Privacy Policy
Last updated: 22 May 2026 · Applies to: IELTS Master (iOS app & web)
DLR Coaching ("we", "us", "our") operates the IELTS Master platform. This policy explains in full what data we collect, why, who we share it with, and what rights you have. We do not sell your personal data.
1. Data Collected & How It Is Collected
We collect the following categories of data, by the following means:
| Category | Specific Fields | How Collected |
|---|---|---|
| Account / Identity | Full name, email address, account role (student / admin) | Provided by you at registration or via social login |
| Practice Responses | Written essays (full text), transcribed spoken answers, daily question responses | You type or record them in-app; audio is uploaded then transcribed server-side |
| Test Metadata | Skill (Listening / Reading / Writing / Speaking), test type (Academic / General), task label, band score, AI-generated feedback, submission timestamp | Computed and stored automatically when you submit a practice test |
| Progress & Usage | Pages visited, tests taken, session timestamps, streak counts | Recorded automatically via in-app analytics on every page navigation |
| Payment & Billing | Subscription plan, payment status, Stripe customer/session IDs | Provided by you at checkout; card details handled exclusively by Stripe — we never see them |
| Device & Technical | Browser / OS type, viewport, IP address (ephemeral, used for rate-limiting only) | Collected automatically by our hosting infrastructure (Base44) |
| Consent Records | Whether AI consent was granted or revoked, timestamp, consent schema version | Stored in device localStorage when you act on the AI consent modal |
| Audio (transient) | Raw audio recording of your spoken answer (WebM/MP3) | Captured by the device microphone with your explicit permission; uploaded for transcription then deleted from our servers |
2. Primary Uses of Your Data
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Deliver IELTS practice tests and track your progress | Account info, test responses, metadata | Contract performance |
| Generate AI-powered feedback and band scores | Practice response text, question prompt, task metadata (no name/email) | Explicit consent (AI consent modal) |
| Process subscription payments | Email, Stripe session/customer ID | Contract performance |
| Authenticate and maintain your session | Email, session token | Contract performance |
| Display your results dashboard | Band scores, feedback, metadata | Contract performance |
| Platform analytics & improvement | Anonymised, aggregated usage and score patterns | Legitimate interests |
| Security, fraud prevention, rate-limiting | IP address (ephemeral), session ID | Legitimate interests |
| Legal compliance and dispute resolution | Account and payment records | Legal obligation |
3. Third Parties We Share Data With & Equal Protections Required
We share data only where necessary to provide the service. We never sell your data. Every third-party processor is required by contract (a Data Processing Agreement or equivalent) to:
- Process data only on our documented instructions.
- Apply technical and organisational security measures equivalent to or exceeding our own.
- Not sub-process data without our prior written consent.
- Delete or return all personal data upon termination of the relationship.
- Notify us of any data breach within 72 hours.
- Not use the data for their own commercial purposes, including training AI models.
| Third Party | Category | Data Shared | Purpose | Location | Privacy Policy |
|---|---|---|---|---|---|
| Anthropic (Claude) | AI Processor | Practice response text, question prompt, task metadata only — no name, email, or device data | Generate IELTS band score estimates and detailed feedback | USA | anthropic.com/privacy |
| Base44 | Infrastructure / BaaS | All app data (acts as our cloud database, auth, and AI request router) | App hosting, database, authentication, AI request routing | USA / EU | base44.com/privacy |
| Stripe | Payment Processor | Email, billing address, subscription tier (card details processed by Stripe directly, never by us) | Subscription and one-time payment processing | USA / EU | stripe.com/privacy |
| Google Analytics (GA4) | Analytics | Page views, session data, anonymised device/browser type — no personal identifiers | Aggregate usage analytics to improve the product | USA | policies.google.com/privacy |
No cross-app tracking. We do not use Apple's App Tracking Transparency (ATT) framework. We do not track users across apps or websites owned by other companies, and we do not share any data with advertising networks or data brokers.
4. AI Processing & Consent
Consent-first: Before any practice response is sent to an AI provider, an explicit consent modal is shown. You must tap "I Agree" before submission proceeds. You may decline at any time — the feature will not function without consent, but all other app features remain available.
