Privacy Policy

Who we are and what this covers

Virtuous English Academy ("VEA", "we", "us") runs the free English-learning website at virtuousenglishacademy.com. This policy covers that website and every page on it.

It explains what data we hold, why we hold it, who else can see it, and what you can make us do about it. It is written to meet the UK GDPR, the EU GDPR, the CCPA/CPRA, and the disclosure requirements of the Google AdSense programme.

If anything here is unclear, ask us at virtuousenglish@virtuousenglishacademy.com — we would rather explain it than have you guess.

What we collect

Your data sits in one of two layers, and which one depends entirely on whether you have chosen to create an account.

If you use VEA without an account

Your progress, quiz states, saved preferences and study timers are written to your own browser's localStorage. That data stays on your device. We cannot read it, and it is never transmitted to us.

You can erase all of it at any moment by clearing site data in your browser. You do not need to ask us, and nothing is kept on our side to delete.

If you create a free account

Signing in lets your progress follow you between devices, and it is what a certificate is issued against. Creating an account asks for four details on one screen, once. We store, against your account:

• Your email address, handled by Google Firebase Authentication.
• Your given name and family name — the name a certificate would be issued in, which is why we ask for a real one rather than a nickname.
• Your nationality — printed on a certificate, as it is on any language certificate. “Prefer not to say” is on the list and is a complete answer.
• Your year of birth — a year, never a full date. It does two jobs: telling two candidates with the same name apart on an exam record, and letting us apply the under-13 rule below. An exact date of birth is not asked for and the form would not accept one.
• Whether your email is verified, and the date and policy version recorded when you created the account.
• Course progress, streak count, XP, badges and weekly study seconds.
• Flashcards and vocabulary you choose to save, and notes you write in the dashboard.
• Placement-test results and any certificate you generate.
• Whether you ticked the optional marketing-email box when you signed up.

We never see your card. Almost everything on VEA is free; the one exception is the Certified English Placement Exam. If you buy it, the payment is taken by Dodo Payments on its own checkout page. Your card number, expiry and security code are entered there, not here, and are never transmitted to us or stored on our servers. What comes back to us is a confirmation that an order was paid, an order reference, and the country the provider used to work out tax.

We do not ask for your address, phone number, exact date of birth or any government identifier. A year of birth is a year: it is not a date, and there is no way to derive one from it.

If you write to us

Messages sent through our contact page reach us by email and include the name, email address and message you typed. We keep them only as long as we need to answer you.

The Word Trainer — your words, your streak and the weekly league

The Word Trainer works without an account, and then everything it knows about you stays in your browser. If you sign in, a copy of your progress is also kept with your account, so it follows you between devices: which words you have met, when each one is due, how many questions you answered on each day, and the points those answers earned.

The weekly league is a choice

Nobody is put on the league. If you choose to join it, other signed-in learners can see four things: the name you typed, your level, the points you earned this week and the length of your streak. They cannot see your email address, the name on your account, or anything else about you.

You can leave the league at any time from the league screen, which takes your row down. Deleting your account removes your league rows and your saved words as well.

The certified exam — payment, recordings and AI marking

The details you give before you start

Before the first question the exam asks for five things, and it asks for them because a certificate names a person. You give them once, on a screen where the clock is not yet running, and you can see exactly how your name will be printed before you confirm it.

• Your given name and family name — printed on the certificate, which is the whole reason we ask. They cannot be changed after the exam is scored, so please check them on that screen.
• An email address — where we send your result and your certificate link. It is your choice and does not have to be the address you signed in with.
• Your nationality — printed on the certificate, as it is on any language certificate. “Prefer not to say” is on the list and is a complete answer.
• Your year of birth — a year, never a full date. It does the job a date of birth does on an exam record, which is telling two candidates with the same name apart, without putting an exact date of birth on a page anyone with the link can read. We do not ask for one and the exam would not accept one.

Your name, nationality and year of birth appear on your certificate, and a certificate page is public to anyone who has its link — that is what makes it shareable and verifiable. Nothing else from your account appears there. If you delete your account, your certificates go with it.

What sitting the exam stores

• Your answers to every question, and how long each one took.
• The text of your writing tasks, including the draft as it autosaves.
• Audio recordings of your spoken answers — see below.
• Proctoring events: how many times the exam window lost focus, left full screen, or refused a copy or paste. We record that these happened and when; we do not record what you switched to, and we cannot see your screen, your camera or any other application.
• The result: your band per skill, the marker's written feedback, and the certificate if one is issued.

