligations.
• Payment and invoice records: retained for 7 years as required by UK tax law.
• Analytics data: retained for 14 months (Google Analytics default).
• Speaking audio: not stored — processed in real-time and discarded.

As a data subject under UK/EU GDPR, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — request correction of inaccurate or incomplete data.
• Erasure — request deletion of your data (subject to legal retention obligations).
• Portability — receive your data in a structured, machine-readable format.
• Restriction — request that we limit processing of your data in certain circumstances.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — withdraw any consent you have given at any time.

To exercise any right, email us at hello@englishtestpractice.com. We will respond within 30 days. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO).

We use essential cookies for authentication and session management, and optional analytics/marketing cookies (Google Analytics, Google Ads). You can manage your cookie preferences at any time via our Cookie Policy page. Consent is managed through Cookiebot.

We implement industry-standard security measures including HTTPS encryption for all data in transit, bcrypt password hashing, and row-level security policies in our database. Stripe handles all payment card data under PCI-DSS Level 1 compliance. No system is completely secure; please use a strong, unique password for your account.

Some processors (ElevenLabs, Google) may process data outside the UK/EEA. Where this occurs, we rely on Standard Contractual Clauses or equivalent safeguards approved by the ICO.

This Privacy Policy is governed by and construed in accordance with the laws of England and Wales. Any disputes shall be subject to the exclusive jurisdiction of the courts of England and Wales.

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a notice on the website. Continued use of the service after changes constitutes acceptance of the updated policy.