Last updated: September 23, 2026

Privacy Policy

This Privacy Policy explains how Examling ("Examling", "we", "us") collects, uses, shares, and protects personal information when you use the Examling website and applications (the "Service"). We collect as little as possible: an email address, what you practise, and how you scored.

1. Who we are

The Service is operated by Examling, which is the data controller for the information described in this policy. For any privacy question, or to exercise any right below, contact us at support@examling.com — this is our official contact point for privacy matters and is monitored.

2. Information we collect

Account information

• Email address and an encrypted password, to create and secure your account.
• Display name (optional), and your preferred language.
• Consent records — the date you accepted our terms and the version you accepted, as required by law.
• Voice recordings — if you practise a speaking section, we record your spoken answer, send it to a third-party AI provider to be transcribed into text, and score the transcript. The recording is used for that purpose only. We store the transcript and your score with your practice history; we do not build a voiceprint and we do not use recordings to identify you. Speaking practice is entirely optional — every other section works without a microphone.

Your profile

• Optional, and none of it is required to use the service: a name, a photograph, a country, a phone number, a short bio, and social handles. You choose what to fill in and can remove any of it at any time. Until you choose a country yourself, it is filled in from the country your network or your billing address is in, and the form says so.
• Your first language, if you tell us — it changes what the marking says, because it selects the error patterns speakers of that language typically produce.
• The phone number is a contact detail. It is not verified, it is never shown to other learners, and it is never used to sign you in.

Learning content & progress

• The practice questions and papers generated for you, your answers, scores, and progress statistics — so you can review history and we can show analytics.

Technical & security information

• Sign-ins and devices — for each new sign-in, the network (IP) address it came from, the country that address is in, and the time; for each signed-in device, its current network address and country, a device fingerprint, the browser type and when it was last used. We use these to secure accounts, enforce your plan’s device limit, detect a shared or stolen account, and show you where your account has been signed in (Settings → Sign-in history). A sign-in’s address is kept for 90 days. A device’s record is deleted 30 days after the device was last used. We do not use any of this to build advertising profiles.
• Error reports — if the app hits a fault in your browser, it sends us the error’s text, the screen it happened on (never the link that opened it), the app version and your browser type, so we can fix it. A report carries no account, no email address and no IP address, and we delete it after 30 days.
• Page-visit statistics — Cloudflare, our content-delivery provider, counts visits to our pages with its Web Analytics service: which page was opened, the site that linked to it, the country, the browser type, and how quickly the page loaded. It sets no cookies, stores nothing on your device, does not fingerprint you and does not follow you to other sites. We see totals only, never a visit we could tie to you.

Payment information

• Subscriptions are processed by Lemon Squeezy, our Merchant of Record. Card details are entered on their systems — we never receive or store your full card number. We receive the subscription status and plan needed to grant access, and a record of each purchase for our own accounts — the amount, the currency, the tax Lemon Squeezy charged and the billing country. Never the card, never the cardholder.

3. How we use information

• To provide the Service — generate practice papers, mark your answers, and track your progress.
• To create and secure accounts, enforce plan limits, and prevent fraud and abuse.
• To process subscriptions and provide customer support.
• To comply with legal obligations and enforce our terms.
• To send essential service emails (e.g. verification, billing, security, and a reminder a week before a plan you bought ends). We do not sell your data and we run no advertising.

4. Legal bases (GDPR)

Where the GDPR applies, we rely on: performance of a contract (to provide the Service you signed up for); legitimate interests (to secure the Service, prevent abuse, and understand in aggregate how our pages are used and how fast they load); consent (where required, such as optional email); and legal obligation (to meet our legal duties).

5. Age and minors

Examling is for adults preparing for an English or admissions test. You must be at least 18, or the age of majority where you live, to create an account. The Service is not directed to children and we do not knowingly collect personal information from anyone under 13. One account belongs to one candidate; nobody registers or is supervised on behalf of anybody else.

If you believe a child has created an account, write to privacy@examling.com and we will delete it and its data.

6. How we share information

We do not sell personal information. We share it only with service providers who help us run the Service, under contract and only as needed:

• Hosting & database — our cloud infrastructure and database provider.
• AI processing — providers that generate and score learning content (see below).
• Speech transcription — a provider that converts a spoken practice answer into text so it can be scored.
• Payments — Lemon Squeezy, as Merchant of Record.
• Security & delivery — our content-delivery and security provider, which also counts page visits for us without cookies (see Technical & security information).
• Legal — where required by law or to protect rights and safety.