Your voice recordings

The speaking section asks you to record three short spoken answers — two open questions and one sentence read aloud. Your microphone is active only while you are recording, you can listen back before you submit, and you can skip the section; nothing is marked from it either way.

• Why we hold them: to keep them with your attempt, and as evidence if an attempt is flagged for review. Nothing marks them at present. Nothing else. The legal basis is performance of the contract you entered when you bought the exam.
• Where they live: a private Google Cloud Storage bucket that no browser can read — only our server-side code can reach it.
• How long: 12 months, then deleted. You can ask us to delete them sooner at any time, and we will, unless the attempt is under active review.
• What we never do: publish them, sell them, use them to advertise, use them to identify you biometrically, or use them to train anybody's model.

Writing and speaking responses

Your writing and speaking responses stay with your exam attempt in our Google Cloud services. They are not sent to an external AI marker or speech-recognition provider.

• What is stored: the task prompt, what you wrote or recorded, and a few facts about how you worked, such as timing and revisions.
• What the detailed result uses: grammar, vocabulary, reading and listening answers scored on our servers.
• Training: we do not use your responses to train a model.

The result email

When your exam is scored we email the result to the address you gave on that first screen: your level, your score and its margin, your bands by skill, and a link to your certificate if one was issued. It is sent once, by our transactional email provider, and it is not marketing — there is no list to join and nothing else is sent to that address. If the name on the certificate is wrong, replying to that email is the fastest way to reach us.

Payment data

The sale is handled by Dodo Payments as merchant of record (their privacy policy). That company, not VEA, is the seller on your bank statement and the party that handles your card data, the tax and any dispute. We receive an order reference, the amount, the currency and the country used to work out tax, and we store those against your account so we know the exam is unlocked. We do not receive, and cannot ask for, your card number.

Advertising — how ads on this site work

Yandex Advertising Network. Eligible lesson, grammar, vocabulary, story and blog pages carry one advertising space inside the lesson and one at its end, and on a wide screen one more on each side of the lesson. Yandex is contacted only for visitors outside the EEA, the UK and Switzerland — and not in Ukraine, where Yandex is blocked — once you scroll, tap or press a key, or a few seconds after the page has loaded. Nobody in the EEA, the UK or Switzerland loads it. Yandex mainly sells advertising for Russia and Central Asia, so elsewhere a space often has nothing to show and closes again. After 3 empty answers in a row the site stops asking until you close the tab; it keeps that count, a number and nothing about you, in your browser's sessionStorage. Our contract for these ads is with Air Smart Advertising Solutions FZ-LLC (Dubai, United Arab Emirates), under the Yandex Advertising Network Terms of Offer.

Where its advertising loads, Yandex may use cookies and similar technology to choose, show, measure and protect ads, including ads based on your visits to other sites. Yandex handles that data under its own privacy policy. We receive only aggregate reports, never who saw or clicked an ad.

Infolinks (publisher ID 3448116) ran on editorial pages from 24 to 28 September 2026 and has been switched off. No Infolinks script is loaded any more.

Affiliate link: Preply. Most lesson, exercise, story and blog pages end with one card that links to online English tutors on Preply. It is an affiliate link through the Impact partner network: if you book a lesson, Preply may pay us a commission. The card is marked as an affiliate link on the page, and it never changes what a lesson teaches. The sign-in page shows it beside the form. Tests, the exam, games, other account screens and policy pages do not carry it.

The card is a plain link. It loads no script and sets no cookie on this site, and we send no personal data with it. When you click it, you go to Preply through Impact’s tracking address (preply.sjv.io); Preply and Impact may set their own cookies there to record that the visit came from us, under their own privacy policies.

Google AdSense is paused. No AdSense advertising script is loaded anywhere on the site. The homepage retains only the non-serving ownership-verification meta for publisher ID ca-pub-6733098045611992.

Advertising is limited to eligible lesson, grammar, vocabulary, story, blog and similar editorial pages. Policy pages, tests, games, account screens, the lesson directory, the homepage and the certified exam stay ad-free.

The advertising disclosures we make

• Third-party vendors — today Yandex, for visitors outside the EEA, the UK and Switzerland — may use cookies or similar technology to select, deliver, measure and protect advertising.
• Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to our site and/or other sites on the internet.
• You can opt out of personalised advertising by visiting Google Ads Settings.
• You can switch off personalised ads from Yandex in the Yandex ad settings.
• You can opt out of a third-party vendor's use of cookies for personalised advertising at the Network Advertising Initiative, aboutads.info/choices, or — in Europe — at youronlinechoices.eu.

