Privacy notice
Part A applies now, during the beta. Part B applies from 1 January 2027, when accounts and subscriptions open; we will email everyone with a beta registration before then.
The short version (for young learners)
Learnington is a place to learn English. - What you do in the town (your stamps, your words, your settings) stays on your own device for now. We can't see it. - When accounts arrive, your teacher or a parent will help you make one. If you are under 14, a parent or your teacher has to say yes first. - We never sell your information and we never show adverts. - If you use the microphone, your browser may send your voice to the company that made it, so it can understand you. Ask a grown-up first. - If something worries you, tell a parent or your teacher. They can write to us at hello@mylearnington.com.
1. Who is responsible for your data
- Controller: Justin Faircloth, trading as "Learnington", sole trader (autónomo)
- Email (privacy contact): hello@mylearnington.com
- Website: mylearnington.com
We have not appointed a Data Protection Officer: Learnington is not a public body, does not monitor people systematically on a large scale and does not process special categories of data on a large scale (art. 37 GDPR, art. 34 LOPDGDD).
2. Basic information at a glance (art. 11 LOPDGDD)
| Controller | Justin Faircloth ("Learnington") |
| Purposes | Give you access to the beta; from 1 Jan 2027, run your account, save your progress, give teachers a class view, bill subscriptions; keep the site secure; answer your messages; send a newsletter only if you ask for it |
| Legal bases | Contract · consent (a parent's or guardian's consent for children under 14; newsletter) · legitimate interest (security, improving the site from ratings and feedback) · legal obligation (tax records) |
| Recipients | Providers working for us under contract: Cloudflare (hosting and database); from 1 Jan 2027 also Resend (email), Paddle (payments; it is the seller of record and issues your invoice) and Anthropic (the teachers' game-building tool). We never sell data and never share it for advertising. |
| International transfers | Only with legal safeguards (section 10) |
| Your rights | Access, correction, deletion, objection, restriction, portability, withdrawing consent; complaint to the AEPD |
Part A: the beta (from December 2026)
3. What we collect in the beta
3.1 Registration (/join). To enter the beta you give us your name, email address, who you are (teacher, student, academy or parent), country, optionally the levels you are interested in and how you heard about us, and you tick a box to accept these terms. You can also tick a separate box to receive our newsletter (never pre-ticked; you can unsubscribe in every email). We record the time you registered and the time you ticked the box. The beta is for adults: children use Learnington in the beta through their teacher's screen or with a parent.
3.2 The access cookie. Registering sets one cookie, lt_beta, which lets the site recognise your browser until the beta ends on 31 December 2026. It contains a random code and nothing about you. It is strictly necessary to provide the access you asked for, so it needs no consent (art. 22.2 LSSI-CE). The Cookie Policy lists everything we store.
3.3 Ratings and feedback. If you rate an item with stars, we store the rating with your registration so that you can change it later and so that we can see which items need work. If you fill in the feedback page, we store what you write (the page you were on, stars, what you used, what was good, what was bad, and an optional quote). We use ratings and feedback to improve the site; that is our legitimate interest, and you can object at any time. We publish a quote only if you tick "you may quote me", and we will still ask you again before using it.
3.3a What you open. While you have beta access, the site notes which films, tools, games and places you open: at most one note per item per day, with the date but no time and no IP address, and, if the page reports it, how long it took to load. The note is stored under a code made from your registration, not under your name or email, and is deleted after 90 days. We look at it only in totals (what is used, what people come back to, what loads slowly) to decide what to fix; that is our legitimate interest, and you can object at any time. It is deleted with your registration if you ask us to delete it.
3.4 Bot protection. The registration page uses Cloudflare Turnstile to tell people from bots. It runs on our hosting provider's servers, uses no tracking cookies and does not profile you. (Cloudflare's privacy policy covers it.)
3.5 What stays on your device. Inside the town, your settings (town, level, accent, sound), your progress (stamps, word bank, review cards, saved mistakes), drafts in the Writing Studio and, for teachers, lesson plans and pasted progress codes are saved in your browser's local storage. We do not receive, see or keep a copy of any of it during the beta. To delete it, clear this site's data in your browser. A progress code passes directly from a student to their teacher and never through us; share it only with your own teacher.