7. AI processing

Practice questions, papers and scoring are produced using third-party AI providers. We send providers only what is needed to produce the content, and never more.

What we send. The practice prompt and the answer you wrote, or the transcript of the answer you spoke. For speaking practice the audio recording itself is sent to a transcription provider. We do not send your name, email address, photograph, phone number or any other profile field with it — a marking request contains the task and your answer, and your first language where you have set one, because that changes what the feedback says.

Model training — stated plainly. Our AI providers are used on paid service tiers, whose terms exclude the content you submit from being used to train their models. An essay you write for practice, or the transcript of a speaking answer, is used to produce your score and your feedback, and for nothing else. When you have an essay from your own practice book marked, the book’s question you type in is used for that one marking and is not stored. This section said the opposite while one provider was still on a free tier whose terms did permit training; we said so plainly at the time rather than implying otherwise, and we are correcting it here for the same reason.

Your answers are still sent to a third-party provider in order to be scored — that is how the marking works, and it is a separate thing from training. If you would prefer your written or spoken practice answers not to be processed by a third party at all, please do not submit them for scoring; reading and listening practice is graded by us and does not involve sending your answers to an AI provider.

We apply a safety filter to generated content before it is shown.

8. Data retention

We keep personal information only as long as needed to provide the Service and meet legal obligations:

• your account, profile and practice history, until you delete them;
• the network address and country of each sign-in, for 90 days;
• a signed-in device’s record, until 30 days after the device was last used, and the log of which devices were used to sign in, for 35 days;
• security alerts about an account, for fraud prevention — after 90 days with no network address or device identifier on them;
• error reports, for 30 days;
• purchase records (amount, currency, tax and billing country), for our accounts and tax;
• if you start the monthly plan’s free trial, the email address it was started with, so that the trial is offered once per person — including after the account is deleted.

When you request deletion, we remove your data within 30 days, except where we must retain limited records for legal, tax, or security reasons. Inactive accounts may be purged after a period of inactivity, following a warning to the address on the account.

9. Your rights & choices

Depending on where you live, you may have the right to access, correct, delete, export, or restrict processing of your personal information, and to withdraw consent.

You can exercise the two main ones yourself, immediately, without asking us. In Settings → Your data:

• Download my data — a JSON file of everything we hold about you: your profile, every attempt with your answers, scores and feedback, your plans and purchases, your sign-ins and devices, and the meters that count your use. The file lists the few records it leaves out and why — the internal detail of an abuse alert, which would show how account sharing is detected, and records that name one of our operators rather than you.
• Delete my account — permanently deletes your account, profile photo, practice history, marking, progress, subscriptions and sign-in history. This takes effect straight away, not after a waiting period. Anonymised fraud-prevention logs, with no network address or device identifier on them, and purchase records (amount, tax and country, with nothing that identifies you) are kept for fraud prevention and our accounts; neither is linked to you afterwards. If you started a free trial, the email address it was started with is kept, so that the trial is offered once per person.

For correction, restriction, or anything else, email support@examling.com and we will complete it within 30 days. You may also lodge a complaint with your local data-protection authority.

10. Security

Data is encrypted in transit (TLS) and at rest. Access is restricted, passwords are hashed, and sensitive operations run server-side only. To protect your account we record the network address and country of each new sign-in; you can see where your account has been signed in under Settings → Sign-in history, and a sign-in’s address is deleted after 90 days. No system is perfectly secure, but we work continuously to protect your information.

11. International transfers

Examling is an online service and your data is processed in more than one country. Your account and your practice history are held in a database in Singapore. The providers we rely on for payments, AI marking, speech transcription, content delivery and email process data elsewhere, including in the United States.

Where personal data is transferred outside the United Kingdom or the European Economic Area, we use providers that commit to appropriate safeguards for those transfers — in practice the European Commission’s Standard Contractual Clauses, or an adequacy decision where one covers the country concerned. You can ask us which safeguard applies to a particular provider at privacy@examling.com.

12. Changes to this policy

We may update this policy from time to time. Material changes will be posted here with a new "Last updated" date, and where required we will seek renewed consent.

13. Contact us

Questions or requests: support@examling.com. See also our Contact page.

← Back to home