Legal Document
Privacy Policy
Worddemy ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, with whom we share it, and what rights you have — wherever you are in the world. By using Worddemy, you agree to the collection and use of data as described in this Policy.
This policy applies to all users of the Worddemy web application, regardless of location, including users in the EU, EEA, UK, United States, Canada, Australia, Brazil, and Asia-Pacific regions.
1.Who We Are (Data Controller)
Worddemy is an independently operated service. The data controller responsible for your personal data is the individual operator of Worddemy, reachable at the contacts below. If you are located in the EU/EEA, the operator acts as the controller under the GDPR. If you are in the UK, we act as controller under the UK GDPR and the Data Protection Act 2018.
Data Controller Contact
Email:
Data protection contact:
For GDPR-related requests:
2.What Data We Collect
2.1 Account and Registration Data
- —Name (first and last)
- —Email address
- —Password (stored as a one-way hash — we cannot see your password)
- —Profile photo (optional)
- —Target IELTS band score and exam date (optional, used to personalise your experience)
- —Country of residence (optional)
- —Date of account creation
2.2 User-Generated Study Content
- —Writing submissions: essays and task responses submitted for AI feedback
- —Speaking practice audio: your live voice, streamed in real time to our AI voice provider during Speaking sessions (not stored as audio files by us), and the resulting session transcripts
- —Exam simulation answers: responses to reading, listening, and writing practice questions
- —Vocabulary: your progress on vocabulary card sets, favourited words, studied words
- —Notes or annotations (if available in the Platform)
2.3 Performance and Progress Data
- —AI-generated scores and band estimates for Writing and Speaking
- —Exam simulation results (band scores, correct/incorrect answers, time taken)
- —Listening and reading practice scores
- —Vocabulary study counts and study streaks
- —Historical performance data stored in our database
2.4 Usage and Technical Data
- —IP address (anonymised or pseudonymised where possible)
- —Browser type and version, operating system, device type
- —Pages visited, features used, time spent, click patterns
- —Session duration and frequency of use
- —Referring URLs
- —Error logs and crash reports
2.5 Payment Data
Payment data (card number, CVV, billing address, expiry) is collected and processed directly by Gumroad, Inc., our third-party payment and subscription management provider. We do not store or have access to your full card details. From Gumroad, we receive only: your subscription status, billing plan, billing period, renewal date, and a licence key confirming active access. Gumroad is PCI-DSS compliant and handles all payment data under their own privacy policy and security standards.
2.6 Subscription and Billing Data (from Gumroad)
When you purchase a paid plan or top-up credits via Gumroad, we receive the following data from Gumroad via webhook notification:
- —Your email address (used to match the Gumroad purchase to your Worddemy account)
- —Subscription plan name and billing cycle (monthly or biannual)
- —Subscription status (active, cancelled, refunded, paused)
- —Licence key issued by Gumroad
- —Purchase date, renewal date, and cancellation date (if applicable)
- —Gumroad sale ID (used for dispute resolution and refund tracking)
We do not receive your card number, CVV, bank details, or full billing address from Gumroad. All payment card data remains with Gumroad under their PCI-DSS compliant infrastructure.
2.7 Consent Records
When you create an account, we record: the timestamp of your agreement to the Terms of Service and Privacy Policy (captured when you check the mandatory consent checkbox), the version of the Terms and Privacy Policy in effect at that time, and the method of registration (email/password or Google OAuth). This record is retained for the lifetime of your account plus 7 years to demonstrate compliance with GDPR Article 7 and other applicable consent requirements.
2.8 Communications Data
- —Support messages and correspondence
- —Email preferences and communication opt-in/opt-out settings
2.9 Wordy AI Chat History
When you use the Wordy AI assistant ("Chat" feature), your conversation messages are stored in our database linked to your account. We collect and retain this data for the following reasons:
- —Context retrieval: Chat History is loaded into the AI's context window at the start of each session so it can provide consistent, memory-aware responses without you having to repeat prior context.
- —Session continuity: You can revisit past conversations and continue them at a later time.
- —Personalised coaching: The AI may reference your previous study results and conversations to tailor its guidance.
