Privacy Policy

Who we are and what this covers

Virtuous English Academy ("VEA", "we", "us") runs the free English-learning website at virtuousenglishacademy.com. This policy covers that website and every page on it.

It explains what data we hold, why we hold it, who else can see it, and what you can make us do about it. It is written to meet the UK GDPR, the EU GDPR, the CCPA/CPRA, and the disclosure requirements of the Google AdSense programme.

If anything here is unclear, ask us at virtuousenglish@virtuousenglishacademy.com — we would rather explain it than have you guess.

What we collect

Your data sits in one of two layers, and which one depends entirely on whether you have chosen to create an account.

If you use VEA without an account

Your progress, quiz states, saved preferences and study timers are written to your own browser's localStorage. That data stays on your device. We cannot read it, and it is never transmitted to us.

You can erase all of it at any moment by clearing site data in your browser. You do not need to ask us, and nothing is kept on our side to delete.

If you create a free account

Signing in lets your progress follow you between devices, and it is what a certificate is issued against. Creating an account asks for four details on one screen, once. We store, against your account:

• Your email address, handled by Google Firebase Authentication.
• Your given name and family name — the name a certificate would be issued in, which is why we ask for a real one rather than a nickname.
• Your nationality — printed on a certificate, as it is on any language certificate. “Prefer not to say” is on the list and is a complete answer.
• Your year of birth — a year, never a full date. It does two jobs: telling two candidates with the same name apart on an exam record, and letting us apply the under-13 rule below. An exact date of birth is not asked for and the form would not accept one.
• Whether your email is verified, and the date and policy version recorded when you created the account.
• Course progress, streak count, XP, badges and weekly study seconds.
• Flashcards and vocabulary you choose to save, and notes you write in the dashboard.
• Placement-test results and any certificate you generate.
• Whether you ticked the optional marketing-email box when you signed up.

We never see your card. Almost everything on VEA is free; the one exception is the Certified English Placement Exam. If you buy it, the payment is taken by Dodo Payments on its own checkout page. Your card number, expiry and security code are entered there, not here, and are never transmitted to us or stored on our servers. What comes back to us is a confirmation that an order was paid, an order reference, and the country the provider used to work out tax.

We do not ask for your address, phone number, exact date of birth or any government identifier. A year of birth is a year: it is not a date, and there is no way to derive one from it.

If you write to us

Messages sent through our contact page reach us by email and include the name, email address and message you typed. We keep them only as long as we need to answer you.

The certified exam — payment, recordings and AI marking

The details you give before you start

Before the first question the exam asks for five things, and it asks for them because a certificate names a person. You give them once, on a screen where the clock is not yet running, and you can see exactly how your name will be printed before you confirm it.

• Your given name and family name — printed on the certificate, which is the whole reason we ask. They cannot be changed after the exam is scored, so please check them on that screen.
• An email address — where we send your result and your certificate link. It is your choice and does not have to be the address you signed in with.
• Your nationality — printed on the certificate, as it is on any language certificate. “Prefer not to say” is on the list and is a complete answer.
• Your year of birth — a year, never a full date. It does the job a date of birth does on an exam record, which is telling two candidates with the same name apart, without putting an exact date of birth on a page anyone with the link can read. We do not ask for one and the exam would not accept one.

Your name, nationality and year of birth appear on your certificate, and a certificate page is public to anyone who has its link — that is what makes it shareable and verifiable. Nothing else from your account appears there. If you delete your account, your certificates go with it.

What sitting the exam stores

• Your answers to every question, and how long each one took.
• The text of your writing tasks, including the draft as it autosaves.
• Audio recordings of your spoken answers — see below.
• Proctoring events: how many times the exam window lost focus, left full screen, or refused a copy or paste. We record that these happened and when; we do not record what you switched to, and we cannot see your screen, your camera or any other application.
• The result: your band per skill, the marker's written feedback, and the certificate if one is issued.

Your voice recordings

The speaking section asks you to record three short spoken answers — two open questions and one sentence read aloud. Your microphone is active only while you are recording, you can listen back before you submit, and you can skip the section; nothing is marked from it either way.

• Why we hold them: to keep them with your attempt, and as evidence if an attempt is flagged for review. Nothing marks them at present. Nothing else. The legal basis is performance of the contract you entered when you bought the exam.
• Where they live: a private Google Cloud Storage bucket that no browser can read — only our server-side code can reach it.
• How long: 12 months, then deleted. You can ask us to delete them sooner at any time, and we will, unless the attempt is under active review.
• What we never do: publish them, sell them, use them to advertise, use them to identify you biometrically, or use them to train anybody's model.

AI marking

Your writing tasks are marked by an AI model — Claude, from Anthropic (their privacy policy) — against a published rubric. Your spoken answers are not marked and are not sent to any marker or speech-recognition service; they stay in our own storage.

• What is sent: the task prompt, what you wrote, and a few facts about how you worked (how long you took, how many revisions). That is all the marker needs.
• What is not sent: your name, your email address, your account id, or anything else that identifies you. The marker sees a script, not a person.
• Training: under the commercial API terms we use, what we send is not used to train the provider's models.
• A human can overrule it: AI marking is not a decision with legal effect, but it does decide what appears on a certificate you paid for. If you think a band is wrong, write to us and a person will look at your script.

The result email

When your exam is scored we email the result to the address you gave on that first screen: your level, your score and its margin, your bands by skill, and a link to your certificate if one was issued. It is sent once, by our transactional email provider, and it is not marketing — there is no list to join and nothing else is sent to that address. If the name on the certificate is wrong, replying to that email is the fastest way to reach us.

