E
English Era Studio
HomeAll CoursesPlansAboutStart
Legal

GDPR & Your Rights

How we comply with the General Data Protection Regulation and respect your privacy rights.

Last updated: 14 May 2025

1. Our Role Under the GDPR

English Era Studio acts as the data controller for the personal data you provide when using the Platform. This means we determine the purposes and means by which your data is processed. Where we use third-party processors (such as Supabase for storage), we have data processing agreements in place to ensure your data is protected.

2. What Data We Hold

We hold the minimum data necessary to provide our service:

  • Email address and display name (account registration)
  • Profile avatar (optional)
  • Date of birth (optional)
  • Sex (optional)
  • Learning progress: enrolled courses, completed lessons, saved words, practice logs
  • Billing information held by our payment processor (not by us directly)
  • Technical logs: IP address, browser type, pages visited

For a full breakdown see our Privacy Policy.

3. Lawful Bases for Processing

We only process your data when we have a lawful basis to do so:

  • Performance of a contract — to provide the services you signed up for (account management, course delivery, payment processing).
  • Legitimate interests — platform security, fraud prevention, product improvement, and internal analytics. We have assessed that these interests do not override your rights.
  • Consent — marketing emails and non-essential analytics cookies. You can withdraw consent at any time.
  • Legal obligation — retaining financial records as required by law.

4. Your Rights Under the GDPR

As a data subject in the EEA or UK you have the following rights. To exercise any of them, email our contact form with the subject line starting with "GDPR Request". We will respond within 30 days.

Right of Access (Article 15)
Request a copy of all personal data we hold about you, along with information about how it is used.
Right to Rectification (Article 16)
Ask us to correct inaccurate or incomplete personal data.
Right to Erasure (Article 17)
Request deletion of your personal data ("right to be forgotten") where we no longer have a lawful basis to hold it.
Right to Restrict Processing (Article 18)
Ask us to pause processing your data while a dispute is resolved.
Right to Data Portability (Article 20)
Receive your personal data in a structured, machine-readable format (e.g. JSON or CSV) so you can transfer it to another service.
Right to Object (Article 21)
Object to processing based on legitimate interests, including profiling. We will cease processing unless we can demonstrate compelling legitimate grounds.
Right to Withdraw Consent
Where processing is based on consent (e.g. marketing emails, analytics cookies), you may withdraw it at any time without affecting the lawfulness of prior processing.

5. International Data Transfers

Your data is primarily stored in EU-based infrastructure (Supabase EU region). Where data is processed outside the EEA — for example, by Vercel's global edge network — we ensure appropriate safeguards are in place (Standard Contractual Clauses or equivalent mechanisms under Article 46 GDPR).

6. Data Retention

We retain personal data only for as long as necessary for the purposes described in this notice:

  • Account data: retained while your account is active, deleted within 30 days of account closure.
  • Learning progress: deleted with your account.
  • Financial records: retained for 7 years as required by applicable tax law.
  • Server logs: retained for up to 90 days for security purposes.

7. Automated Decision-Making

We do not use fully automated decision-making or profiling that produces legal or similarly significant effects on you. Course recommendations are based on your stated preferences, not algorithmic profiling.

8. Right to Lodge a Complaint

If you believe we have handled your data unlawfully, you have the right to lodge a complaint with your national data protection authority. In the EU you can find your local authority at edpb.europa.eu. We would appreciate the opportunity to resolve your concern directly first — please contact our contact form .

9. Contact

For all GDPR requests and privacy questions, contact us at our contact form . Please include "GDPR Request" in the subject line so we can prioritise your message.