Chat messages (both your inputs and the AI's responses) are stored in our Supabase database and are associated with your account ID. They are transmitted to Google's Gemini API for response generation; no other third party receives your chat data. You may delete individual chat sessions or your full Chat History at any time from Account Settings. Anonymised chat content may be used to improve AI quality (see Section 4.3); you may opt out in Account Settings → Privacy.
2.10 Data We Do Not Collect
- —We do not collect sensitive categories of data (racial origin, health data, political opinions, religious beliefs, biometric identity data) except incidentally within writing submissions — we do not process these for profiling.
- —We do not collect physical address unless voluntarily provided for billing.
3.Legal Bases for Processing (GDPR / UK GDPR)
For users in the EU, EEA, and UK, we process your personal data under the following legal bases:
| Processing Activity | Legal Basis |
|---|---|
| Providing the core Service (AI feedback, exams, vocabulary) | Performance of a Contract (Art. 6(1)(b)) |
| Sending transactional emails (account, receipts) | Performance of a Contract (Art. 6(1)(b)) |
| Sharing email/plan with Gumroad to process subscription payments | Performance of a Contract (Art. 6(1)(b)) |
| Improving our AI models using anonymised data | Legitimate Interests (Art. 6(1)(f)) |
| Security monitoring and fraud prevention | Legitimate Interests (Art. 6(1)(f)) |
| Marketing communications (with your opt-in) | Consent (Art. 6(1)(a)) |
| Analytics and usage statistics | Legitimate Interests (Art. 6(1)(f)) |
| Legal obligations (tax, regulation) | Legal Obligation (Art. 6(1)(c)) |
| Processing live speaking audio for the AI examiner and transcription | Performance of Contract / Consent |
| Recording consent timestamp at registration (Terms & Privacy agreement) | Legal Obligation (Art. 6(1)(c)) / Legitimate Interests (Art. 6(1)(f)) |
| Receiving subscription/billing data from Gumroad webhooks | Performance of a Contract (Art. 6(1)(b)) |
| Storing Wordy AI Chat History for context retrieval and session continuity | Performance of a Contract (Art. 6(1)(b)) / Legitimate Interests (Art. 6(1)(f)) |
Where we rely on Legitimate Interests, we have conducted a balancing test and determined that our interests do not override your rights. You may request a copy of our Legitimate Interests Assessment at .
4.How We Use Your Data
4.1 Core Service Delivery
- —Authenticating your account and maintaining your session
- —Generating AI writing feedback (band score, task achievement, coherence, lexical resource, grammatical range)
- —Generating AI speaking feedback (fluency, pronunciation, lexical resource, grammatical range)
- —Running exam simulations and grading responses
- —Providing listening and reading practice with automated scoring
- —Tracking your vocabulary progress and study streaks
- —Saving all results to your profile database for review and progress tracking
4.2 Personalisation
- —Tailoring vocabulary and practice recommendations based on your performance
- —Displaying your historical results and progress charts
- —Notifying you of study reminders based on your preferences
4.3 AI Model Improvement
We may use anonymised, de-identified study content — such as essays or speaking transcripts with personal identifiers stripped — to train, evaluate, and improve our AI models. Before using your content for this purpose, we remove your name, email, account ID, and any other direct identifiers. You may opt out of this processing at any time via Account Settings → Privacy.
4.4 Platform Security and Integrity
- —Detecting and preventing fraud, abuse, and Terms of Service violations
- —Monitoring for unauthorised access to accounts
- —Maintaining audit logs for security purposes
4.5 Communications
- —Transactional emails: account creation, password reset, subscription receipts, cancellation confirmations
- —Product updates and feature announcements (with opt-out available)
- —Marketing emails only with your explicit consent (opt-in), with one-click unsubscribe
4.6 Legal and Compliance
We process data as necessary to comply with applicable legal obligations, respond to lawful requests from public authorities, and enforce our Terms of Service.
4.7 Automated Decision-Making and Profiling
Worddemy uses AI to automatically generate practice feedback — for example estimated band scores, exam marking, and study recommendations. This is automated processing of the study content you submit, but it is used exclusively to provide the practice feedback you request. We do not make any decision producing legal effects or similarly significant effects on you based solely on automated processing: AI scores are practice estimates only, and they never affect your account status, your pricing, or your access to the Service. If you believe an AI-generated output about you is wrong, you can delete the session from your history at any time and may contact us to have any concern reviewed by a human.
