Privacy notice

Last updated: 4 November 2026. Questions: hello@mylearnington.com

Part A applies now, during the beta. Part B applies from 1 January 2027, when accounts and subscriptions open; we will email everyone with a beta registration before then.

The short version (for young learners)

Learnington is a place to learn English. - What you do in the town (your stamps, your words, your settings) stays on your own device for now. We can't see it. - When accounts arrive, your teacher or a parent will help you make one. If you are under 14, a parent or your teacher has to say yes first. - We never sell your information and we never show adverts. - If you use the microphone, your browser may send your voice to the company that made it, so it can understand you. Ask a grown-up first. - If something worries you, tell a parent or your teacher. They can write to us at hello@mylearnington.com.

1. Who is responsible for your data

We have not appointed a Data Protection Officer: Learnington is not a public body, does not monitor people systematically on a large scale and does not process special categories of data on a large scale (art. 37 GDPR, art. 34 LOPDGDD).

2. Basic information at a glance (art. 11 LOPDGDD)

Controller Justin Faircloth ("Learnington")
Purposes Give you access to the beta; from 1 Jan 2027, run your account, save your progress, give teachers a class view, bill subscriptions; keep the site secure; answer your messages; send a newsletter only if you ask for it
Legal bases Contract · consent (a parent's or guardian's consent for children under 14; newsletter) · legitimate interest (security, improving the site from ratings and feedback) · legal obligation (tax records)
Recipients Providers working for us under contract: Cloudflare (hosting and database); from 1 Jan 2027 also Resend (email), Paddle (payments; it is the seller of record and issues your invoice) and Anthropic (the teachers' game-building tool). We never sell data and never share it for advertising.
International transfers Only with legal safeguards (section 10)
Your rights Access, correction, deletion, objection, restriction, portability, withdrawing consent; complaint to the AEPD

Part A: the beta (from December 2026)

3. What we collect in the beta

3.1 Registration (/join). To enter the beta you give us your name, email address, who you are (teacher, student, academy or parent), country, optionally the levels you are interested in and how you heard about us, and you tick a box to accept these terms. You can also tick a separate box to receive our newsletter (never pre-ticked; you can unsubscribe in every email). We record the time you registered and the time you ticked the box. The beta is for adults: children use Learnington in the beta through their teacher's screen or with a parent.

3.2 The access cookie. Registering sets one cookie, lt_beta, which lets the site recognise your browser until the beta ends on 31 December 2026. It contains a random code and nothing about you. It is strictly necessary to provide the access you asked for, so it needs no consent (art. 22.2 LSSI-CE). The Cookie Policy lists everything we store.

3.3 Ratings and feedback. If you rate an item with stars, we store the rating with your registration so that you can change it later and so that we can see which items need work. If you fill in the feedback page, we store what you write (the page you were on, stars, what you used, what was good, what was bad, and an optional quote). We use ratings and feedback to improve the site; that is our legitimate interest, and you can object at any time. We publish a quote only if you tick "you may quote me", and we will still ask you again before using it.

3.3a What you open. While you have beta access, the site notes which films, tools, games and places you open: at most one note per item per day, with the date but no time and no IP address, and, if the page reports it, how long it took to load. The note is stored under a code made from your registration, not under your name or email, and is deleted after 90 days. We look at it only in totals (what is used, what people come back to, what loads slowly) to decide what to fix; that is our legitimate interest, and you can object at any time. It is deleted with your registration if you ask us to delete it.

3.4 Bot protection. The registration page uses Cloudflare Turnstile to tell people from bots. It runs on our hosting provider's servers, uses no tracking cookies and does not profile you. (Cloudflare's privacy policy covers it.)

3.5 What stays on your device. Inside the town, your settings (town, level, accent, sound), your progress (stamps, word bank, review cards, saved mistakes), drafts in the Writing Studio and, for teachers, lesson plans and pasted progress codes are saved in your browser's local storage. We do not receive, see or keep a copy of any of it during the beta. To delete it, clear this site's data in your browser. A progress code passes directly from a student to their teacher and never through us; share it only with your own teacher.

3.6 Fonts, voices and microphone. - Fonts are served from our own server; nothing is loaded from Google. - Speech recognition (Pronunciation Studio, Talk to the Town) uses your browser's built-in service. In some browsers (for example Google Chrome) the browser sends your voice to the browser maker's servers to turn it into text, under that company's privacy policy. We never receive the audio. Your browser asks for permission first and you can say no. Recordings you make to compare with a model voice stay on your device and are gone when you leave the page. - Read-aloud uses your device's voices; some "online" voices send the text to the browser maker. - Children should use the microphone only with a parent's, guardian's or teacher's permission.

3.7 Hosting and logs. Our pages, the registration list, ratings and feedback are hosted by Cloudflare (Cloudflare, Inc.; EU services provided through Cloudflare Portugal / Cloudflare Germany, under Cloudflare's data processing addendum). Our database is set to be stored in Western Europe. Cloudflare records technical data for every request (IP address, time, page, browser type) to deliver the pages and keep them secure; we keep those logs for no more than 30 days.

