Privacy
Privacy Policy
Written to be read, not to be scrolled past. If something here is unclear, that's a fault in the writing and we'd like to know, the contact page reaches us.
✓ Last updated July 26, 2026
Who Is Responsible for Your Data
TOEIC.ai is operated by Inverse AI, which is the data controller for everything described here. Requests and complaints go through the contact page; that's a real inbox read by the people who built the site.
What We Collect
Four things, and no more than that.
Your Account Email
Required, because a study plan and a score history have to belong to someone. It's also how we send you a password reset and, occasionally, a notice about the service. We don't ask for your full name, your phone number, your address, or your date of birth.
Your Practice Answers and Scores
Which questions you answered, what you chose, whether it was right, how long you took, which items you bookmarked, and the projected scores that come out of it. For Speaking & Writing this also includes the text you wrote and the audio you recorded, because there is nothing to mark otherwise. This is the substance of the product, without it there is no per-part breakdown and no adaptive plan.
Your Test Date and Target Score, If You Give Them
Optional. The study plan works backwards from a date, so it's much more useful with them than without. Skip both and everything else still works.
Basic Analytics
Which pages get visited, roughly where from at country level, which browser and device, and where people leave. We use this to find broken pages and to see which guides are worth expanding. We don't build advertising profiles and we don't try to identify you from it.
What We Don't Collect
No card details. Where a payment is taken it goes to Stripe directly, so card numbers never reach our servers; what we would hold is the plan, the billing period and the renewal amount. No camera access at all. Microphone access only while you are recording a Speaking answer, and only after your browser asks you — you can see the state of it in the permission bar. No contact list, no location beyond the country-level guess an IP address gives any web server, and no data bought in from third parties.
Why We Process It, and on What Legal Basis
GDPR applies to us and we treat it as the baseline rather than a regional exception. France is our single biggest market, and a large share of our users are in the EU, so compliance isn't optional and we haven't built the product as though it were.
| What | Why | Basis under GDPR |
|---|---|---|
| Account email | To create your account, log you in, reset your password, and send service notices | Performance of a contract |
| Answers and scores | To grade your work, build the study plan, and show progress over time | Performance of a contract |
| Test date, target score | To schedule the plan backwards from your date | Consent: you choose to supply them |
| Analytics | To keep the site working, fix broken pages, and see which content helps | Legitimate interests, and consent where required for non-essential cookies |
We don't use your data to train models sold to anyone else, and we don't make automated decisions about you that carry legal effects. Two things here are automated: the adaptive plan chooses what you practice next, and an AI examiner scores your Speaking & Writing answers. Neither produces an official result — the plan only changes which questions you are shown, and the band scores are practice feedback, not a score any employer or institution recognises.
We Do Not Sell Personal Data
Not to advertisers, not to data brokers, not to recruiters, not to language schools, not to anybody. Your email address will not be rented out and your score history will not be packaged up. If that ever changed it would require your explicit, separate consent, and we can't think of a version of this business that needs it.
Who Else Touches Your Data
We rely on a small number of processors to run the service. Each one only gets what it needs to do its job.
- Hosting and database. Where the application runs and where your account and answers are stored.
- Transactional email. Sends password resets and service notices. It sees your email address and the contents of those messages.
- Analytics. Receives page-level usage data as described above.
- Stripe. Handles payment where a subscription is taken. Card details go to Stripe directly and never pass through our servers; we hold only the plan, the billing period and the renewal amount.
- An AI model provider. Marks Speaking & Writing answers against the rubric. It receives the response you submitted and the task it answers, not your name or email.
Some of these providers operate outside the EU, in which case transfers rely on the European Commission's standard contractual clauses or an adequacy decision. If you want the current list of named providers, ask through the contact page and we'll tell you rather than making you guess.
Cookies
Two kinds. Essential cookies keep you logged in and hold your session together; the site can't function without them and they don't need consent. Analytics cookies do the counting described above, and where the law requires consent for them we ask for it and honour a refusal.
There are no advertising trackers on this site. No retargeting pixels, no ad-network scripts, no social-media tracking widgets. That's partly principle and partly the fact that we don't sell ads, so there's nothing to retarget you for.
How Long We Keep Things
Your account data and practice history stay for as long as your account exists, because the whole point of a score trend is that it's long. If you delete your account we remove your email and your practice history within 30 days, keeping only aggregate counts that can't be traced back to you, for instance how many people have attempted a given question, which is what tells us if an item is badly written.
Speaking recordings are the exception: they are deleted 7 days after you record them, whether or not your account is still open. The band scores and written feedback derived from them stay with your history; the audio does not.
Analytics data is retained in aggregate. Support emails are kept while a conversation is open and for a reasonable period afterwards so we have context if you write again, then deleted.
Your Rights
If you're in the EU or the UK these are legal rights, and we extend the same handling to everyone else because running two systems would be silly. You can ask us to:
- Access the personal data we hold about you, and be told what we do with it.
- Correct anything inaccurate, a wrong email address, for instance.
- Delete your account and your data. This is permanent; your score history goes with it.
- Export your data in a machine-readable file you can take elsewhere.
- Object to processing based on legitimate interests, or withdraw consent you've given, at any time.
- Restrict processing while a dispute about accuracy or lawfulness is being sorted out.
To use any of them, write to us through the contact page from the address on your account and say which right you're exercising. We'll respond within 30 days, usually much sooner. We won't charge you and we won't make you explain why.
If you think we've handled your data badly, you can complain to the data protection authority in your country, the CNIL in France, and the equivalent supervisory authority elsewhere in the EU. You don't have to come to us first, though we'd rather you did, because we can usually fix it faster than a regulator can.
Children
The service isn't intended for children under 13, and we don't knowingly create accounts for them. In the EU, users under 16 need a parent or guardian's consent. If you believe a child has an account, tell us and we'll remove it.
Security
Passwords are stored hashed, traffic is encrypted in transit, and access to production data is limited to the people who need it to keep the service running. We're not going to claim more than that. No service is unbreakable, and if a breach ever affected your data we would tell you and the relevant authority within the timeframes GDPR sets, rather than waiting to be found out.
Changes to This Policy
The "last updated" date at the top changes whenever this page does. For anything material, a new processor, a new category of data, a new purpose, we'll say so directly to account holders by email rather than quietly editing the page and hoping nobody notices.
One honest caveat. This policy describes what actually happens today. Where the product changes, this page changes with it rather than being left to drift — the Speaking & Writing track, the audio it records and the AI examiner that marks it were all added here when they shipped. If you find something on this page that no longer matches the product, tell us and we will fix it.
Related Pages
The terms of service cover the rules of using the site, including the subscription and cancellation mechanics, and pricing sets out the plans. Questions about either go to contact.