Last updated: October 2026 · Version 5.0
EnglishDee (“we”, “us”, “our”) operates the LMS platform at https://englishdee.com. We are the data controller for the personal data described in this policy, except where a teacher or school acts as the controller for their students’ data (see Section 10). For any privacy matter you can reach us at admin@englishdee.com.
We collect the following categories of data:
Where the GDPR or similar laws apply, we process personal data on the following legal bases:
We use collected information only to:
We do not sell or rent personal data. We share data only with the service providers below, who process it on our behalf under data protection agreements:
| Provider | Purpose | Data involved |
|---|---|---|
| Cloudways | Hosting platform (servers in Singapore, on DigitalOcean infrastructure) | All platform data |
| Cloudflare | Storage and delivery of user media (voice recordings, images) | Uploaded media files |
| Stripe | Payments and subscriptions | Name, email, payment details |
| OpenRouter | AI text grading and feedback | Submissions sent for grading |
| OpenAI | AI text grading and speech-to-text | Submissions and voice recordings |
| Brevo | Transactional email (SMTP relay) | Name, email |
| Umami Cloud | Privacy-friendly analytics | Aggregate, cookieless usage data |
| CDN providers (jsDelivr, cdnjs, Google Fonts) | Serving styles, scripts and fonts | IP address, browser data |
We may also disclose data to law enforcement or regulators if required by law, and to successors in the event of a merger or acquisition.
Our servers are located in Singapore, and the processing carried out there is subject to Singapore’s Personal Data Protection Act (PDPA). Data may be processed outside your country of residence. Where we transfer personal data out of Singapore (for example, to a subprocessor located elsewhere), we do so under written agreements that require the recipient to provide a standard of protection comparable to that under the PDPA. For users in the European Economic Area (EEA) or UK, we rely on Standard Contractual Clauses (SCCs) and, where applicable, the UK International Data Transfer Addendum to safeguard these transfers.
We use industry-standard security measures (encryption in transit, access controls, hashed passwords). If we become aware of a personal data breach that is likely to result in a risk to your rights, we will notify the relevant supervisory authority without undue delay and, where required, within 72 hours, and will inform affected users where the risk is high. Where Singapore’s PDPA applies, we will notify the Personal Data Protection Commission within 3 calendar days of determining that a notifiable breach has occurred.
We keep personal data only as long as necessary for the purposes described above:
| Data | Retention period |
|---|---|
| Account data (teacher/student) | While the account is active, plus 30 days after deletion |
| Voice recordings | Up to 12 months — or not stored at all when the teacher enables “transcribe upon submission” (the recording is deleted immediately after transcription; only the transcript is kept) |
| Written submissions and grades | While the account is active |
| Certificates | 5 years (to keep verification valid) |
| Server logs | 90 days |
| Backups | 30 days |
| Payment and tax records | As required by applicable tax law |
Where a teacher enables the “transcribe audio upon submission” option, each student recording is sent to our speech-to-text subprocessor, transcribed immediately, and the audio file is not retained on our servers — only the resulting transcript is stored (and shown to the student and the teacher). This option is available on AI (premium/trial) plans only.
Teachers may delete student data at any time from their dashboard. A teacher can delete an individual assignment, which permanently deletes the students’ submissions for that assignment (including recordings and grades), or delete an entire class, which also permanently deletes the class’s assignments and the students’ submissions for them and removes the students from that class (the students’ accounts are kept); already-issued certificates are not affected. Students can also delete their own submissions directly from their account: written answers and voice recordings can be deleted before a submission is graded, and once a submission has been graded (or a recording has been transcribed) the student can remove the recording file while the grade, transcript and feedback are kept. We will delete an account on request from the teacher or, for students, from a parent who verifies their identity.
We use a small number of strictly necessary cookies to keep you logged in and to protect forms (session and CSRF cookies). We also use Umami Cloud, a privacy-friendly, cookieless analytics service that does not use cookies and does not store personal data. For details, see our Cookie Policy.
EnglishDee does not directly collect parental consent. Instead, we require each teacher to attest that they have obtained all necessary consents under applicable local laws for any student under 18 using the platform. The teacher (or school) is the data controller for parental consent. We do not knowingly allow students under 13 to create accounts without a teacher-invited class code. If we learn that a student under 13 has created an account without such teacher invitation, we will delete the account promptly.
Each certificate contains a QR code linking to a public verification page, for example https://englishdee.com/certificates/verify.php?code=…. Anyone with the link or code can open this page and see the certificate holder’s name, the teacher’s name, the school, the class, the course title, and the issue date, in order to confirm that a certificate is genuine. This page is not indexed by search engines. If you do not want a certificate to be publicly verifiable, contact the issuing teacher; a certificate can be left unissued or removed by the teacher.
Depending on your jurisdiction, you may have the right to access, correct, delete, or restrict processing of your data, to object to processing, to data portability, and to withdraw consent. To exercise these rights:
We may update this policy. When we make significant changes, we will notify account holders by email and post a notice on the site at least 30 days before the changes take effect, and update the version and date at the top of this page.
For privacy questions or deletion requests:
Email: admin@englishdee.com