3.8 Email. If you email hello@mylearnington.com we use your address and message only to reply, and delete the exchange after 12 months unless we need it for a legal claim.

Purpose Legal basis
Giving you beta access until 31 December 2026 and recognising your browser Contract (art. 6(1)(b))
Storing ratings and feedback to improve the site Legitimate interest (art. 6(1)(f)); you may object
Counting which items are opened, per day and under a code, to see what is used and what to fix Legitimate interest (art. 6(1)(f)); you may object
Newsletter Consent (art. 21 LSSI-CE), withdrawable in every email; never sent to children
Security, bot protection, logs Legitimate interest (art. 6(1)(f))
Emailing you before accounts launch about how your access continues Contract (a service message about the access you asked for)

5. How long we keep beta data

Data How long
Registration (name, email, role, country, levels, consent record) Until 30 days after accounts launch, when it is either linked to the account you create or deleted; if you ask, deleted straight away
Access cookie Until the beta ends (31 December 2026)
Which items you opened (the day only, under a code) 90 days
Ratings and feedback For as long as the item exists; feedback is anonymised (registration link removed) 12 months after the beta
Logs 30 days

Part B: accounts and subscriptions (from 1 January 2027)

6. Accounts: what we collect and why

We collect only what we need, and we never ask children for photos, phone numbers, surnames, school reports or identity documents.

Who Data Why
Teachers Name or nickname, email, password (stored only as a strong hash), country, the classes you create, homework you set, your Build-your-own game sets To run your account and classes
Academy administrators As teachers, plus the academy's name, billing email and the teachers you invite To run the academy's plan
Students 14 and over (own account) Nickname, email, password (hashed), age band (14–17 or 18+; never your date of birth), level, progress, results, passport stamps, word bank To run your account and track your learning
Students under 14 (own account) Nickname (not a full name), age band, level, progress, results, passport, word bank, and the email of the parent or guardian who consented To run the account safely, with parental consent
Students in a class account (created by a teacher or academy) Nickname chosen by the teacher, a 4-digit PIN (hashed), class, level, progress, results To run the class; see "accounts created by a teacher or school" below
Parents and guardians Email, the record of consent (date, time, text version, a hashed IP address) To prove consent and let you manage the child's data
Everyone with an account Security records: sign-in times, a summary of the device, failed attempts, a hashed IP address; an audit trail of sign-ins, role changes, deletions and exports To keep accounts secure and to answer "who did this" questions

One device at a time. An account is signed in on one device at a time; signing in elsewhere signs the first device out, and adults get an email the first time that happens in a day. This is part of the service and helps stop account sharing.

Results and the class view. Every quiz, game or film check you finish while signed in is saved (item, topic, score, time). Teachers see the results of the students in their classes, including per grammar point, so they can plan lessons. Academy administrators see each class's summary and, if they open a class, the same as its teacher. Students see only their own results. We never show public leaderboards with real names, and a class "speed round" board shows nicknames only within that class.

Accounts created by a teacher or school. When a teacher or academy creates class accounts, the teacher or academy decides how the students' data is used (they are the controller) and we process it for them under the data processing terms in Annex B of the Terms of Use. The teacher confirms, when creating the accounts, that they have the families' permission. Questions about those accounts go to the teacher or school first; we help them answer.

Build-your-own games (teachers only). A teacher's request (a grammar point, a vocabulary topic or word list, a level, an audience, an optional short note) is sent to Anthropic to generate the content set. No student data is sent, and teachers are told not to put personal information in the note. Anthropic processes it under its commercial terms and data processing addendum; under those terms it does not use the content to train its models. The set is checked automatically and then read and approved by the teacher before any student can see it.

8. Payments

Subscriptions are sold by Paddle (Paddle.com Market Ltd, London), our merchant of record: Paddle is the seller on your invoice, charges the VAT of your country and handles refunds and chargebacks under its own privacy policy, as an independent controller. We never see or store your card number. From Paddle we receive your name, email, plan, payment status, the country used for VAT and the last digits of your card, so that we can unlock your account and show you your invoices. Only adults can buy a subscription; a parent, guardian, teacher or academy buys for a child.

