ACE Learning

Legal

Privacy Policy

Last updated: 2026-07-03 (added: PIPEDA, named sub-processors, school-controller roles, localStorage, clarified retention). Written for LGPD (Brazil) and PIPEDA (Canada). Plain-English summary below.

1. Who is responsible for your data

If you signed up directly with ACE Learning, we are the controller of your personal data. If you joined through your school's invitation, the school is the controller for the data processed in that relationship and ACE Learning processes it on the school's behalf as its operator/service provider — direct your requests to the school first, and we'll support them. Either way, you can reach our privacy officer at dpo@acelearning.ca.

2. What we collect

  • Account data: name, email, password (hashed), phone (verified by SMS code), native language, current English level, learning goal, optional photo and bio.
  • Learning data: lessons, test answers, pronunciation recordings, study-time events, AI-coach conversations.
  • Technical data: IP address, user-agent, device type, anonymized usage analytics.
  • Marketing attribution (only if you arrive via a campaign link): the source label captured from the URL.

3. Why we collect it (legal basis)

  • Contract — to deliver the lessons you signed up for.
  • Legitimate interest — to keep the platform secure (rate limits, captcha) and to improve features.
  • Consent — for marketing emails. Opt-in only; you can withdraw at any time from your account. Under PIPEDA, we collect, use, and disclose personal information only with meaningful consent and for the purposes described here.

4. Who sees your data

  • Your teacher and your school's administrators (per the school's seat assignment).
  • Trusted sub-processors, listed below. We do not sell personal data.
  • AI model vendors receive learning data to generate the response, but do not use it for further training (per their enterprise terms).

Sub-processors we use: Google Cloud (hosting and storage, us-central1, USA), Anthropic (AI lessons and grading), OpenAI (AI features and images), ElevenLabs (voice synthesis), AssemblyAI (speech transcription), Stripe (payments), Twilio (SMS verification codes), Resend (transactional email), Cloudflare (Turnstile bot protection). Data is hosted in the United States; by using the platform you acknowledge this cross-border transfer.

5. How long we keep data

  • Active accounts: retained while the account is in use.
  • Audio recordings (pronunciation attempts, speaking practice, class recordings, generated podcasts): deleted automatically after 12 months. Scores and transcripts derived from them are kept.
  • Account deletion: on request to your school or to dpo@acelearning.ca, we delete or anonymize your personal data within 90 days, except where law requires longer retention (e.g. billing records).

6. Your rights (LGPD & PIPEDA)

You can request, at any time, to:

  • Confirm whether we hold your data.
  • Access a copy of your data.
  • Correct inaccurate data.
  • Anonymize, block, or delete unnecessary data.
  • Withdraw any consent you previously gave.
  • Receive your data in a portable format.
  • Challenge our compliance (PIPEDA) — you may also complain to the Office of the Privacy Commissioner of Canada or, in Brazil, to the ANPD.

Email dpo@acelearning.ca to exercise any of these rights. We respond within 15 days.

7. Cookies and local storage

We use a session cookie (ace_session) to keep you signed in. The browser's localStorage holds interface preferences and in-progress work (e.g. draft answers, selected voice) on your device; it is not used for advertising or cross-site tracking. No third-party advertising cookies.

8. Security

Passwords are hashed (scrypt). Data is encrypted in transit (HTTPS) and at rest (Cloud SQL native encryption). Captcha (Cloudflare Turnstile) protects the signup and login endpoints from automated abuse.

9. Changes to this policy

We may update this policy. Material changes will be communicated in-app or by email at least 30 days in advance.

Back to home