Exact fields sent (and not sent) to Anthropic:
| Field | Sent? | Notes |
|---|---|---|
| Practice response text (essay / transcription) | ✅ Yes | Core content required for grading |
| IELTS question / prompt | ✅ Yes | Provides grading context |
| Task label (e.g. Writing Task 2) | ✅ Yes | Determines scoring rubric applied |
| Test type (Academic / General) | ✅ Yes | Determines scoring rubric applied |
| Your name | ❌ No | Never included |
| Your email address | ❌ No | Never included |
| Device identifiers / IDFA | ❌ No | Never included |
| Location | ❌ No | Never collected |
| IP address | ❌ No | Request is proxied through Base44 |
| Audio file (raw) | ❌ No | Transcribed server-side; only text forwarded to AI |
Anthropic processes data under its API usage policy. API data is not used to train models by default. See anthropic.com/privacy for full details.
5. Manage Your AI Consent
You have not yet consented to AI data processing, or your consent was previously revoked. You will be prompted to consent the next time you submit a Writing, Speaking, or Daily Question response for AI grading.
7. Data Retention
| Data Category | Retention Period | Notes |
|---|---|---|
| Account (name, email, role) | Duration of account + 30 days after deletion | Deleted within 30 days of account deletion request |
| Test attempts & AI feedback | 5 years from last login | Deleted immediately on account deletion; aggregated anonymised stats may persist |
| Audio recordings | Deleted immediately after transcription | Not stored beyond the transcription step |
| Payment / billing records | 7 years | PCI DSS and financial regulation requirement; held by Stripe |
| AI consent records | Stored locally only (localStorage) | Deleted when you revoke consent or clear app data; not held on our servers |
| Analytics (GA4) | 14 months rolling window | Google Analytics default; no personal identifiers stored |
| Session tokens / logs | 90 days | Infrastructure security logs; not linked to test content |
8. Security
- All data in transit is encrypted via TLS 1.2+.
- Database access is restricted by role-level security rules (users can only access their own records).
- Payment card data is never stored on our servers — all card handling is delegated to Stripe (PCI DSS Level 1 certified).
- Audio files are stored transiently in a private, non-public storage bucket and deleted immediately after transcription.
- Admin-only endpoints are protected by server-side role verification.
- No method of electronic storage or transmission is 100% secure. We will notify you promptly in the event of a breach affecting your personal data.
9. Your Rights & GDPR
We comply with the General Data Protection Regulation (GDPR) and UK Data Protection Act 2018. You have the following rights:
| Right | What It Means | How to Exercise |
|---|---|---|
| Access | Receive a copy of all personal data we hold about you | Email privacy@ieltsmasterflow.com |
| Rectification | Correct inaccurate or incomplete data | Email us or update in-app |
| Erasure | Delete your account and all associated personal data | In-app: Menu → Delete Account, or email us |
| Data Portability | Receive your data in CSV/JSON format | Email privacy@ieltsmasterflow.com |
| Withdraw AI Consent | Stop your practice responses being sent to AI providers | Section 5 above — instant revocation |
| Object / Restrict | Object to processing based on legitimate interests | Email privacy@ieltsmasterflow.com |
| Lodge a Complaint | File a complaint with the ICO (UK) or your local DPA | ico.org.uk or your national DPA |
All requests are responded to within 30 days. Include "Data Subject Request" in your subject line.
10. Children's Privacy
IELTS Master is designed for adults preparing for the IELTS examination (typically age 16+). We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us immediately and we will delete it.
11. Policy Changes
We may update this Privacy Policy to reflect changes in our practices or applicable law. Material changes will be communicated by updating the "Last updated" date at the top and, where appropriate, via in-app notification. Continued use of the app after changes constitutes acceptance of the updated policy.
12. Contact Us
DLR Coaching
Privacy enquiries: privacy@ieltsmasterflow.com
General enquiries: info@dlrcoaching.com
Please include "Privacy Policy" or "Data Subject Request" in the subject line for fastest routing.