Purpose Legal basis
Running accounts, saving progress and results, the class view Contract (art. 6(1)(b)); for a child, the contract is with the parent, guardian or school
Accounts for children under 14 who sign up themselves Parental consent (arts. 6(1)(a) and 8 GDPR; art. 7 LOPDGDD)
Class accounts created by a teacher or school We process on the school's or teacher's instructions (art. 28); their lawful basis is their own
Billing, invoices, tax records Contract and legal obligation (art. 6(1)(c))
Security, abuse prevention, audit trail, "signed in elsewhere" emails Legitimate interest (art. 6(1)(f)), weighed with particular care where children are involved
Service emails (verification, reset, renewal, plan ending) Contract
Newsletter and offers Consent only; never to children
The teachers' game-building tool Contract (a feature of the teacher plan)

10. Who we share data with, and international transfers

Provider Role Data Where
Cloudflare, Inc. Hosting, database, bot protection Everything on the site; database stored in Western Europe EU servers; Cloudflare is certified under the EU–US Data Privacy Framework and provides Standard Contractual Clauses in its DPA
Resend, Inc. (from 1 Jan 2027) Sending account, consent and service emails Email address, the email's content USA, under Standard Contractual Clauses in its DPA
Paddle.com Market Ltd (from 1 Jan 2027) Payments, as merchant of record (independent controller) Billing data UK (adequacy decision) and its own processors
Anthropic, PBC (from 1 Jan 2027) Generating teachers' game content The teacher's request only USA, under Standard Contractual Clauses in its data processing addendum
Our gestoría (from 1 Jan 2027) Accounting Payout and invoice summaries from Paddle; no customer data beyond what Paddle's statements carry Spain
Tax authorities, courts, police Only where the law requires it As required Spain / EU

We prefer EU storage, and where a provider processes data in the United States we rely on an adequacy decision (the Data Privacy Framework, where the provider is certified) or Standard Contractual Clauses (arts. 44–49 GDPR). Ask us for details at any time.

11. How long we keep data (Part B)

Data How long
Account and progress data While the account exists. After 24 months without a sign-in we email a warning and delete the account 30 days later. Deleted accounts are purged within 30 days; results in a class view show as "deleted student" until then.
Class accounts Until the teacher deletes them or the class is archived for 12 months, whichever is first
Records of parental consent For the life of the child's account, plus 3 years
Security logs and audit trail Logs 30 days; audit trail 12 months
Billing records As Spanish tax and commercial law requires
Game sets created by a teacher While the teacher's account exists
Backups Rolling 30-day backups of the database, deleted on the same schedule

Where the law requires it, data is "blocked" rather than deleted for the legal period (art. 32 LOPDGDD).

12. Your rights

You can ask us to access, correct, delete, restrict or move your data, to object to uses based on legitimate interest, and to withdraw consent (without affecting what was done before). From 1 January 2027 the account page has Export my data and Delete my account buttons; otherwise email hello@mylearnington.com with "Data rights" in the subject. We may ask you to confirm your identity. We reply within one month (extendable by two months for complex requests; we will tell you). It is free. Parents and guardians act for children under 14.

If you are not happy with our answer, you can complain to the Agencia Española de Protección de Datos, C/ Jorge Juan 6, 28001 Madrid, www.aepd.es, or to your own country's authority.

13. Security

HTTPS everywhere; passwords and PINs stored only as salted hashes; sessions bound to one device; rate limits and bot protection on sign-in and sign-up; a content-security policy on account pages; access to personal data only by the account's owner, their teacher or academy where this policy says so, and Justin for support; two-step sign-in on our own administrative accounts; daily backups; an audit trail. If a breach risks your rights, we will notify the AEPD within 72 hours and tell you without undue delay where the law requires it (arts. 33–34 GDPR).

14. No advertising, no analytics (for now)

Learnington shows no adverts and runs no analytics or tracking scripts. If we ever add privacy-friendly statistics, we will update this policy and the Cookie Policy first and ask for consent where the law requires it; nothing of the kind will run in Kids mode.

15. Changes

We update the date at the top when this policy changes. Before Part B takes effect, and before any later change that matters, we email account holders (and the parents of under-14s) and show a notice on the site. Where a change needs new consent, we ask for it.

Resumen en español

  • Responsable: Justin Faircloth, autónomo, hello@mylearnington.com. Datos de contacto para privacidad: los mismos.
  • Durante la beta (desde el 1 de diciembre de 2026): para entrar hay que registrarse con nombre, correo electrónico, perfil (profesor/a, alumno/a, academia o familia), país y niveles de interés. Guardamos ese registro, una cookie técnica de acceso (lt_beta, hasta el 31 de diciembre de 2026), las valoraciones con estrellas y los comentarios que nos envíes. El progreso y los ajustes dentro de la ciudad se guardan solo en tu navegador. No hay publicidad, ni analítica, ni seguimiento.
  • Desde el 9 de enero de 2027 (cuentas y suscripciones): cuentas de alumno, profesor y academia; el progreso, el pasaporte y el banco de palabras pasan a la cuenta; panel de clase para el profesorado; pagos a través de Paddle (que emite la factura); una herramienta de creación de juegos con IA solo para profesores. Los menores de 14 años necesitan el consentimiento de sus padres o tutores, o una cuenta creada por su profesor/a o centro (art. 7 LOPDGDD).
  • Bases jurídicas: contrato, consentimiento (padres/tutores para menores de 14; boletín), interés legítimo (seguridad) y obligación legal (facturación).
  • Derechos: acceso, rectificación, supresión, oposición, limitación, portabilidad y retirada del consentimiento, escribiendo a hello@mylearnington.com. Reclamaciones: AEPD, www.aepd.es.