Payment data

The sale is handled by Dodo Payments as merchant of record (their privacy policy). That company, not VEA, is the seller on your bank statement and the party that handles your card data, the tax and any dispute. We receive an order reference, the amount, the currency and the country used to work out tax, and we store those against your account so we know the exam is unlocked. We do not receive, and cannot ask for, your card number.

Advertising — how ads on this site work

We have applied to Google AdSense (publisher ID ca-pub-6733098045611992) and its integration is installed on eligible editorial pages. As of 9 September 2026, Google has not approved this site, no ads are being served and we earn no advertising revenue.

If Google approves the site, ads may appear only on eligible lesson, grammar, vocabulary, story, blog and similar editorial pages. Policy pages, tests, games, account screens, navigation pages and the certified exam remain ad-free.

The disclosures Google requires us to make

• Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or to other websites.
• Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to our site and/or other sites on the internet.
• You can opt out of personalised advertising by visiting Google Ads Settings.
• You can opt out of a third-party vendor's use of cookies for personalised advertising at aboutads.info/choices, or — in Europe — at youronlinechoices.eu.

What we do not do

We do not build our own advertising profiles, we do not run cross-site behavioural tracking of our own, and we do not sell or share your personal information with data brokers. The advertising data described above is processed by Google under its own privacy policy, not passed to us — we receive aggregate earnings reports, never the identity of who saw or clicked an ad.

If you are in the EEA, the UK or Switzerland

Consent Mode defaults advertising and analytics storage to denied in these regions. On pages carrying AdSense code, Google’s certified consent message owns the advertising choice. On pages without ads, our first-party banner asks only about optional analytics cookies and never grants advertising consent. If serving begins and you decline personalised advertising, eligible ads may instead be non-personalised. You can revisit an available choice from the "Privacy settings" link in the site footer.

Analytics

We use Google Analytics 4 (measurement ID G-56N53QZVQH) to understand which lessons people actually finish, which pages are broken, and where learners give up. It is the only analytics tool on the site.

We record page views plus a small number of named events: completing a placement test, saving a flashcard, and creating an account. These are counted, not tied to a name — we use them to decide what to build next, and for nothing else.

IP addresses are anonymised by Google Analytics 4 by default. We have not enabled Google Signals, advertising features or cross-device tracking in our Analytics property.

Third parties we actually use

This is the complete list. Every one of these is a service the site genuinely loads — if a name is not here, we are not sending your data to it.

Why we are allowed to hold this (legal basis)

• Contract — account data and essential account, security, exam and service-update email exist because you asked us to provide a membership and save your progress.
• Consent — advertising and analytics cookies in the EEA/UK, and marketing email anywhere. You can withdraw consent at any time without losing access to any lesson.
• Legitimate interests — keeping the service secure, preventing abuse, and fixing what is broken.

How long we keep things

• Local, guest-mode data — until you clear your browser. We never see it.
• Account data — for as long as the account exists, then deleted on request.
• Contact messages — deleted once the conversation is finished.
• Analytics — retained on Google's default schedule for a GA4 property.
• Exam voice recordings — 12 months, or sooner if you ask.
• Exam scripts, marks and proctoring events — kept with the attempt record, because a certificate has to remain checkable for as long as it is shown to anyone.
• Order records — kept as long as tax and accounting law requires, which is longer than we would otherwise choose and is not ours to shorten.

Security

Account data lives in Google Firestore behind server-enforced security rules: each account can read and write only its own records, and those rules are enforced by Google's servers rather than by anything running in your browser. The whole site is served over HTTPS with HSTS.

No system is perfect. If you believe you have found a security problem, please write to us before disclosing it publicly and we will fix it as fast as we can.

Children

VEA is a general-audience education site and is not directed at children under 13. We do not knowingly collect personal information from a child under 13.

Since 2026-09-08 that is checked rather than assumed: creating an account asks for a year of birth, and a year that puts you under 13 is refused at that point — before any account exists. Nothing else about the site changes for you, because none of it needs an account.

Teachers using our material with a class should have pupils work in guest mode, which stores nothing off the device and requires no account at all. Every lesson, story, quiz and grammar page works fully without signing in.

If you are a parent or guardian and believe a child has created an account here, write to us at virtuousenglish@virtuousenglishacademy.com and we will delete it.

International transfers

Our hosting, authentication and database are provided by Google and may process data on servers outside your country, including in the United States. Google relies on the European Commission's Standard Contractual Clauses and the EU–US Data Privacy Framework for those transfers.

Your rights

Wherever you live, you can ask us to:

• Show you a copy of the account data we hold about you.
• Correct anything that is wrong.
• Delete your account and everything attached to it.
• Stop marketing email, at any time, with one click.
• Restrict or object to a particular use of your data.

Deletion you do not need to ask for. Delete your account removes your profile, progress, saved words, notes and certificates immediately, from your own browser, with no request to us and no waiting period. That page also lists the two things which cannot vanish in the same instant, and why.

Under the GDPR you also have the right to data portability and the right to complain to your national data-protection authority. Under the CCPA/CPRA you have the right to know, delete, correct, and to opt out of "sale" or "sharing" — we do not sell or share personal information as those laws define it, and you will never be treated differently for exercising any of these rights.

To make a request, email virtuousenglish@virtuousenglishacademy.com from the address on the account. We answer within 30 days.

Changes to this policy

If we change how we handle your data in a way that matters, we will update the date at the top of this page and, for anything significant, say so on the site itself. Continuing to use VEA after a change means you accept the updated policy.