GDPR & Your Rights

English Era Studio acts as the data controller for the personal data you provide when using the Platform. This means we determine the purposes and means by which your data is processed. Where we use third-party processors (such as Supabase for storage), we have data processing agreements in place to ensure your data is protected. Payments are handled by Paddle, which acts as Merchant of Record and is responsible for the payment data it collects at checkout.

We hold the minimum data necessary to provide our service:

• Email address and display name (account registration)
• Profile avatar and word translation language (optional)
• Date of birth (optional)
• Sex (optional)
• Courses you own and your orders (payment details are held by Paddle, not by us)
• Learning progress: completed lessons, saved words, practice logs
• Technical logs: IP address, browser type, pages visited
• How you found us, e.g. the ad or link you arrived from

For a full breakdown see our Privacy Policy.

We only process your data when we have a lawful basis to do so:

• Performance of a contract — to provide the services you signed up for (account management, course delivery, order processing).
• Legitimate interests — platform security, fraud prevention, product improvement, and internal analytics. We have assessed that these interests do not override your rights.
• Consent — marketing emails and analytics and advertising cookies (Google Analytics, Meta Pixel). You can withdraw consent at any time.
• Legal obligation — retaining financial records as required by law.

As a data subject in the EEA or UK you have the following rights. To exercise any of them, email our contact form with the subject line starting with "GDPR Request". We will respond within 30 days. Account deletion specifically can also be requested directly from your Profile page without emailing us.

Your data is primarily stored in EU-based infrastructure (Supabase EU region). Some of our processors may handle data outside the EEA — for example Vercel (hosting), Paddle (payments), Resend (email), Sentry (error monitoring), Google and Meta (analytics and advertising). Where this happens we rely on appropriate safeguards (Standard Contractual Clauses or equivalent mechanisms under Article 46 GDPR). See our Privacy Policy for the full list.

We retain personal data only for as long as necessary for the purposes described in this notice:

• Account data: retained while your account is active, deleted within 30 days of account closure.
• Learning progress: deleted with your account.
• Financial records: retained for 7 years as required by applicable tax law.
• Server logs: retained for up to 90 days for security purposes.

We do not use fully automated decision-making or profiling that produces legal or similarly significant effects on you. Course recommendations on the site are based on what other learners buy and on the catalogue, not on profiling you.

If you believe we have handled your data unlawfully, you have the right to lodge a complaint with your national data protection authority. In the EU you can find your local authority at edpb.europa.eu. We would appreciate the opportunity to resolve your concern directly first — please contact our contact form .

For all GDPR requests and privacy questions, contact us at our contact form . Please include "GDPR Request" in the subject line so we can prioritise your message.