What we do not do

We do not build our own advertising profiles, run cross-site behavioural tracking of our own, or sell your personal information to data brokers. Advertising data is processed by the advertising providers under their own policies, not passed to us as a list of people — we receive aggregate reporting, never the identity of who saw or clicked an ad.

If you are in the EEA, the UK or Switzerland

Consent Mode defaults advertising and analytics storage to denied in these regions. No advertising is loaded for visitors in these regions, so our first-party choice covers optional analytics only. You can revisit your choice from the "Privacy settings" link in the site footer.

Everywhere else

Outside these regions optional analytics runs by default, and so does the Yandex advertising described above. To turn either off, choose "Decline" under the "Privacy settings" link in the site footer: the advertising leaves the page you are on, and nothing is loaded from Yandex from the next page on. The site decides which rules apply from your device's time zone, and asks first whenever that time zone could belong to one of these regions or cannot be read.

Analytics

We use Google Analytics 4 (measurement ID G-56N53QZVQH) to understand which lessons people actually finish, which pages are broken, and where learners give up. It is the only analytics tool on the site.

We record page views plus a small number of named events: completing a placement test, saving a flashcard, and creating an account. These are counted, not tied to a name — we use them to decide what to build next, and for nothing else.

IP addresses are anonymised by Google Analytics 4 by default. We have not enabled Google Signals, advertising features or cross-device tracking in our Analytics property.

Third parties we actually use

This is the complete list. Every one of these is a service the site genuinely loads — if a name is not here, we are not sending your data to it.

Why we are allowed to hold this (legal basis)

• Contract — account data and essential account, security, exam and service-update email exist because you asked us to provide a membership and save your progress.
• Consent — advertising and analytics cookies in the EEA/UK, and marketing email anywhere. You can withdraw consent at any time without losing access to any lesson.
• Legitimate interests — keeping the service secure, preventing abuse, and fixing what is broken.

How long we keep things

• Local, guest-mode data — until you clear your browser. We never see it.
• Account data — for as long as the account exists, then deleted on request.
• Contact messages — deleted once the conversation is finished.
• Analytics — retained on Google's default schedule for a GA4 property.
• Exam voice recordings — 12 months, or sooner if you ask.
• Exam scripts, marks and proctoring events — kept with the attempt record, because a certificate has to remain checkable for as long as it is shown to anyone.
• Order records — kept as long as tax and accounting law requires, which is longer than we would otherwise choose and is not ours to shorten.

Security

Account data lives in Google Firestore behind server-enforced security rules: each account can read and write only its own records, and those rules are enforced by Google's servers rather than by anything running in your browser. The whole site is served over HTTPS with HSTS.

No system is perfect. If you believe you have found a security problem, please write to us before disclosing it publicly and we will fix it as fast as we can.

Children

VEA is a general-audience education site and is not directed at children under 13. We do not knowingly collect personal information from a child under 13.

Since 2026-09-08 that is checked rather than assumed: creating an account asks for a year of birth, and a year that puts you under 13 is refused at that point — before any account exists. Nothing else about the site changes for you, because none of it needs an account.

Teachers using our material with a class should have pupils work in guest mode, which stores nothing off the device and requires no account at all. Every lesson, story, quiz and grammar page works fully without signing in.

If you are a parent or guardian and believe a child has created an account here, write to us at virtuousenglish@virtuousenglishacademy.com and we will delete it.

International transfers

Our hosting, authentication and database are provided by Google and may process data on servers outside your country, including in the United States. Google relies on the European Commission's Standard Contractual Clauses and the EU–US Data Privacy Framework for those transfers.

Your rights

Wherever you live, you can ask us to:

• Show you a copy of the account data we hold about you.
• Correct anything that is wrong.
• Delete your account and everything attached to it.
• Stop marketing email, at any time, with one click.
• Restrict or object to a particular use of your data.

Deletion you do not need to ask for. Delete your account removes your profile, progress, saved words, notes and certificates immediately, from your own browser, with no request to us and no waiting period. That page also lists the two things which cannot vanish in the same instant, and why.

Under the GDPR you also have the right to data portability and the right to complain to your national data-protection authority. Under the CCPA/CPRA you have the right to know, delete, correct, and to opt out of "sale" or "sharing" — we do not sell or share personal information as those laws define it, and you will never be treated differently for exercising any of these rights.

To make a request, email virtuousenglish@virtuousenglishacademy.com from the address on the account. We answer within 30 days.

Changes to this policy

If we change how we handle your data in a way that matters, we will update the date at the top of this page and, for anything significant, say so on the site itself. Continuing to use VEA after a change means you accept the updated policy.