3.6 Fonts, voices and microphone. - Fonts are served from our own server; nothing is loaded from Google. - Speech recognition (Pronunciation Studio, Talk to the Town) uses your browser's built-in service. In some browsers (for example Google Chrome) the browser sends your voice to the browser maker's servers to turn it into text, under that company's privacy policy. We never receive the audio. Your browser asks for permission first and you can say no. Recordings you make to compare with a model voice stay on your device and are gone when you leave the page. - Read-aloud uses your device's voices; some "online" voices send the text to the browser maker. - Children should use the microphone only with a parent's, guardian's or teacher's permission.
3.7 Hosting and logs. Our pages, the registration list, ratings and feedback are hosted by Cloudflare (Cloudflare, Inc.; EU services provided through Cloudflare Portugal / Cloudflare Germany, under Cloudflare's data processing addendum). Our database is set to be stored in Western Europe. Cloudflare records technical data for every request (IP address, time, page, browser type) to deliver the pages and keep them secure; we keep those logs for no more than 30 days.
3.8 Email. If you email hello@mylearnington.com we use your address and message only to reply, and delete the exchange after 12 months unless we need it for a legal claim.
4. Why we use beta data, and the legal basis
| Purpose | Legal basis |
|---|---|
| Giving you beta access until 31 December 2026 and recognising your browser | Contract (art. 6(1)(b)) |
| Storing ratings and feedback to improve the site | Legitimate interest (art. 6(1)(f)); you may object |
| Counting which items are opened, per day and under a code, to see what is used and what to fix | Legitimate interest (art. 6(1)(f)); you may object |
| Newsletter | Consent (art. 21 LSSI-CE), withdrawable in every email; never sent to children |
| Security, bot protection, logs | Legitimate interest (art. 6(1)(f)) |
| Emailing you before accounts launch about how your access continues | Contract (a service message about the access you asked for) |
5. How long we keep beta data
| Data | How long |
|---|---|
| Registration (name, email, role, country, levels, consent record) | Until 30 days after accounts launch, when it is either linked to the account you create or deleted; if you ask, deleted straight away |
| Access cookie | Until the beta ends (31 December 2026) |
| Which items you opened (the day only, under a code) | 90 days |
| Ratings and feedback | For as long as the item exists; feedback is anonymised (registration link removed) 12 months after the beta |
| Logs | 30 days |
Part B: accounts and subscriptions (from 1 January 2027)
6. Accounts: what we collect and why
We collect only what we need, and we never ask children for photos, phone numbers, surnames, school reports or identity documents.
| Who | Data | Why |
|---|---|---|
| Teachers | Name or nickname, email, password (stored only as a strong hash), country, the classes you create, homework you set, your Build-your-own game sets | To run your account and classes |
| Academy administrators | As teachers, plus the academy's name, billing email and the teachers you invite | To run the academy's plan |
| Students 14 and over (own account) | Nickname, email, password (hashed), age band (14–17 or 18+; never your date of birth), level, progress, results, passport stamps, word bank | To run your account and track your learning |
| Students under 14 (own account) | Nickname (not a full name), age band, level, progress, results, passport, word bank, and the email of the parent or guardian who consented | To run the account safely, with parental consent |
| Students in a class account (created by a teacher or academy) | Nickname chosen by the teacher, a 4-digit PIN (hashed), class, level, progress, results | To run the class; see "accounts created by a teacher or school" below |
| Parents and guardians | Email, the record of consent (date, time, text version, a hashed IP address) | To prove consent and let you manage the child's data |
| Everyone with an account | Security records: sign-in times, a summary of the device, failed attempts, a hashed IP address; an audit trail of sign-ins, role changes, deletions and exports | To keep accounts secure and to answer "who did this" questions |
One device at a time. An account is signed in on one device at a time; signing in elsewhere signs the first device out, and adults get an email the first time that happens in a day. This is part of the service and helps stop account sharing.
Results and the class view. Every quiz, game or film check you finish while signed in is saved (item, topic, score, time). Teachers see the results of the students in their classes, including per grammar point, so they can plan lessons. Academy administrators see each class's summary and, if they open a class, the same as its teacher. Students see only their own results. We never show public leaderboards with real names, and a class "speed round" board shows nicknames only within that class.
