Draft preview. Owner details, the provider and storage audit, and legal review must be completed before publication.
Privacy Policy
Draft for owner completion and legal review. Do not publish with unresolved placeholders.
Effective date: {{EFFECTIVE_DATE}} · Version: 1.0.0 (draft, not yet in effect)
1. Who we are and how to contact us
ESL Teaching Studio is operated by Ian Magistrado Naz, trading as ESL Teaching Studio (the product name; not a registered business), at San Francisco, Iriga City, Camarines Sur, Philippines. This notice explains how we handle personal information through https://esl-teaching-studio.pages.dev/, our Windows application, account services, customer support and optional integrations.
For privacy questions or requests, contact infosyscoreteam@gmail.com. Our privacy contact or data protection officer, where applicable, is Ian Magistrado Naz. Customer support is available at infosyscoreteam@gmail.com and +63 910 567 3778.
For teacher accounts, service security, licensing and our business records, we decide the purposes and means of processing. Teachers or their organizations decide what learner information they enter and how it is used for teaching. Where we process that information on their documented instructions, our role and responsibilities depend on the service and applicable processing agreement. Keeping a copy in a teacher's Drive does not remove our responsibilities for processing performed by our software or services.
2. Information and purposes
| Information | How it is used |
|---|---|
| Account email, display name, account/provider identifiers and authentication records | Create and secure accounts, verify email, recover access and provide requested account features |
| Subscription/order identifiers, plan and payment status, billing/contact information received from checkout | Provide paid access, process support requests, maintain transaction records and prevent fraud |
| Device activation identifier, app version, permit status and relevant technical/security events | Apply disclosed license/device limits, support the app and protect the service |
| Account preferences selected for cloud storage | Apply supported preferences when you sign in on another device |
| Lesson text, vocabulary, activity settings and imported media you choose | Provide local editing, teaching, export and optional backup/restore |
| Optional learner profiles, progress or feedback entered by a teacher | Provide the teacher-selected functions; learner records are excluded from Drive backups by default |
| Google account identifier, granted permissions, authorization credentials and backup-file metadata | Connect the Drive account you choose and perform requested backup/restore actions |
| Messages, attachments and diagnostic information you send to support | Respond, troubleshoot and maintain a record of the request |
| Website requests and essential storage, such as relevant connection/security information | Deliver and protect the website, remember choices and operate requested services |
We do not need your date of birth, government identification or learners' medical information for ordinary teacher account registration. Do not submit unnecessary sensitive information in lesson names, support messages or backup filenames.
We process information when necessary to provide an agreed service, comply with legal obligations, protect legitimate service/security interests where lawful, or with your specific permission when required. Optional Drive connections, optional tracking and marketing have separate controls. A contract with a teacher does not automatically authorize processing sensitive learner information or replace a required parent, school or data-subject authorization.
The release's verified purpose and lawful-basis details are available at https://esl-teaching-studio.pages.dev/providers/ or from our privacy contact. We do not use this notice to obtain blanket consent.
3. Local lessons and cross-device use
Lessons are edited in a local workspace. Creating an app account does not itself upload the entire workspace or every file on your computer. Supported account preferences may be stored with the account service. Imported files remain local unless you choose an upload, backup, support attachment or export that includes them.
On another device, sign-in provides account access; lesson restoration also requires the relevant backup and connected storage permissions. Built-in resources may be represented by resource identifiers and pack versions. A lesson restored without external media may show missing-resource indicators. A manual export creates a separate copy under your control.
4. Optional Google Drive backup
When you choose Connect Google Drive, Google asks you to authorize the app. App sign-in and Drive authorization are different. The backup feature requests access appropriate for app-created or otherwise authorized files, using the drive.file scope for the described implementation. It creates or uses the ESL Teaching Studio Backups folder and accesses backup archives, associated metadata and the files you authorize for that feature. It does not request general access to every unrelated Drive file.
Backups may contain lesson content, selected settings and imported media if you opt to include it. Learner records require a separate supported choice and default to excluded. Backups run while the app is open and online unless a separately described background feature is enabled. Drive storage availability, permissions and operational limits affect completion.
Google account identifiers, folder/file identifiers and connection credentials are used to maintain the connection and perform backup/restore. Local credentials are protected using the supported operating-system credential mechanisms; any additional server-side token or file handling must be disclosed in the verified processing details before release. Lessons selected for direct-to-Drive backup are transferred to your Google account rather than copied to our lesson-hosting service as part of this design.
We do not sell Google user data, use it for advertising, or use it to train general-purpose AI models. Human access is limited to circumstances permitted by applicable Google policies, such as specific user-authorized support, security or legal requirements. The app's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements where applicable.
You can disconnect Drive in the app and revoke access in your Google Account. Disconnection stops future authorized operations and removes the stored connection credentials according to the implementation; it does not automatically erase previous backups in Drive. Delete those files through the app's supported explicit deletion action or Drive. A previously exported or downloaded copy is a separate copy. Account deletion, subscription cancellation and deleting Drive files are separate requests.
