Privacy that keeps your learning in your hands.

EnglishPal.ai is owned and operated by QLian I.O.T US LLC, a United States company. In this policy, “EnglishPal,” “we,” “us,” and “our” refer to QLian I.O.T US LLC and the EnglishPal.ai service.

This policy applies to the EnglishPal.ai website, the EnglishPal conversation and learning portal, related mobile or browser experiences, public certificate-verification pages, subscriptions, customer support, and business or education services that link to this policy (together, the “Services”).

This policy does not apply to independent third-party websites, app stores, payment services, or services that have their own privacy policies. When a third party processes data for its own purposes, its privacy notice also applies.

The information we collect depends on the features you use, whether you create an account, whether you speak or type, whether you purchase a plan, and whether an organization manages your access.

We may also receive information from fraud-prevention providers, payment networks, public sanctions or compliance sources, referral partners, and other sources when necessary to protect users, verify transactions, comply with law, or provide a feature you request.

Where we rely on legitimate interests, we consider the expected benefit, necessity, impact on users, and available safeguards. Where processing relies on consent, you may withdraw consent at any time without affecting processing that was lawful before withdrawal.

EnglishPal is designed to make it clear that you are interacting with an AI system. AI may generate conversation responses, role-play, corrections, translations, pronunciation guidance, vocabulary suggestions, summaries, estimated proficiency levels, and certificate-related assessment data.

• Inputs and outputs. Your typed messages, transcripts, relevant conversation context, selected learning level, and other necessary session data may be sent to contracted AI, speech-to-text, text-to-speech, cloud, safety, and infrastructure providers so the requested feature can work.
• Microphone and audio. We access the microphone only after you choose a voice feature and grant device permission. Depending on the feature, audio may be processed transiently or stored with a learning record. Stored learning audio is subject to the deletion controls described below.
• No biometric identification. EnglishPal uses speech to support transcription, pronunciation, fluency, and learning feedback. We do not use voice data to identify you across services, create a voiceprint for authentication, infer emotion for high-impact decisions, or perform biometric categorization.
• Educational estimates. AI-generated scores, CEFR-related estimates, corrections, and certificates are educational outputs. They may be incomplete or inaccurate and are not used by EnglishPal to make decisions that produce legal or similarly significant effects about employment, credit, housing, insurance, healthcare, or government services.
• Human review. Authorized personnel may review limited content when necessary to investigate a support request, security incident, abuse report, legal issue, or quality problem, subject to access controls and confidentiality obligations.
• Model training safeguards. We do not intentionally submit account-linked learning content to public, third-party model-training programs. Where available, we use API, enterprise, contractual, or technical settings intended to prevent service providers from using customer content to train their general-purpose models. We may use aggregated, de-identified, or separately consented information to improve EnglishPal.

EnglishPal uses authorized third-party payment providers and other checkout channels. The provider presented to you may vary by country, currency, product, device, or sales channel. Payment method details are normally entered directly into the provider’s secure checkout environment rather than stored by EnglishPal.

EnglishPal uses payment and billing records to activate access, reconcile transactions, provide billing support, prevent fraud, manage refunds and disputes, and meet applicable tax, accounting, consumer-protection, and legal requirements. We generally do not receive complete card numbers or card security codes.

• Service providers. Hosting, content delivery, authentication, AI models, speech processing, text-to-speech, email, customer support, analytics, security, fraud prevention, and other vendors that process data under contractual restrictions.
• Payment and commerce providers. Authorized third-party payment providers, app stores, banks, card networks, and related providers involved in payments, tax, invoices, refunds, chargebacks, fraud prevention, and transaction compliance.
• Organization administrators. A school, employer, coach, or other organization that provides or manages your account may receive the information described in Section 16.
• Professional advisers. Lawyers, accountants, auditors, insurers, and consultants where reasonably necessary and subject to professional or contractual duties.
• Authorities and legal process. Government, regulatory, judicial, law-enforcement, or other parties when required by law or reasonably necessary to protect rights, safety, users, the public, or the Services.
• Business transactions. A buyer, investor, lender, successor, or adviser in connection with a merger, financing, reorganization, sale of assets, insolvency, or similar transaction, subject to appropriate confidentiality and legal safeguards.
• At your direction. When you ask us to share information, publish a certificate, connect a service, export content, or otherwise authorize a disclosure.

When we create de-identified or aggregated information, we take reasonable measures to prevent it from being linked back to an individual and do not attempt to re-identify it except to test whether de-identification safeguards work.

EnglishPal and authorized providers may use cookies, local storage, software development kits, pixels, and similar technology. The categories used may include:

• Strictly necessary. Sign-in, account security, session continuity, fraud prevention, load balancing, language preferences, checkout, and core service operation.
• Preferences and functionality. Remembering settings, accessibility choices, learning preferences, and interface options.
• Analytics and performance. Understanding feature use, errors, page performance, and aggregated engagement so we can maintain and improve the Services.
• Advertising and conversion measurement, if enabled. Measuring campaign effectiveness or limiting repeated advertising. We do not use learning conversation content or voice recordings for advertising profiles.

