Privacy Policy

Privacy policy

Last updated: 28 April 2026

In short: we store the minimum we need to run an IELTS speaking practice service. Audio recordings are deleted automatically after 90 days. We name every third party that touches your data, and we never sell it.

ScoreReady ("we", "us", "our") is an IELTS Speaking practice platform operated from the United Kingdom. This policy explains what personal data we collect, why, and what rights you have over it. We are the data controller for the personal data described below. The Information Commissioner's Office (ICO) is the supervisory authority for the UK.

1. What data we collect

Summary: account details for teachers, audio recordings and email gates for students, and the bare minimum needed to bill paying customers.

• Teacher accounts: name, email address, hashed password, and any optional profile information you add.
• Student access: students join via a teacher's shared link and email gate. We store the email address you enter so the teacher can identify your submissions.
• Audio recordings: the speaking responses you record through the browser microphone.
• AI-generated content: transcripts, scores, written feedback, and synthesised question audio produced for your exercises.
• Exercise content: reading passages, cue cards, and questions that teachers create.
• Operational data: session cookies, sign-in timestamps, and basic technical logs needed to keep the service running.
• Billing data: if you pay for a Pro or Pro+AI plan, Stripe handles your card details. We only see the metadata Stripe returns to us (subscription status, last four digits, billing country).

2. How audio recordings are handled

Summary: audio is stored on our UK server, processed by AssemblyAI for transcription and Anthropic for grading, and deleted automatically after 90 days.

• Recordings are saved to encrypted storage on our UK virtual private server.
• Each recording is sent to a transcription sub-processor (AssemblyAI by default, with OpenAI Whisper as a fallback).
• The resulting transcript is sent to Anthropic (Claude) for grading and feedback.
• Audio files are automatically deleted 90 days after submission. After that point only the transcript and feedback remain.
• Teachers and students can request earlier deletion at any time via our support route. We action verified deletion requests within 7 working days.

3. Sub-processors

Summary: a small number of named third parties process specific data for us. Each one is bound by their own privacy notice and, where relevant, a data processing agreement.

• AssemblyAI — transcribes recordings into text. Privacy notice.
• OpenAI — fallback transcription via the Whisper API when AssemblyAI is unavailable. Privacy notice.
• Anthropic — grades transcripts and produces written feedback using Claude. Privacy notice.
• ElevenLabs — synthesises the spoken question audio that students hear. Privacy notice.
• Stripe — processes subscription payments and credit top-ups. Privacy notice.
• Email delivery — transactional emails (sign-in, password reset, billing receipts) are sent via our SMTP provider. We do not run separate marketing tooling.

None of these services are owned by us. AssemblyAI, OpenAI, Anthropic, ElevenLabs, and Stripe are independent companies. Some of them are based in the United States; transfers are made under the UK extension to the EU–US Data Privacy Framework or the ICO's International Data Transfer Agreement, as applicable.

4. Why we process your data (lawful basis)

Summary: legitimate interests for running the service, contract for paid plans, and explicit consent for the few things that need it.

• Legitimate interests — providing IELTS Speaking practice, transcribing and grading recordings, keeping accounts secure, and preventing abuse.
• Performance of a contract — billing, subscription management, and credit top-ups for paying teachers.
• Consent — recording audio through the browser microphone (you grant this in the browser permission prompt) and any optional marketing emails. You can withdraw consent at any time.
• Legal obligation — keeping a minimum amount of billing data to satisfy UK tax law.

5. Data retention

Summary: we keep things only as long as we need to.

• Audio recordings: 90 days from submission, then deleted automatically.
• Transcripts and feedback: kept while the teacher's account is active. Deleted within 30 days of account closure or sooner on request.
• Teacher accounts: kept while you use the service. Closed accounts are purged within 30 days.
• Billing records: kept for 7 years to comply with UK tax law.
• Support tickets: kept for 24 months, then deleted.

6. Your rights

Summary: under UK GDPR you can ask to see, correct, export, or delete your data. We respond within one calendar month.

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct anything that is wrong.
• Erasure — ask us to delete your data ("right to be forgotten").
• Portability — receive your data in a machine-readable format.
• Objection — object to processing based on legitimate interests.
• Restriction — ask us to pause processing while a dispute is resolved.
• Withdraw consent — for anything we do on the basis of consent.

Send any of these requests via our support route. If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office.

7. Children and under-18 candidates

Summary: IELTS candidates can be under 18. Teachers are responsible for getting parental consent before adding minors.

ScoreReady is designed for use by English language teachers and their students. We do not knowingly market to children. If you are a teacher inviting candidates under the age of 18, you are responsible for obtaining the necessary parental or guardian consent before they record audio on the platform. We treat any account where the student is under 13 as ineligible — please contact us if you believe a child under 13 has used the service so we can remove their data.

8. Security

• Data in transit is encrypted with TLS (HTTPS).
• Audio files and database backups are stored on a UK virtual private server with restricted access.
• Passwords are hashed using a modern algorithm (bcrypt/argon2) and never stored in plain text.
• Access to production systems is limited to the operator and authenticated through SSH key pairs.

We do not claim certifications such as ISO 27001 or SOC 2. We describe what we actually do.

9. International transfers

Some of our sub-processors are based outside the UK (chiefly the United States). Where personal data is transferred outside the UK, we rely on the UK extension to the EU–US Data Privacy Framework, the ICO's International Data Transfer Agreement, or equivalent safeguards.

10. Cookies

We use a small number of strictly necessary cookies. Full details are in the Cookies policy. We do not run analytics, advertising, or tracking cookies.

11. Marketing

We do not send promotional emails by default. If you opt in to a newsletter, you can unsubscribe from any email or by emailing support. Student email addresses captured at the email gate are used solely to identify submissions to the teacher who shared the exercise — never for marketing.

12. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top will always reflect the most recent revision. Material changes will be communicated to registered users by email.

13. Contact

For any privacy question, deletion request, or complaint, please use our support route. We typically respond within two working days.