Introduction
CEFRHub ("we", "our", "us") is committed to protecting your privacy. This policy explains how we collect, use, and protect your personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec's Act respecting the protection of personal information in the private sector (Law 25), and the General Data Protection Regulation (GDPR).
1. Data We Collect
We collect and process the following personal data:
- Account Information: Email address, name (optional), password (encrypted), profile stated at sign-up (optional: individual, teacher or organization)
- Evaluation Results: Assigned CEFR levels, detailed analyses, personalized recommendations; along with, for a personal account, the first 100 characters of the submitted text (or the file name) and, for a placement test, the full text. Audio recordings are never kept.
- Metadata: Evaluation title, evaluated language, evaluation type (oral/written), timestamp
- Technical Data: IP address, browser type, device information
Audio recordings (oral evaluation) are never kept: they are analysed and then discarded, with no transcription and no copy. For a personal account, we keep the result of the analysis together with a short excerpt of your text (first 100 characters) or the name of the submitted file, never the full text; the result may quote passages of your production. For a placement test run by an organisation, the written text is kept in full with the result, accessible only to that organisation's administrators; the model's raw response is kept for at most 72 hours.
2. How We Use Your Data
Your data is used to:
- Provide CEFR language evaluation services
- Generate personalized learning recommendations
- Enable progress tracking
- Improve our service quality
- Send service updates (with your consent)
- Ensure platform security
3. Legal Basis for Processing
We process your data on the following legal bases:
- Consent: For sending audio/text evaluations to our AI system
- Contract Performance: To provide the evaluation services you requested
- Legitimate Interest: To improve our services and ensure security
- Legal Obligation: To comply with applicable laws
CEFRHub Technologies Inc., a federally incorporated Canadian company, is committed to protecting the personal data of all its users in accordance with the strictest applicable data protection laws, including Quebec's Law 25 (fully in effect since September 2024). This includes:
- Transparency regarding automated decisions: our AI-powered evaluations are clearly identified as automated processing, and you may request information about how the decision was made
- Privacy by default: only strictly necessary personal data is collected, and privacy settings are set to their most protective level by default
- PIA completed: CEFRHub has conducted a Privacy Impact Assessment (PIA / EFVP) under Quebec's Law 25 prior to deploying its AI analysis system. This document is available upon request for institutional clients.
- A privacy officer has been designated to oversee compliance
4. Data Storage and Security
Your results and the text excerpts we keep are stored in Canada (Montréal); audio recordings are never stored. Linguistic analysis is performed by Google Cloud Vertex AI in the Montréal region (northamerica-northeast1). Security measures in place:
- Data encryption in transit (HTTPS/TLS)
- Data encryption at rest
- Access controls and enhanced authentication
- Continuous security monitoring
- Database restore available over the last 7 days
5. Data Sharing and Sub-processors
Your data is never sold to third parties. It is processed only by the following sub-processors; each is governed by the provider's data processing terms. For Google Cloud and Firebase, the Google Cloud Data Processing Addendum, with Standard Contractual Clauses, applies. Your results and the text excerpts we keep are stored in Canada (Montréal); audio recordings are never stored. Linguistic analysis is performed by Google Cloud Vertex AI in the Montréal region (northamerica-northeast1).
- Google LLC — Firebase: authentication, database, server functions, file storage and website hosting. The database, file storage and server functions are located in Montréal (Canada). Certifications: ISO 27001, SOC 2 Type II. Firebase Privacy Policy.
- Google LLC — Google Cloud Vertex AI: AI linguistic analysis of submitted content. Processing location: Montréal region, Canada (northamerica-northeast1). Data transmitted: no identifying data (name, email) is sent to the AI; the content of the production itself is transmitted. Your content is not used to train Google's models (Google Cloud terms applicable to Vertex AI).
- Google LLC — Google Analytics 4 and Firebase Analytics: audience measurement for the website and the application.
- Google LLC — Sign in with Google: single sign-on (SSO), if you choose to sign in with a Google account.
- Microsoft — Microsoft Entra ID: single sign-on (SSO), if you choose to sign in with a Microsoft account.
- Stripe Inc. (United States): secure payment processing. Certifications: PCI DSS Level 1, SOC 2 Type II. Stripe Privacy Policy.
- Twilio SendGrid (United States): transactional email delivery (account confirmation, notifications). Twilio Privacy Policy.
- Sentry (Functional Software Inc.) (European Union, Germany): error and performance monitoring. Sentry receives the account's technical identifier and technical information about errors; text displayed on screen is masked. Sentry Privacy Policy.
6. Your Rights (GDPR, PIPEDA, Law 25)
Depending on your jurisdiction and applicable legislation, you have the right to:
- Access: Request a copy of your personal data (GDPR, PIPEDA, Law 25)
- Rectification: Correct inaccurate data (GDPR, PIPEDA, Law 25)
- Erasure: Request deletion of your data — "right to be forgotten" (GDPR, Law 25)
- Portability: Export your data in a readable format (GDPR, Law 25)
- Objection: Refuse processing for marketing purposes (GDPR, PIPEDA)
- Withdrawal: Withdraw your consent at any time (GDPR, PIPEDA, Law 25)
- Automated Decisions: Request information about and contest decisions made solely through automated processing (GDPR, Law 25)
- De-identification: Request that your personal information be de-identified (Law 25)
To exercise these rights: from your profile (full export, account deletion) or by writing to us at: dpo@cefrhub.ai
7. Data Retention
Your evaluations are kept for 2 years from their creation, then deleted automatically. You can download all your data from your profile at any time.
- You request it from your profile; for 30 days, you can cancel it
- Once that period has elapsed, CEFRHub processes your request: your profile, personal evaluations and files are then permanently deleted, and technical backups are erased within 7 days. A written confirmation is available on request at dpo@cefrhub.ai
- Evaluations you made for an organization stay with that organization, with no link to you
- Financial records (invoices, transactions) and security logs are kept in pseudonymised form for the period required by law
- If you subscribed to a paid plan, your customer record remains with Stripe, our payment provider, together with the payment records
- If you used the free trial, a pseudonymised fingerprint of your account is kept so that the trial cannot be used more than once (abuse prevention)
- Aggregated, anonymised usage data may be kept for statistical purposes
9. Protection of Minors
Our services are not intended for persons under 13 years of age. We do not knowingly collect personal data from children under 13. Under GDPR (Article 8), parental consent is required for users under 16 in the European Union. Under PIPEDA, children under 13 generally cannot provide meaningful consent. If you are a parent or guardian and believe your child has provided us with personal data, please contact us.
10. Changes to This Policy
We may update this privacy policy periodically. Material changes will be notified via email or platform notifications.
11. Contact Us
For any questions about privacy or data protection:
Privacy Officer: dpo@cefrhub.ai