Where law requires consent, non-essential cookies and similar technology should not be activated until you make a choice. You may withdraw or change a consent choice through the cookie controls made available on the relevant site or device. Browser settings can also block or delete cookies, although some features may stop working.

Some browsers also send a legacy “Do Not Track” signal. Because there is no universally adopted interpretation for that signal, our response may vary. We do honor legally binding universal opt-out mechanisms where required.

We keep personal data only for as long as reasonably necessary for the purposes described in this policy, including to provide the Services, honor your choices, protect security, resolve disputes, enforce agreements, and meet legal, tax, accounting, or regulatory duties. Typical retention criteria include:

Service providers may maintain their own legally required records and backup cycles. We require providers to retain personal data only as permitted by their contract and applicable law.

Deleting an account and cancelling a recurring subscription are related but distinct actions. The deletion flow or billing page will tell you whether an active subscription must be cancelled separately through EnglishPal, the relevant third-party payment provider, an app store, or another purchase channel. To avoid future charges, complete any required cancellation before or during account deletion.

If you cannot access the controls, contact us through the details in Section 18. We may verify your identity before acting on a request.

We use safeguards designed to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure. Depending on the system and risk, these measures may include encryption in transit, encryption or protected storage at rest, access controls, least-privilege permissions, authentication protections, logging, monitoring, backups, vendor review, confidentiality duties, secure development practices, and incident-response procedures.

No online service can guarantee absolute security. You can help by using a unique password, protecting access to your email and device, signing out on shared devices, and contacting us promptly if you suspect unauthorized access.

If a personal-data breach occurs, we will investigate and provide notices to affected individuals, customers, regulators, or other parties when required by applicable law.

QLian I.O.T US LLC is based in the United States, and EnglishPal uses service providers in multiple countries. Your information may therefore be transferred to, stored in, or accessed from countries whose privacy laws differ from those in your location.

Where required for transfers from the European Economic Area, United Kingdom, or Switzerland, we use an applicable lawful transfer mechanism, such as an adequacy decision, the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum, an approved certification framework, or another lawful safeguard. We may also rely on a permitted legal exception for a specific transfer.

We assess transfer risks and apply supplementary technical, contractual, or organizational measures where appropriate. You may contact us for more information about safeguards relevant to your data.

To exercise a right, use the account controls or contact us. Tell us the right you wish to exercise and the account email involved. We may ask for information reasonably necessary to verify identity and authority. An authorized agent may submit a request where permitted, but we may require proof of authorization and direct verification with the user.

We will respond within the time required by applicable law. We do not discriminate against users for exercising privacy rights. A request may be limited or denied where an exception applies, such as when information is needed for security, fraud prevention, legal compliance, a transaction, freedom of expression, research permitted by law, or legal claims. We will explain a denial where required.

The consumer Services are not directed to children under 13, and we do not knowingly collect personal information from a child under 13 without verifiable parental consent or another lawful basis. In countries where a higher minimum age applies to consent-based online services, a parent or guardian may need to authorize the account until the user reaches that age.

If we learn that personal information was collected from a child in a way that does not meet applicable requirements, we will take reasonable steps to delete or restrict the information. A parent or guardian who believes a child has provided information without appropriate permission should contact us.

Schools and other education customers must obtain any notices, permissions, consents, or agreements required for student accounts and must use the Services consistently with child-privacy, student-privacy, education, and safeguarding laws. We process organization-managed student data under the applicable agreement and instructions of the educational customer.

If a school, employer, coach, family-plan manager, reseller, or other organization provides or manages your account, its administrator may be able to create or remove seats, manage invitations, and access information connected with the organization’s program. Depending on configuration and the agreement, this may include:

• Name, email, user identifier, team, class, group, role, and seat or invitation status.
• Account activation, last activity, feature usage, completion, learning time, progress, estimated level, assessment, and certificate status.
• Support, security, policy, or billing information relevant to the organization’s account.
• Aggregated reports or individual records that the organization is authorized to receive.

The organization is responsible for its own privacy notices, lawful basis, instructions, user permissions, and use of information it receives. Direct questions about an organization’s decisions or use of your data to that organization. EnglishPal remains responsible for processing under our own purposes, including platform security, billing, legal compliance, and service operation as described in this policy.

We may update this policy to reflect changes in the Services, vendors, technology, law, or business operations. We will post the updated policy at this URL and revise the “Effective” or “Last Updated” date.

If a change materially affects your rights or how we use personal data, we will provide additional notice where required, such as an account message, email, banner, or consent request. We will obtain consent before applying a new use where applicable law requires it.

We encourage you to review this page periodically and save or print a copy for your records.

For efficient handling, include your account email, country or state of residence, the right or issue involved, and enough detail for us to understand the request. Do not send passwords, complete payment-card numbers, or unnecessary identity documents by ordinary email.