5.Voice Data (Speaking Practice)
Voice data from Speaking practice sessions is particularly sensitive. The following rules apply specifically to it:
- —During a Speaking session, your microphone audio is captured in your browser and streamed in real time over an encrypted connection (TLS/WSS) directly to our AI voice provider (xAI), which powers the live examiner conversation and automatic speech transcription.
- —Worddemy's own servers never receive or store your raw audio — no audio recordings are retained by us in any form.
- —The session transcript (text) and the AI-generated feedback are saved to your account so you can review your results.
- —xAI processes your audio as a service provider for the sole purpose of running the live session and producing the transcript, subject to its API data-handling terms.
- —Audio is never used for biometric identification.
- —You can delete any speaking session (including its transcript and feedback) at any time from your Progress history.
6.Data Retention
We retain your data only as long as necessary for the purposes described in this Policy or as required by law.
| Data Type | Retention Period |
|---|---|
| Account data (name, email) | Until account deletion + 30 days |
| Writing submissions & AI feedback | Until account deletion or manual deletion |
| Speaking audio (raw) | Not stored — streamed live to our voice provider, never retained by us |
| Speaking transcripts & AI feedback | Until account deletion or manual deletion |
| Exam simulation results | Until account deletion or manual deletion |
| Vocabulary progress | Until account deletion |
| Usage/analytics data (anonymised) | Up to 24 months |
| Payment records (for tax/audit) | 7 years (legal obligation) |
| Gumroad billing/subscription records | 7 years (legal obligation) |
| Consent records (Terms & Privacy agreement timestamp) | Account lifetime + 7 years |
| Wordy AI Chat History | Until account deletion or manual deletion by user |
| Support correspondence | 3 years from last contact |
| Security logs | 12 months |
Upon account deletion, we initiate a 30-day grace period during which your data is deactivated but not yet purged (to allow recovery). After 30 days, all personal data is permanently deleted from our systems, except where longer retention is required by law.
7.Data Sharing and Disclosure
We do not sell your personal data. We share data only in the following circumstances:
7.1 Service Providers (Processors)
We use carefully selected third-party service providers who process data on our behalf under Data Processing Agreements (DPAs). These include:
| Provider | Purpose | Location |
|---|---|---|
| Supabase (cloud database & auth) | Storing application data, user accounts, and study results | EU / US (SCCs applied) |
| Google (Gemini API + OAuth) | AI feedback generation; Google Sign-In authentication | US (SCCs / DPA in place) |
| Gumroad, Inc. (payment & subscriptions) | Processing subscription payments, managing billing cycles, issuing licence keys | US (PCI-DSS compliant; SCCs applied for EU/UK users) |
| xAI (real-time voice API) | Live AI Speaking examiner — real-time voice conversation and speech transcription | US (SCCs applied) |
| OpenAI | Text-to-speech audio generation for Listening practice | US (SCCs applied) |
| Resend | Transactional email (account, receipts, contact form, newsletter) | US (SCCs applied) |
| Upstash | Caching infrastructure to improve Service performance | US / EU (SCCs applied) |
7.2 Legal Requirements
We may disclose your data when required by law, court order, or governmental authority, or when we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.
7.3 Business Transfers
In the event of a merger, acquisition, or sale of all or part of our assets, your data may be transferred to the acquiring entity. We will notify you via email or prominent in-app notice before your data becomes subject to a different privacy policy.
7.4 With Your Consent
We may share your data with third parties when you have given your explicit consent to do so.
7.5 Gumroad — Payment Data Details
Because Gumroad acts as our payment processor and subscription manager, the following data flow applies when you make a purchase:
- —We send Gumroad your email address and selected plan at checkout initiation so Gumroad can create a customer record and send your receipt.
- —Gumroad collects and retains your payment card details, billing name, and billing address directly under their own privacy policy. We do not receive or retain this data.
- —After a successful payment, Gumroad sends us: your email, subscription plan, billing cycle, licence key, and renewal/cancellation status. We store this in our database to grant and manage your platform access.
- —Gumroad may process your data in the United States. For EU/EEA/UK users, Gumroad applies Standard Contractual Clauses (SCCs) for international data transfers.
- —You may review, update, or delete your Gumroad payment data by contacting Gumroad directly or through the customer portal link in your purchase receipt email.
- —Gumroad's privacy policy is available on their website and governs how they handle your payment and customer data.