App Store Connect — Review Notes Reference
This section is provided for App Store reviewers and to assist with completing App Store Connect privacy disclosures. It is not a legal document.
View Full App Store Review Notes →A. Summary of Privacy-Relevant Changes in This Build
- ATT (App Tracking Transparency): Not implemented and not required. This app does not track users across third-party apps or websites. No IDFA or equivalent identifier is collected. The ATT prompt does not appear.
- In-App Purchases / Subscriptions: Subscriptions (Pro Plan, Elite Plan) are purchased exclusively via the web platform (Stripe). On iOS, the Pricing page displays an informational banner directing users to ieltsmasterflow.com to manage their subscription. No StoreKit / IAP is implemented in this build.
- Microphone Permission: The Speaking module and Daily Question feature use the device microphone for spoken practice. The
NSMicrophoneUsageDescriptionin Info.plist reads: "IELTS Master uses the microphone to record your spoken practice answers for AI-powered feedback." The permission prompt appears when the user first taps the record button in Speaking or Daily Question. - AI Consent Screen: A custom, in-app consent modal gates all AI-dependent features (Writing grading, Speaking grading, Daily Question feedback). Users must explicitly tap "I Agree" before any practice response text is transmitted to Anthropic. Consent is stored in localStorage and can be revoked at any time via Privacy Policy → Section 5.
B. Navigation Steps for Key Review Flows
- AI Consent Screen: Log in → tap Writing in the nav → select any prompt (e.g. "Discuss both views") → type at least one sentence in the essay box → tap "Submit for Grading". The AI consent modal appears immediately if consent has not been previously granted.
- Speaking + Microphone Permission: Log in → tap Speaking → select Part 1 → tap "Start Recording" (microphone icon). iOS will show the microphone permission prompt on first use.
- Daily Question (Speaking via Home): Log in → the Home dashboard shows a "Daily Speaking Question" card → scroll down if needed → tap "Submit Answer" after typing a response. AI consent modal appears if not yet granted.
- Subscription / Pricing (iOS — no IAP): Log in → tap Pricing in the nav → a blue banner displays: "Subscriptions are managed on the web. Visit ieltsmasterflow.com to subscribe." No checkout button is displayed on iOS.
- Account Deletion: Log in → tap hamburger menu (mobile) → scroll to Account section → tap "Delete Account". A confirmation dialog appears before deletion.
C. Test / Demo Credentials
Demo Account (Free tier):
Email: reviewer@dlrcoaching.com
Password: IELTSReview2026!
(All features accessible; AI features require completing the in-app consent flow first)
D. App Store Connect — Data Collection Fields
| Data Type | Collected? | Use | Linked to User? | Used for Tracking? |
|---|---|---|---|---|
| Contact Info — Email | Yes | Account auth, communications | Yes | No |
| Contact Info — Name | Yes | Display in account | Yes | No |
| User Content — Written essays | Yes | AI grading (with consent) | Yes | No |
| User Content — Audio (transient) | Yes — deleted after transcription | Speech-to-text transcription only | No (deleted immediately) | No |
| Identifiers — User ID | Yes | App functionality | Yes | No |
| Usage Data — Product interaction | Yes | Analytics (anonymised) | No | No |
| Diagnostics — Crash data | Yes (via platform) | Stability improvements | No | No |
| Financial Info — Purchase history | Yes (via Stripe, web only) | Subscription management | Yes | No |
| Device ID / IDFA | No | — | — | — |
| Location | No | — | — | — |
| Contacts / Calendar | No | — | — | — |
| Health & Fitness | No | — | — | — |
| Browsing History | No | — | — | — |
E. Geographic Behaviour Differences
- Subscriptions: Available on the web platform globally. On iOS, the Pricing page shows an informational banner only — no payment flow is triggered inside the app.
- AI Features: Available in all regions where Anthropic's API is accessible. No geo-restrictions are applied by our platform.
- GDPR: Enhanced rights (access, portability, erasure) apply automatically to users in the EU/UK. Non-EU users have the same rights by our policy choice.
- No content, functionality, or data handling differs by country within the app itself.