Last updated: 2024-12-21
ICS English is an AI-powered language-learning platform operated by 24 English Özel Eğitim Sanayi ve Ticaret Ltd. Şti. (trading as “ICS English”). This Privacy Policy explains what personal data we collect, how and why we use it, the trusted providers who process it on our behalf, and the rights available to you. It applies to our mobile applications and websites worldwide and is designed to meet the requirements of the GDPR (EU/UK), the CCPA/CPRA (California) and the KVKK (Türkiye). Our learning experience is delivered entirely by artificial intelligence — there are no live human-teacher lessons.
We collect the following categories of personal data: • Account & profile: your name, email address, optional phone number, authentication identifiers, age group, native and target languages, level, learning goals and interests, and avatar. • Learning & usage: lessons completed, scores, streaks and points, exam and speaking results, activity history, in-app preferences, device and diagnostic information, and IP address. • Voice & audio: when you use speaking, pronunciation or live-conversation features, your microphone audio is captured to generate feedback (processed in real time and not stored as raw audio — see “AI & Voice Processing”). • Practice content: your interactions with the Voxi AI tutor. • Payment: limited transaction and subscription details received from our payment providers; we do not collect your full card data. • Children’s data: collected only where a parent or guardian creates and manages a child profile (see “Children & Minors”).
We use your personal data to create and secure your account; deliver and personalize lessons, feedback and the Voxi AI tutor; assess pronunciation and examinations; track and report your progress; provide customer support; send service communications and, with your consent, reminders and marketing; operate subscriptions; safeguard the platform and prevent misuse; and comply with our legal obligations. Our legal bases under the GDPR are the performance of our contract with you, your consent (for voice processing, marketing and optional features), our legitimate interests (security and service improvement), and compliance with legal obligations. We do not sell your personal data.
Your interactive practice — the Voxi AI tutor, pronunciation feedback, conversation and speaking or exam practice — is delivered entirely by artificial intelligence; there are no live human-teacher video lessons. To provide these features, a limited amount of data is processed by trusted providers acting as our data processors under contract: • Microsoft Azure Speech — your voice audio and the reference text are processed to generate pronunciation and fluency scores (processed in a European Union region). • Google Gemini — the text and, for live conversation, the audio of your practice, together with learning context, are processed to generate real-time tutor responses, lessons and feedback. • Anthropic Claude — practice and conversation text is processed to generate tutor responses and feedback. • DeepSeek — to generate practice content we transmit de-identified content attributes only: your selected interest topic, level and language. We never send your name, account or identity, so this provider cannot identify you. • ElevenLabs — lesson and curriculum text is converted into natural speech; no account-identifying data is sent. We do not store your raw voice recordings or full conversation transcripts: audio is processed in real time for feedback and then discarded. We do not sell your data and do not use your voice or conversations to identify you for advertising. We share only the minimum necessary to deliver each feature, on our instructions; our providers may not use your content for their own purposes, and your content is not used to train these providers’ general AI models under the API terms we use. Microphone features operate only after you grant microphone permission, which you may revoke at any time in your device settings.
We apply organizational and technical safeguards appropriate to the risk, including encryption in transit and at rest, strict access controls and security rules, least-privilege server-side enforcement, and audit logging. Access to personal data is limited to authorized personnel and to processors engaged under contract. No method of transmission or storage is completely secure, but we work continually to protect your information.
We use strictly necessary cookies for authentication and session management, and limited analytics to understand and improve our service. We do not use third-party advertising cookies. Please see our Cookie Policy for details and your choices.
We engage carefully selected providers who process data solely to deliver their service to us: • Google Firebase / Google Cloud — hosting, authentication, database, storage, push notifications and analytics (United States). • Google Gemini — AI tutor, live conversation and content generation (United States). • Anthropic (Claude) — AI tutor reasoning and feedback (United States). • Microsoft Azure Speech — pronunciation and fluency assessment (European Union region). • DeepSeek — practice-content generation using de-identified attributes only, with no identifying data (People’s Republic of China). • ElevenLabs — text-to-speech audio generation (United States). • Paddle — payments for purchases made on our website, as Merchant of Record (EU/US). • SendPulse — email and messaging notifications (EU/US). In-app subscriptions, where offered, are processed by the Apple App Store and Google Play; we do not handle in-app payment card data. We do not currently use OpenAI; should we engage additional providers, we will update this Policy.
We operate globally, and your personal data may be processed in the United States, the European Union, Türkiye and — for de-identified content generation only — the People’s Republic of China. Where we transfer personal data outside your region, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses and equivalent mechanisms. Before transmitting data to providers in countries without an adequacy decision (for example, DeepSeek), we de-identify it so that it cannot be linked to you.
We practice data minimization. We do not store your raw voice recordings or full conversation transcripts — speaking and live-conversation audio is processed in real time to provide feedback and is then discarded. Following a session we retain only a short AI-generated memory summary and derived skill analysis (scores and insights, not raw content) to support your learning continuity; for learners under 18, a parent-facing summary is generated for transparency, never the raw conversation. Your account, learning and derived records are kept while your account is active and are permanently erased within 30 days of your deletion request (after a 30-day recovery window). Payments are handled by the Apple App Store, Google Play and Paddle as Merchants of Record, who retain billing data under their own policies; we retain only your subscription status, which is erased with your account. We keep our own commercial and accounting records as required by Turkish law; these are business records and do not include your learning profile.
Depending on your location, you have the right to access, correct, delete, restrict or object to the processing of your personal data, and to data portability. You can delete your account and export your data directly within the app, under Settings → Account. • EU/UK (GDPR): the rights above, and the right to lodge a complaint with your local supervisory authority. • California (CCPA/CPRA): the right to know, delete and correct your information, the right to opt out of the “sale” or “sharing” of personal information — we do not sell or share your personal information — and the right to non-discrimination. • Türkiye (KVKK): the rights set out in Article 11 of the KVKK. To exercise any right, contact us at [email protected]. We respond within the period required by applicable law.
You may permanently delete your account at any time from Settings → Delete Account. Deletion follows a 30-day grace period: if you sign in within 30 days your account is restored; after 30 days your data is permanently erased, subject to any records we are required to retain by law. You may obtain a machine-readable copy of your data at any time from Settings → Export My Data.
ICS English offers age-appropriate learning, including experiences designed for children. Child accounts are created and managed by a parent or guardian, who provides consent and controls the child’s data. We collect from children only what is necessary to deliver the learning experience, we do not show third-party advertising to children, and we do not build advertising profiles of them. Parents may access, correct or delete their child’s data at any time through the parent account or by contacting us. Our mobile application is rated for adult learners (17+); children’s experiences are offered on our web platform under parental control and will come to mobile in a future release.
We may update this Privacy Policy from time to time. For material changes we will provide reasonable notice — for example, within the app or by email — before they take effect, and we will seek your renewed consent where required. The “last updated” date shown above always reflects the current version.
Data Controller: 24 English Özel Eğitim Sanayi ve Ticaret Ltd. Şti. (trading as “ICS English”), Balbey Mah. 410 Sok. No:8 Tunca İş Merkezi K:3-4, Muratpaşa/Antalya, Türkiye. For any privacy, data-protection or KVKK request, contact us at [email protected].