8.International Data Transfers
Your data may be transferred to and processed in countries outside your country of residence, including the United States and other countries that may not provide the same level of data protection as your home country. We ensure adequate safeguards are in place:
- —EU/UK → US transfers: We use Standard Contractual Clauses (SCCs) approved by the European Commission, and/or rely on providers certified under applicable adequacy frameworks.
- —All processor agreements include the EU Standard Contractual Clauses (Module 2: Controller to Processor) where required.
- —We conduct Transfer Impact Assessments (TIAs) for high-risk transfers.
- —For UK data: We use the International Data Transfer Agreement (IDTA) or addendum to SCCs.
You may request a copy of the applicable transfer mechanisms by contacting .
9.Your Rights — All Users
Regardless of where you are located, you have the following rights:
- —Right to Access: Request a copy of the personal data we hold about you.
- —Right to Correction: Request that we correct inaccurate or incomplete data.
- —Right to Deletion: Request deletion of your personal data (subject to legal retention obligations).
- —Right to Data Portability: Receive your data in a machine-readable format.
- —Right to Opt Out of Marketing: Unsubscribe from marketing emails at any time.
- —Right to Withdraw Consent: Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.
To exercise any right, contact us at . We will respond within 30 days.
10.GDPR and UK GDPR Rights (EU, EEA, UK Users)
In addition to the rights above, EU/EEA/UK users have:
- —Right to Restrict Processing: Request that we limit how we use your data while a dispute is resolved.
- —Right to Object: Object to processing based on Legitimate Interests, including profiling.
- —Right Not to be Subject to Automated Decision-Making: Our AI feedback is informational and not used for legally significant automated decisions. You may request human review of any AI evaluation.
- —Right to Lodge a Complaint: You have the right to complain to your local supervisory authority. For EU users, find your authority at edpb.europa.eu. For UK users: the ICO (ico.org.uk).
We will respond to all GDPR-related requests within 30 days. In complex cases we may extend this by a further 60 days, with notice.
11.CCPA / CPRA Rights (California Residents)
If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), grants you additional rights.
11.1 Categories of Personal Information Collected
We collect the following CCPA categories: Identifiers (name, email, IP address); Internet/electronic activity (usage data, browsing behaviour within the Service); Commercial information (subscription records); Audio/electronic data (live speaking audio processed in real time, and its transcripts); Inferences drawn from the above (performance profile). We do not sell or share personal information for cross-context behavioural advertising.
11.2 Your CCPA Rights
- —Right to Know: Know what personal information we collect, use, disclose, or sell.
- —Right to Delete: Request deletion of personal information we hold about you.
- —Right to Correct: Request correction of inaccurate personal information.
- —Right to Opt-Out of Sale/Sharing: We do not sell or share personal information. No opt-out is required, but you may confirm this at any time.
- —Right to Limit Use of Sensitive Personal Information: We do not use sensitive personal information for purposes beyond those listed in the CPRA.
- —Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.
11.3 How to Submit a CCPA Request
Submit verifiable consumer requests to: . You may designate an authorised agent to make requests on your behalf, subject to verification. We will respond within 45 days (extendable to 90 days with notice).
Shine the Light: California Civil Code § 1798.83 permits California residents to request information about disclosure of personal information to third parties for direct marketing purposes. We do not disclose for such purposes. Contact us at for confirmation.
Global Privacy Control (GPC): because we do not sell or share personal information for cross-context behavioural advertising, there is no sale or sharing to opt out of. Where a GPC browser signal is nonetheless required to be treated as an opt-out request under applicable law, we honour it.
12.PIPEDA Rights (Canadian Users)
Canadian users have rights under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws (including Quebec Law 25, Alberta PIPA, and BC PIPA).
- —Right to access your personal information and request corrections.
- —Right to withdraw consent for non-essential processing at any time.
- —Right to file a complaint with the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca.
- —Quebec Law 25 (Bill 64): Quebec residents have additional rights including data portability and the right to be informed of automated decision-making. Contact us at <ObfuscatedEmail email="privacy@worddemy.com" /> for Quebec-specific requests.
13.LGPD Rights (Brazilian Users)
If you are located in Brazil, you have rights under the Lei Geral de Proteção de Dados (LGPD — Law No. 13,709/2018):
- —Confirmation of the existence of processing of your data.