Accounts created by a teacher or school. When a teacher or academy creates class accounts, the teacher or academy decides how the students' data is used (they are the controller) and we process it for them under the data processing terms in Annex B of the Terms of Use. The teacher confirms, when creating the accounts, that they have the families' permission. Questions about those accounts go to the teacher or school first; we help them answer.
Build-your-own games (teachers only). A teacher's request (a grammar point, a vocabulary topic or word list, a level, an audience, an optional short note) is sent to Anthropic to generate the content set. No student data is sent, and teachers are told not to put personal information in the note. Anthropic processes it under its commercial terms and data processing addendum; under those terms it does not use the content to train its models. The set is checked automatically and then read and approved by the teacher before any student can see it.
7. Children and consent
- Sign-up asks your age band neutrally; nothing is pre-filled.
- Under 14, own account: we ask for a parent's or guardian's email and send them a plain explanation of what we store and a confirmation link. The account cannot open content until the adult confirms; if nobody confirms within 14 days the account is deleted. We keep the record of consent. (This is our "reasonable effort" under art. 8(2) GDPR.)
- Under 14, class account: created by the teacher or school, which is responsible for the families' permission (section 6).
- Parents and guardians can see, export, correct or delete their child's data and withdraw consent at any time by emailing hello@mylearnington.com; we act within 30 days. Children under 14 exercise their rights through their parents or guardians (art. 12(6) LOPDGDD).
- We do not use children's data for marketing or profiling, show them adverts, or let them chat with strangers. There is no messaging between users.
- The age threshold is 14 today (art. 7 LOPDGDD). If Spain raises it to 16, we will change the threshold and tell account holders.
8. Payments
Subscriptions are sold by Paddle (Paddle.com Market Ltd, London), our merchant of record: Paddle is the seller on your invoice, charges the VAT of your country and handles refunds and chargebacks under its own privacy policy, as an independent controller. We never see or store your card number. From Paddle we receive your name, email, plan, payment status, the country used for VAT and the last digits of your card, so that we can unlock your account and show you your invoices. Only adults can buy a subscription; a parent, guardian, teacher or academy buys for a child.
9. Legal bases in Part B
| Purpose | Legal basis |
|---|---|
| Running accounts, saving progress and results, the class view | Contract (art. 6(1)(b)); for a child, the contract is with the parent, guardian or school |
| Accounts for children under 14 who sign up themselves | Parental consent (arts. 6(1)(a) and 8 GDPR; art. 7 LOPDGDD) |
| Class accounts created by a teacher or school | We process on the school's or teacher's instructions (art. 28); their lawful basis is their own |
| Billing, invoices, tax records | Contract and legal obligation (art. 6(1)(c)) |
| Security, abuse prevention, audit trail, "signed in elsewhere" emails | Legitimate interest (art. 6(1)(f)), weighed with particular care where children are involved |
| Service emails (verification, reset, renewal, plan ending) | Contract |
| Newsletter and offers | Consent only; never to children |
| The teachers' game-building tool | Contract (a feature of the teacher plan) |
10. Who we share data with, and international transfers
| Provider | Role | Data | Where |
|---|---|---|---|
| Cloudflare, Inc. | Hosting, database, bot protection | Everything on the site; database stored in Western Europe | EU servers; Cloudflare is certified under the EU–US Data Privacy Framework and provides Standard Contractual Clauses in its DPA |
| Resend, Inc. (from 1 Jan 2027) | Sending account, consent and service emails | Email address, the email's content | USA, under Standard Contractual Clauses in its DPA |
| Paddle.com Market Ltd (from 1 Jan 2027) | Payments, as merchant of record (independent controller) | Billing data | UK (adequacy decision) and its own processors |
| Anthropic, PBC (from 1 Jan 2027) | Generating teachers' game content | The teacher's request only | USA, under Standard Contractual Clauses in its data processing addendum |
| Our gestoría (from 1 Jan 2027) | Accounting | Payout and invoice summaries from Paddle; no customer data beyond what Paddle's statements carry | Spain |
| Tax authorities, courts, police | Only where the law requires it | As required | Spain / EU |
We prefer EU storage, and where a provider processes data in the United States we rely on an adequacy decision (the Data Privacy Framework, where the provider is certified) or Standard Contractual Clauses (arts. 44–49 GDPR). Ask us for details at any time.
