Privacy Policy

Bradnova Technologies Ltd. ("Bradnova", "we", "us", or "our") operates the NovaEnglish platform accessible at novaenglish.com and via our mobile apps (collectively, the "Service").

This Privacy Policy explains what personal data we collect when you use NovaEnglish, why we collect it, how we use and protect it, and what rights you have in relation to it.

By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree with any part of this policy, please do not use our Service.

1.1 Information you provide directly

• Account information: When you create an account, we collect your name, email address, and password (stored as a secure hash).
• Profile information: You may optionally add a display name, profile picture, and your native language to personalise your experience.
• Assessment responses: When you take a CEFR assessment, we record your answers to each question to generate your score and level placement.
• Writing samples: If you complete the writing section of an assessment, we store the text you submit for AI evaluation via the Anthropic Claude API.
• Communications: When you contact us via email or our contact form, we retain the content of your messages to provide support and improve our service.

1.2 Information collected automatically

• Usage data: We log pages visited, features used, time spent in the app, and navigation patterns to understand how you use the Service and improve it.
• Device information: We collect your browser type and version, operating system, screen resolution, and language settings.
• IP address: Collected for security and fraud prevention purposes. We do not use it for advertising.
• Performance metrics: Response times, error rates, and crash reports help us maintain service reliability.

1.3 Information from third parties

If you sign in using Google or another third-party OAuth provider, we receive your name and email address from that provider. We do not receive or store your third-party passwords.

We use the personal data we collect for the following purposes:

• Providing the Service: Creating and managing your account, processing assessments, generating your CEFR level report, and personalising your study plan.
• Improving the Service: Analysing aggregate usage patterns to identify areas for improvement, debug issues, and develop new features.
• AI-powered features: Your writing samples are sent to the Anthropic Claude API to provide automated feedback and scoring. These are transmitted securely and not used by Anthropic to train their models (see Section 4).
• Communications: Sending transactional emails (account confirmation, password reset, assessment results) and, where you have opted in, product updates and educational tips.
• Security: Detecting and preventing fraud, abuse, and unauthorised access to the Service.
• Legal obligations: Complying with applicable laws, regulations, and lawful government requests.

We process your data on the following legal bases under GDPR: (a) performance of a contract — to provide the Service you signed up for; (b) legitimate interests — to improve the Service and ensure security; (c) consent — for optional marketing communications; and (d) legal obligation — where required by law.

We do not sell, rent, or share your personal data with third parties for advertising purposes. We share information only in the following limited circumstances:

• Service providers: We use trusted third-party service providers who process data on our behalf and under strict data processing agreements:
  • Supabase Inc. — database hosting, authentication, and storage (servers located in the EU)
  • Anthropic PBC — AI processing of writing samples for assessment scoring (data not used for model training)
  • Stripe Inc. — payment processing for paid plans (we do not store card details)
  • Vercel Inc. — web hosting and CDN infrastructure
• Legal requirements: We may disclose your information if required to do so by law, court order, or government authority, or when we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.
• Business transfers: If Bradnova Technologies is involved in a merger, acquisition, or asset sale, your data may be transferred. We will notify you via email and a prominent notice on our Service before your data is transferred and becomes subject to a different privacy policy.

Your data is stored in PostgreSQL databases hosted by Supabase on servers located within the European Union (Ireland). We take the following measures to protect your data:

• Encryption in transit: All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher.
• Encryption at rest: Database volumes are encrypted at rest using AES-256.
• Password security: Passwords are hashed using bcrypt with a cost factor of 10 before storage. We never store plain-text passwords.
• Access controls: Database access is restricted to authorised personnel only, enforced via row-level security (RLS) policies and service-role keys.
• Monitoring: We maintain audit logs of administrative access and monitor for suspicious activity.

No method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security. In the event of a data breach that affects your rights and freedoms, we will notify you within 72 hours of becoming aware of it, as required by GDPR.

We use cookies and similar tracking technologies. Please see our Cookie Policy for full details. In summary:

• Essential cookies: Required for authentication and to maintain your session. These cannot be disabled.
• Functional cookies: Remember your language preference and UI settings.
• Analytics cookies: Help us understand how the Service is used (anonymous, aggregate data only).

You can control non-essential cookies through your browser settings or our cookie consent banner.

Under the General Data Protection Regulation (GDPR) and UK GDPR, you have the following rights in relation to your personal data:

• Right of access: Request a copy of all personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure: Request deletion of your personal data (“right to be forgotten”). You can also delete your account directly from Settings → Account → Delete Account.
• Right to data portability: Receive your data in a structured, machine-readable format (JSON or CSV).
• Right to object: Object to processing based on legitimate interests, or to direct marketing at any time.
• Right to restrict processing: Request that we limit how we use your data in certain circumstances.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at privacy@novaenglish.com. We will respond within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with your national data protection authority (e.g., the ICO in the UK, or the CNIL in France).

We retain your personal data for as long as your account is active or as needed to provide you the Service. Specific retention periods:

• Account data: Retained while your account is active. Deleted within 30 days of account closure.
• Assessment data: Retained for the lifetime of your account, then deleted with it.
• Writing samples: Retained for 90 days after submission for quality assurance, then automatically deleted.
• Support communications: Retained for 2 years from the date of resolution.
• Billing records: Retained for 7 years as required by financial regulations.
• Server logs: Retained for 90 days for security and performance purposes.

The Service is not directed at children under 13 years of age. We do not knowingly collect personal data from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@novaenglish.com and we will delete that information promptly.

Users aged 13–17 may use the Service with parental or guardian consent. Schools and educational institutions wishing to use NovaEnglish for students under 18 should contact us to establish a data processing agreement appropriate for their jurisdiction.

We may update this Privacy Policy from time to time. We will notify you of significant changes by:

• Sending an email to the address associated with your account
• Displaying a prominent notice within the app
• Updating the “Last updated” date at the top of this page

Your continued use of the Service after the effective date of changes constitutes your acceptance of the revised policy. If you do not agree to the updated policy, you must stop using the Service and delete your account.

If you have questions about this Privacy Policy or our data practices, please contact: