1. Introduction
This Privacy Policy explains how TOEFLGRADER (“we”, “us”) collects, uses, and shares information when you use TOEFL AI Tutor at toeflgrader.com. By using the Service, you acknowledge this Policy.
2. Data we collect
- Account data: name, email, password (hashed), optional profile image, preferences.
- Submission data: essay text, questions, uploaded files (PDF, Word, images), OCR-extracted text, task metadata.
- Report and learning data: band scores, feedback, study plans, learning editions.
- Payment data: processed by Stripe; we do not store full card numbers.
- Technical data: IP address, device/browser, pages visited, referral/UTM parameters, approximate location from IP.
- OAuth data: if you sign in with Google, we receive profile information according to Google’s policies and your permissions.
3. How we use data
- Provide grading, reports, mock exams, and personalized learning.
- Authenticate users, secure accounts, and prevent fraud or abuse.
- Process subscriptions, credits, and customer support.
- Send transactional email (password reset, receipts).
- Analyze product usage to improve reliability and features.
- Comply with legal obligations.
4. AI processing
Essays and related inputs are processed by automated models to generate scores and feedback. Do not include highly sensitive personal data (for example government ID numbers or health details) in essays unless necessary for the writing task. AI outputs are practice tools, not official exam results.
5. Sharing and processors
We do not sell your personal data. We share data with service providers who help us operate the Service under contractual obligations, including: Supabase (database/auth storage), Stripe (payments), email delivery providers, Vercel (frontend hosting), and Fly.io (API hosting). We may disclose information if required by law or to protect rights, safety, and security.
6. Retention
We retain account and submission data while your account is active and as needed to provide the Service, resolve disputes, and meet legal requirements. You may request deletion; we will delete or anonymize personal data except where retention is required by law or for legitimate security/accounting records.
7. Your rights
Depending on your location (including GDPR/UK GDPR and CCPA/CPRA where applicable), you may have rights to access, correct, delete, export, or restrict processing of your personal data, and to object to certain processing. You may also withdraw consent where processing is consent-based. To exercise rights, use Settings or contact Support. You may lodge a complaint with a supervisory authority where applicable.
8. International transfers
We may process data in countries other than your own. Where required, we use appropriate safeguards for cross-border transfers.
9. Children
The Service is not directed to children under 13 (or under 16 in the EEA/UK where applicable). We do not knowingly collect personal data from children below those ages.
11. Security
We use industry-standard measures such as encryption in transit, access controls, and hashed passwords. No method of transmission or storage is 100% secure.
12. Changes
We may update this Policy and will post the revised version with an updated date. Material changes may be communicated via the Service or email when appropriate.
13. Contact
Privacy requests: Settings → Support in your account, or the support contact published on the Service.