11. How long we keep data (Part B)
| Data | How long |
|---|---|
| Account and progress data | While the account exists. After 24 months without a sign-in we email a warning and delete the account 30 days later. Deleted accounts are purged within 30 days; results in a class view show as "deleted student" until then. |
| Class accounts | Until the teacher deletes them or the class is archived for 12 months, whichever is first |
| Records of parental consent | For the life of the child's account, plus 3 years |
| Security logs and audit trail | Logs 30 days; audit trail 12 months |
| Billing records | As Spanish tax and commercial law requires |
| Game sets created by a teacher | While the teacher's account exists |
| Backups | Rolling 30-day backups of the database, deleted on the same schedule |
Where the law requires it, data is "blocked" rather than deleted for the legal period (art. 32 LOPDGDD).
12. Your rights
You can ask us to access, correct, delete, restrict or move your data, to object to uses based on legitimate interest, and to withdraw consent (without affecting what was done before). From 1 January 2027 the account page has Export my data and Delete my account buttons; otherwise email hello@mylearnington.com with "Data rights" in the subject. We may ask you to confirm your identity. We reply within one month (extendable by two months for complex requests; we will tell you). It is free. Parents and guardians act for children under 14.
If you are not happy with our answer, you can complain to the Agencia Española de Protección de Datos, C/ Jorge Juan 6, 28001 Madrid, www.aepd.es, or to your own country's authority.
13. Security
HTTPS everywhere; passwords and PINs stored only as salted hashes; sessions bound to one device; rate limits and bot protection on sign-in and sign-up; a content-security policy on account pages; access to personal data only by the account's owner, their teacher or academy where this policy says so, and Justin for support; two-step sign-in on our own administrative accounts; daily backups; an audit trail. If a breach risks your rights, we will notify the AEPD within 72 hours and tell you without undue delay where the law requires it (arts. 33–34 GDPR).
14. No advertising, no analytics (for now)
Learnington shows no adverts and runs no analytics or tracking scripts. If we ever add privacy-friendly statistics, we will update this policy and the Cookie Policy first and ask for consent where the law requires it; nothing of the kind will run in Kids mode.
15. Changes
We update the date at the top when this policy changes. Before Part B takes effect, and before any later change that matters, we email account holders (and the parents of under-14s) and show a notice on the site. Where a change needs new consent, we ask for it.
Resumen en español
- Responsable: Justin Faircloth, autónomo, hello@mylearnington.com. Datos de contacto para privacidad: los mismos.
- Durante la beta (desde el 1 de diciembre de 2026): para entrar hay que registrarse con nombre, correo electrónico, perfil (profesor/a, alumno/a, academia o familia), país y niveles de interés. Guardamos ese registro, una cookie técnica de acceso (
lt_beta, hasta el 31 de diciembre de 2026), las valoraciones con estrellas y los comentarios que nos envíes. El progreso y los ajustes dentro de la ciudad se guardan solo en tu navegador. No hay publicidad, ni analítica, ni seguimiento. - Desde el 9 de enero de 2027 (cuentas y suscripciones): cuentas de alumno, profesor y academia; el progreso, el pasaporte y el banco de palabras pasan a la cuenta; panel de clase para el profesorado; pagos a través de Paddle (que emite la factura); una herramienta de creación de juegos con IA solo para profesores. Los menores de 14 años necesitan el consentimiento de sus padres o tutores, o una cuenta creada por su profesor/a o centro (art. 7 LOPDGDD).
- Bases jurídicas: contrato, consentimiento (padres/tutores para menores de 14; boletín), interés legítimo (seguridad) y obligación legal (facturación).
- Derechos: acceso, rectificación, supresión, oposición, limitación, portabilidad y retirada del consentimiento, escribiendo a hello@mylearnington.com. Reclamaciones: AEPD, www.aepd.es.