Privacy Policy

1. Overview

Languages Lab (“Languages Lab”, “we”, “us”) provides a software-as-a-service platform that turns coursebooks into phonics-correct listening practice for English-language learners. This Privacy Policy explains what personal data we process, why, and the choices you have.

For most classroom data, the school or organisation is the data controller and Languages Lab acts as a data processor under their instructions. For account and billing data, we act as the controller. Where those roles differ, we say so below.

2. Information we collect

Account & organisation data

Name, work email, password (hashed), organisation name, role, and preferences. We create a separate, isolated tenant for each organisation.

Content you upload

The coursebooks, documents, slides, images, and text you upload, plus the items we extract from them (titles, vocabulary, sentences, questions, answers) and the audio we render. You control this content; we process it to provide the service.

Learner data

Depending on how a school configures the service, learners may access published lessons without an account. Where learner identifiers, progress, or playback preferences are stored, they are processed on behalf of the school. We do not build advertising profiles of learners.

Usage & technical data

Log data, device and browser information, IP address, feature usage, and the per-tenant AI usage ledger (which AI operations ran, token counts, and cost) used for billing and abuse prevention.

Cookies & local storage

See our Cookies Policy. We use strictly-necessary cookies for authentication and security, and local storage to remember your theme and accessibility preferences.

3. How we use information

• To provide, secure, and maintain the platform and your account.
• To extract, classify, and render audio from the content you upload.
• To meter AI usage per tenant for billing and to enforce plan quotas.
• To prevent fraud, abuse, and security incidents.
• To provide support and to send service (not marketing) communications.
• To comply with legal obligations.

4. Legal bases (GDPR/UK GDPR)

Where the GDPR applies, we rely on: performance of a contract (to deliver the service you or your school signed up for); legitimate interests (security, abuse prevention, product improvement, balanced against your rights); legal obligation; and consent (for non-essential cookies and any optional processing, which you can withdraw at any time).

5. AI processing & subprocessors

Delivering the product requires sending content to specialist AI providers acting as our subprocessors. They process content only to return a result to us and under data-processing terms:

We maintain an up-to-date list of subprocessors and will notify controllers of material changes. Contact us at privacy@languageslab.mastereyes.com for the current list or a data-processing agreement.

6. Children's privacy

Languages Lab is sold to schools and educators, not directly to children, and is designed with COPPA and GDPR (including UK “age-appropriate design”) considerations in mind. Where a school uses the service with pupils under the applicable age of consent, the school is responsible for providing any notices and obtaining any consents required from parents or guardians, and directs our processing of learner data.

We minimise learner data, do not use it for advertising, and do not sell it. If you believe a child's data has been provided to us without proper authorisation, contact privacy@languageslab.mastereyes.com and we will work with the responsible school to address it.

7. Sharing & disclosure

We do not sell personal data. We share it only with the subprocessors above, with your organisation's administrators, where required by law or to protect rights and safety, and in connection with a business transfer (subject to this Policy). Payment processing is handled by our payment provider; we do not store full card numbers.

8. Data retention

We retain content and account data for as long as the account is active and as needed to provide the service, then delete or anonymise it within a reasonable period, subject to legal retention requirements. Schools can request deletion of specific content or an entire tenant. Backups are cycled on a rolling schedule.

9. Security

We use encryption in transit and at rest, tenant isolation enforced at the database level (row-level security), signed time-limited URLs for media assets, least-privilege access, and audit logging. No system is perfectly secure, but we work to protect your data and to notify affected parties of qualifying breaches as required by law.

10. International transfers

Our providers may process data in countries other than yours. Where required, we rely on appropriate safeguards such as the EU Standard Contractual Clauses (and the UK Addendum) for such transfers.

11. Your rights

Depending on your location, you may have rights to access, correct, delete, restrict, or port your personal data, and to object to certain processing. If a school controls your data, please direct requests to that school; we will assist them as their processor.

To exercise rights where we are the controller, or for any privacy question, email privacy@languageslab.mastereyes.com. You also have the right to complain to your local data protection authority.

12. Changes to this policy

We may update this Policy from time to time. We will change the “Last updated” date above and, for material changes, provide additional notice.

13. Contact

Questions or requests: privacy@languageslab.mastereyes.com. See also our Terms of Use and Cookies Policy.