- —Access to your data.
- —Correction of incomplete, inaccurate, or outdated data.
- —Anonymisation, blocking, or deletion of unnecessary or excessive data.
- —Portability of your data to another service provider.
- —Deletion of data processed with your consent.
- —Information about public and private entities with which we share data.
- —Information about the possibility of denying consent and the consequences.
- —Revocation of consent.
To exercise your LGPD rights, contact: . You may also file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD) at gov.br/anpd.
14.Privacy Act Rights (Australian Users)
For users in Australia, our practices comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
- —You may access and correct your personal information by contacting us.
- —We will not use or disclose your information for direct marketing without your consent (and provide a simple opt-out).
- —You may file a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au if you believe we have violated the APPs.
15.PDPA Rights (Thailand and Singapore Users)
Thailand (PDPA — Personal Data Protection Act B.E. 2562)
- —Rights to access, correct, delete, restrict, and object to processing of your personal data.
- —Right to data portability.
- —Right to withdraw consent at any time.
- —Right to file a complaint with the Personal Data Protection Committee (PDPC) of Thailand.
Singapore (PDPA — Personal Data Protection Act 2012)
- —Right to access and correct personal data we hold about you.
- —Right to withdraw consent (subject to legal or contractual restrictions).
- —Do Not Call Registry: We will not use your phone number for telemarketing unless consented.
- —You may file a complaint with the Personal Data Protection Commission (PDPC) Singapore at pdpc.gov.sg.
16.Cookies and Tracking Technologies
16.1 What We Use
| Cookie Type | Purpose | Duration |
|---|---|---|
| Strictly Necessary | Authentication, session management, security | Session / 30 days |
| Functional | Remembering your preferences (theme, language) | 1 year |
| Consent Record | Storing your cookie consent choice (CookieYes) | 1 year |
| Analytics | Google Analytics — aggregate usage measurement (only after consent) | Up to 2 years |
16.2 Your Cookie Choices
Strictly necessary cookies cannot be disabled as they are essential to the Service. You may opt out of analytics and functional cookies via your browser settings or our cookie preferences panel. We do not use third-party advertising cookies or cross-site tracking cookies.
17.Security
We implement industry-standard technical and organisational measures to protect your personal data:
- —All data is transmitted over TLS 1.2 or higher (HTTPS).
- —Passwords are stored using bcrypt or Argon2 (one-way hashing). We cannot retrieve your password.
- —Database access is restricted and protected by role-based access controls.
- —Speaking audio is never stored — it is processed in transit only, over encrypted connections.
- —We regularly review our code, dependencies, and access controls for security issues.
- —Access to production data is limited to authorised personnel with a documented need.
- —We maintain an incident response plan and will notify affected users and relevant authorities within the legally required timeframe (72 hours under GDPR) in the event of a breach affecting your rights.
No system can be guaranteed 100% secure. If you suspect a security incident, please report it immediately to .
18.Children's Privacy
The Service is not directed at children under 13 years of age. We do not knowingly collect personal data from children under 13. If you are under 13, do not use the Service or submit any data. If we discover we have collected data from a child under 13 without parental consent, we will delete it promptly.
For users aged 13–17 (or up to 16 in certain EU member states), we require parental or guardian consent. Schools or educational institutions deploying Worddemy for minors must ensure appropriate consent mechanisms are in place.
19.Changes to This Privacy Policy
We may update this Privacy Policy periodically to reflect changes in our practices, legal requirements, or Service features. We will notify you of material changes at least 30 days in advance by email and/or a prominent notice within the Service. The "Last Updated" date at the top reflects the most recent revision. Your continued use of the Service after the effective date of changes constitutes acceptance of the updated Policy.
20.How to Contact Us and Exercise Your Rights
To exercise any data protection right, raise a concern, or ask a question about this Privacy Policy, contact us using the details below. We will acknowledge your request within 5 business days and provide a full response within 30 days (or the applicable statutory period for your jurisdiction).
Privacy & Data Protection Contacts
General privacy enquiries:
Data protection contact:
GDPR-specific requests:
CCPA / US requests:
Security incidents:
If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority. We will cooperate fully with such investigations.
By using Worddemy, you acknowledge that you have read and understood this Privacy Policy and agree to the collection and use of your information as described herein.