Privacy Policy

Last Updated: April 2026

This Privacy Policy describes how EduConnect Asia Ltd ("we", "us", or "our") collects, uses, stores, and protects your personal data when you use our websites, applications, and services (collectively, the "Services"), including Last Minute Lessons and The DALF Dojo.

We are committed to protecting your privacy and handling your data transparently, in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Data Controller

The data controller responsible for your personal data is:

EduConnect Asia Ltd
71-75 Shelton Street, Covent Garden
London, WC2H 9JQ, United Kingdom
Email: [email protected]

2. What Data We Collect

We collect the following categories of personal data:

• Account Information: Email address, password hash (we never store plaintext passwords).
• Profile Data: Any information you voluntarily provide in your user profile.
• Usage Data: Topics you enter, exam attempts, error tracking data, generated content metadata.
• Payment Data: Billing information processed by Stripe. We do not store full card numbers.
• Technical Data: IP address, browser type, device information, and cookies (see Section 7).
• Communications: Any correspondence you send us.

3. How We Use Your Data

We use your personal data for the following lawful purposes:

• To provide the Services: Creating and managing your account, processing payments, generating and delivering content.
• To improve our Services: Analysing usage patterns to enhance features and user experience.
• To communicate with you: Sending service updates, security alerts, and responding to inquiries.
• For legal compliance: Fulfilling our obligations under applicable law.

Our legal basis for processing is contractual necessity (to provide the Services you request), legitimate interests (to improve and secure our Services), and legal obligation (where required by law).

4. How We Store & Protect Your Data

Your data is stored and processed using the following infrastructure:

• Cloudflare D1 — Our primary database, a serverless SQLite database distributed across Cloudflare's global edge network. Data is encrypted at rest and in transit.
• Cloudflare R2 — Object storage for generated files (presentations, audio, worksheets, images). Files are stored in your regional edge location.
• Stripe — Payment data is processed and stored by Stripe in accordance with PCI-DSS standards.
• OpenAI — User prompts and generated content are transmitted to OpenAI's API for processing. OpenAI does not use API-submitted data to train its models.

We implement industry-standard security measures including HTTPS/TLS encryption, secure password hashing (bcrypt), and access controls. However, no system is impenetrable, and we cannot guarantee absolute security.

5. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:

• Account data: Retained for the duration of your active account plus 12 months after closure, unless you request earlier deletion.
• Generated content: Retained for 24 months from creation to allow you to access your historical materials.
• Payment records: Retained for 7 years as required by UK tax law.
• Usage logs: Retained for 12 months for security and debugging purposes.

6. Data Sharing & Third Parties

We do not sell your personal data. We share data only with:

• Service providers: Cloudflare (hosting, database, storage), Stripe (payments), OpenAI (content generation), Resend (email delivery) — all bound by data processing agreements.
• Legal authorities: When required by law, court order, or to protect our rights and safety.
• Business transfers: In the event of a merger, acquisition, or asset sale, your data may be transferred to the successor entity.

7. Cookies & Analytics

We use essential cookies to maintain your session and authentication state. We do not currently use third-party analytics cookies (e.g., Google Analytics). If we add analytics in the future, we will update this Policy and obtain your consent where required.

8. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right to Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data, subject to legal retention requirements.
• Right to Restrict Processing: Request that we limit how we use your data.
• Right to Data Portability: Request your data in a structured, machine-readable format.
• Right to Object: Object to processing based on legitimate interests.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

9. International Data Transfers

Some of our service providers (including OpenAI and Stripe) may process data outside the UK. Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) or adequacy decisions, to protect your data in accordance with UK GDPR.

10. Children's Privacy

Our Services are not intended for children under 13. We do not knowingly collect data from children under 13. If you believe we have inadvertently collected such data, contact us immediately and we will delete it.

11. Data Breach Notification

In the unlikely event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours and inform affected users without undue delay.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or a prominent notice on our Services at least 30 days before they take effect.

13. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact:

EduConnect Asia Ltd
71-75 Shelton Street, Covent Garden
London, WC2H 9JQ, United Kingdom
Email: [email protected]