5. Providers and disclosures
We use the following providers for the functions identified, subject to the actual release configuration:
- Supabase: account authentication, supported preferences and backend records; project region European Union (Paris, France).
- Lemon Squeezy: checkout, subscription billing and related transaction services as merchant of record for purchases processed through it. Its own buyer terms and privacy notice apply to its processing. We receive relevant order/subscription information; full card details are handled by the payment service rather than stored by us as part of this design.
- Google: optional sign-in and teacher-authorized Drive storage. Google also processes information under its own terms and privacy notice.
- Website, email and operational providers: Google (Gmail) sends account e-mails and carries support and privacy correspondence; GitHub hosts app downloads and update checks; Cloudflare hosts this policy website.
The current provider and processing-location list is https://esl-teaching-studio.pages.dev/providers/. We disclose information to service providers as needed for their functions, to authorities or other parties when legally required, to address security incidents and protect rights where lawful, or in a business transfer with appropriate safeguards and notices. We do not sell personal information or share it for cross-context behavioral advertising under this release design. Adding such activities requires an updated assessment, notice and controls before deployment.
Information may be processed outside your country. Relevant locations and any required transfer safeguards are account and license records in the European Union (Paris, France, with Supabase); checkout and billing records with Lemon Squeezy, and e-mail with Google, which may process information in the United States and other countries under their own terms. We do not claim that selecting a project region guarantees every provider operation stays in that region.
6. Cookies and optional communications
Our Cookie Policy describes website cookies and similar storage, including the verified inventory. Essential technologies support requested functions. Optional technologies, if introduced, remain off until the applicable permission is given under our chosen consent design. Use Cookie settings to change browser choices. A native Windows preference or lesson file is distinct from a browser cookie; embedded browser features may have their own relevant storage.
Account, security, billing and requested support messages are operational communications. Marketing subscriptions, if offered, are optional and have a separate opt-in and unsubscribe control. Declining optional marketing or tracking does not cancel your paid account.
7. Retention and deletion
We use the following confirmed schedule, subject to justified legal holds and mandatory recordkeeping:
| Record | Retention or deletion rule |
|---|---|
| Active account and selected preferences | While needed for the account; after a verified deletion request, deleted or irreversibly anonymized within 30 calendar days, unless a shorter legal deadline or a specific lawful hold applies |
| Security and license event logs | up to 90 calendar days from each event |
| Support correspondence and submitted attachments | 12 months after the case is closed, including attachments; identity documents copied for verification are removed as soon as verification is complete |
| Our billing/tax records | five years under the applicable Philippine accounting-record rule, counted from the filing deadline for the year concerned, and longer only for an unresolved tax matter or other legal requirement; checkout provider records follow its applicable obligations |
| Our operational backup copies containing deleted account data | we do not currently keep our own backup copies of the server database; our database host keeps its own platform backups under its policies. If we enable our own backups, they will expire within 30 calendar days, and completed deletions will be applied again before any restored copy is used; copies remain access-restricted and are not returned to active use without reapplying deletion |
| Google authorization credentials | Until disconnection, revocation, expiration or account deletion, as applicable to the actual connection |
| Teacher-controlled local files, exports and Drive snapshots | Until the teacher deletes them or their own storage/organization policy removes them |
| Website choice record and other storage | As listed in the verified Cookie Policy inventory |
Deleting our account records does not erase copies on your other computers, exports, Google Drive or third-party backups. We will explain any information we must retain and why. Do not rely on a subscription cancellation as a data-deletion request.
8. Your choices and rights
Depending on applicable law, you may request information about processing, access or a copy, correction, objection or restriction, deletion/blocking, portability, or withdrawal of permission where processing depends on it. Some rights have conditions and lawful exceptions. Withdrawal does not retrospectively invalidate lawful earlier processing. You may complain to the Philippine National Privacy Commission or another competent authority; contacting us first does not remove that right.
Use https://esl-teaching-studio.pages.dev/privacy-requests/ or email infosyscoreteam@gmail.com. We verify identity proportionately and do not require sensitive documents routinely. We respond within the deadlines applicable to the request. If information is controlled by a teacher or school, we may direct the request to them and provide appropriate assistance rather than disclose another person's records. Contact the teacher/school for local or organization-controlled learner records.
9. Learners and security
Teacher accounts are intended for adults, not independent child sign-up. Teachers may show learning content to children and may enter learner records where authorized. Adult account eligibility does not mean the service can never process children's information. Teachers and schools must minimize data and obtain required permissions; we remain responsible for our own handling. Report an unauthorized learner record or child account to infosyscoreteam@gmail.com.
We apply access controls, limited permissions and other measures appropriate to the processing. Network and local-device protections reduce risk but do not guarantee perfect security. Portable ZIP backups are not inherently encrypted, and we do not describe this design as end-to-end encrypted. Protect your computer, account, exported files and connected Drive. We assess incidents and notify affected people and authorities when legally required.
10. Changes
We publish the effective date and version above. Material changes receive suitable notice; new uses requiring permission are not enabled merely by editing this notice. Prior versions are available at https://esl-teaching-studio.pages.dev/policy-archive/.