Privacy Policy

1. Introduction

exalang.ai is committed to maintaining the trust and confidence of our users. This Privacy Policy provides detailed information on how we treat personal data when you interact with our website, use our exam preparation tools, or subscribe to our educational services.

2. Data Collection

We collect information in the following categories:

• Information Provided by You: When you register for an account, subscribe to a plan, or contact our support team, we collect your name, email address, institutional affiliation (if applicable), and communication history.
• Usage Data: We automatically collect data regarding your interaction with the platform, including IP addresses, login timestamps, time spent on specific pages, and the sequence of your learning modules.
• Performance Data: To facilitate your learning, we store your responses to practice tests, diagnostic exam results, and progress metrics within the platform.
• Billing Information: We collect transaction history and subscription status. Financial transaction data (such as credit card numbers) is handled exclusively by our secure, PCI-DSS compliant third-party payment gateways. We never store full payment credentials on our servers.

3. Legal Basis for Processing

We process your personal data based on:

• Contractual Necessity: To provide the educational services requested by you.
• Legitimate Interests: To improve our services, ensure the security of our platform, and manage our business operations.
• Consent: Where we provide optional features or marketing communications, we process data based on your explicit consent.

4. How We Use Your Data

We utilize the collected data to:

• Authenticate your access to exalang.ai.
• Calculate and track your progress against CEFR standards.
• Personalize your study experience (e.g., recommending specific grammar or reading modules).
• Improve our technical infrastructure through data analytics.
• Provide customer support and resolve technical issues.

5. Third-Party Sharing and Sub-processors

We do not sell your personal data. We share data only with authorized sub-processors necessary to perform our services, including:

• Cloud Hosting Providers: To ensure high availability and data storage.
• Analytics Providers: To understand user engagement and optimize the user journey.
• Payment Processors: To manage subscription billing and renewals.
• Legal Authorities: When required by applicable laws or to protect our legal rights.

6. Data Retention

We retain your personal data only for as long as your account is active or as necessary to provide our services. Upon account deletion, we purge your personal identification data from our active databases, though some aggregated, anonymized performance data may be retained for long-term educational research and platform development.

7. Data Security Measures

We employ advanced security protocols, including:

• Encryption: Data is encrypted both in transit (using TLS/SSL) and at rest.
• Access Control: Access to your data is strictly limited to authorized personnel who require it to perform their job functions.
• Regular Audits: We continuously monitor our infrastructure for vulnerabilities.

8. International Data Transfers

As a global platform, your data may be transferred to and processed in countries other than your own. We ensure that such transfers comply with applicable data protection laws by using appropriate safeguards.

9. User Rights

Under applicable data protection laws (including GDPR and KVKK), you have the right to:

• Access and Portability: Request a copy of your personal data in a readable format.
• Correction: Ask us to rectify any inaccurate or incomplete information.
• Erasure (Right to be Forgotten): Request that we delete your data under specific conditions.
• Withdraw Consent: Where processing is based on consent, you may withdraw it at any time.

To exercise these rights, contact us at [email protected].

10. Children's Privacy

While our services are designed for students preparing for proficiency exams, we do not knowingly collect personal information from individuals under the age of 13 without verifiable parental consent. If we become aware that we have collected such data, we will take immediate steps to delete it.

11. Policy Updates

We may update this policy to reflect changes in our data practices or regulatory requirements. We will notify you of any material changes via email or through a notice on our website.