Privacy Policy

1. Introduction

EnvolPrep ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our CELPIP test preparation service.

2. Information We Collect

We collect the following types of information:

• Account Information: Email address, name, and profile information you provide
• Test Responses: Your written essays, speaking recordings, reading answers, and listening responses
• Usage Data: Test completion statistics, performance metrics, and activity logs
• Public Activity Feed: Each test you submit adds a line to our public activity feed. Anyone can read the whole feed; the latest lines also show on our home page. A line shows your nickname, the section and part, and the time, so the feed shows the practice history of each nickname. Your scores and answers stay private unless you share a result. Without a nickname, your lines show no name. To keep your practice off your name, clear your nickname on your Account page: your past lines then show no name too.
• CELPIP news page: When a search there finds nothing, we keep the search words (never an email or a phone number) to learn what to write next, for up to a year after the last time anyone searched them. We also count clicks on each link per day. Neither record holds your name, account or IP address. Before we show the share image of a linked page, OpenAI's moderation service checks it. For links we collect automatically, the title and a short text from the linked page go to OpenAI, which writes the card's summary. This is public text from other sites, never anything about you.
• Technical Data: IP address, browser type, device information, and cookies
• Nickname and Public Posts: Your nickname, and the tips, stories, links and answers you post.
• Moderation Data: Reports you send or receive, our review decisions and their reasons, whether your account is limited or banned, and when you confirmed that you are 16 or older and accepted the community guidelines.

3. How We Use Your Information

We use your information to:

• Provide AI-powered feedback on your test responses
• Track your progress and display performance statistics
• Improve our service and develop new features
• Send important service updates and notifications
• Ensure platform security and prevent fraud

4. What Other People Can See

Some things are public, so anyone can see them, including search engines:

• Your nickname. It shows on your posts, on leaderboards and in the activity feed described in section 2. If you have no nickname, your activity shows no name, and you cannot post.
• Your approved posts, with your nickname and the date.

We never show your email, your real name or your account ID to other users. Choose a nickname that is not your real name.

A post that waits for review is not public. When we remove a post, or you delete your account, the post disappears from the site. To have one of your posts taken down, write to us (section 13). Copies that search engines or other sites already made are outside our control.

5. Data Sharing with Third Parties (OpenAI)

Important Notice: We share your test response data with OpenAI Inc. to provide AI-powered evaluation services:

• What We Share: Your written essays and the transcripts of your speaking answers are sent to OpenAI's language models for feedback. Your speaking recordings are sent to OpenAI's Whisper model to be turned into text.
• Purpose: To generate personalized feedback, scoring, and suggestions for improvement.
• Model Training: Our OpenAI account shares API inputs and outputs with OpenAI. This means OpenAI may use your answers, and the feedback it writes, to improve and train its models. In return, OpenAI gives us free daily usage, which keeps AI feedback mostly free for you.
• Data Retention: OpenAI's own policies decide how long it keeps this data. We do not control this. Please review OpenAI's Privacy Policy.
• Tip: Do not put personal details, like your full name, address or ID numbers, in your answers.

6. Payments (Stripe)

Paying is optional. If you choose to buy a paid option, the payment is handled by Stripe, Inc.:

• What We Share: Your email address and an internal account ID, so we can match the payment to your account.
• Card Details: You enter your card details on Stripe's own checkout page. They go straight to Stripe, and we never see or store them. We keep a record of each payment: the amount, the date, its status and Stripe's reference for it.
• Stripe's Policies: Stripe processes payment data under its own privacy policy. Please review Stripe's Privacy Policy.

7. Other Services We Use

These companies also handle some of your data so the site can work:

• Google sign-in: If you sign in with Google, Google tells us your email address and name. We do not get your Google password.
• Google Analytics: Records which pages are visited and basic facts about the device and browser, using cookies. We use it to see which pages help people.
• Google Ads: When you sign up or buy a paid option, we tell Google Ads that this happened (for a purchase, also the amount and currency), so we can measure whether our ads work. This uses cookies.
• Gmail: Our emails, such as your sign-in codes, are sent through Google's Gmail servers. Google sees your email address and the message.
• DigitalOcean: Hosts our servers and database. Files such as your speaking recordings are stored in DigitalOcean's Toronto data centre.
• Sentry: When something breaks on our servers, an error report goes to Sentry so we can fix it. A report holds the error and technical details of the request, such as the page address and your browser. It can include small parts of the data the code was handling when it failed. We do not send your IP address, and email addresses are removed before a report is sent.

8. Your Data Rights

You have the right to:

• Access your personal data stored in our system
• Request correction of inaccurate data
• Download a copy of your data yourself, on your Account page, as a JSON file. It holds your profile, results, AI feedback, usage, payments and community records. It has no voice recordings: we delete them once their review ends.
• Delete your account and its data yourself, on your Account page. We email you a code to confirm it is you. Section 10 says what is kept.
• Withdraw consent for data processing (note: this may limit service functionality)

9. Data Security

We implement appropriate technical and organizational security measures to protect your data, including:

• Encryption of data in transit (HTTPS/SSL)
• Secure database storage with access controls
• Regular security updates
• Session-based authentication with secure cookies

However, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security of your data.

If a breach of security puts your personal data at risk, we keep a record of it for at least 24 months, as Canadian privacy law (PIPEDA) requires. If the breach creates a real risk of significant harm to you, we tell you and the Privacy Commissioner of Canada as soon as we can.

10. Data Retention

We keep your data, including all your test responses, for as long as your account exists. You can delete your account and its data at any time on your Account page.

When we delete an account, its data is removed from our database and file storage straight away. Copies stay in our encrypted backups until those expire, about 6 months later at most. If we ever restore a backup, we delete those accounts again as part of the restore. To find them, we keep a one-way code made from the account's email address (never the address itself) and the time of the deletion, for about 7 months. Tax rules require us to keep the record of each payment (the amount, the date, its status and Stripe's reference), so it stays, no longer tied to your account. Stripe keeps its own record of the payment.

When you send a speaking answer, a copy of the recording stays in your browser until our server receives it, so it can be sent again if the page reloads. If you close the page before that, the copy stays in your browser until you next open EnvolPrep or sign out.

We keep moderation records (reports, our decisions and your guidelines confirmation) for as long as the account exists, so we can deal with repeated abuse. If we receive a copyright notice about your post, we keep the records that identify you for six months, or one year if a court case is started, as the Copyright Act requires.

11. Cookies

We use essential cookies to keep you signed in and to protect forms (session and CSRF cookies). We also use cookies from Google Analytics and Google Ads, described in section 7. You can block or delete cookies in your browser settings; the site still works without the Google ones.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify users of significant changes by email or through the platform. Continued use of the service after changes constitutes acceptance.

13. Contact Us

The founder of EnvolPrep is responsible for privacy. If you are not happy with our answer, you can complain to the Office of the Privacy Commissioner of Canada.

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us at: viktorbezai@gmail.com