Privacy Policy

AgileEnglish.tech ("we", "us", "our") is operated as a sole-trader business based in Cambridge, United Kingdom. This Privacy Policy explains what personal data we collect when you visit agileenglish.tech or submit an assessment or purchase coaching, how we use it, and the rights you have under the UK GDPR and the Data Protection Act 2018.

1. Who is the data controller?

The data controller is AgileEnglish.tech. You can contact us at john@agileenglish.tech for any privacy-related question or to exercise your rights.

2. What data we collect

• Coaching purchases: student name and email, agreed coaching description, session count, amount, payment status, transaction reference and sessions used. Payment card details are entered directly into Stripe's secure checkout; we do not receive or store your full card number or security code.
• Assessment form: first name, optional surname, email address, current role, communication challenges, tech stack, agile frequency, language-support preferences and your main learning objective.
• Technical data: a hashed (one-way) version of your IP address, used solely for rate-limiting form submissions and preventing abuse. The raw IP is never stored.
• Analytics: aggregated, pseudonymised usage data via Google Analytics 4 (pages viewed, country, device type). We do not collect personally identifying analytics data.

3. Why we use your data (lawful basis)

• To respond to your assessment — lawful basis: performance of a contract / steps taken at your request prior to entering a contract.
• To prevent abuse of the form — lawful basis: legitimate interests (protecting our service).
• To understand how the site is used — lawful basis: consent for optional analytics cookies, managed through the cookie banner.
• To arrange coaching, process orders and track sessions — lawful basis: performance of a contract or steps taken at your request before a contract.
• To retain necessary financial records — lawful basis: legal obligation.

4. Who we share data with

We do not sell your data. We share it with the following service providers and recipients where needed to operate the site and provide coaching:

• Supabase (managed database and backend hosting, EU region)
• Resend (transactional email delivery)
• Cloudflare / Lovable (site hosting and edge delivery)
• Google Analytics (anonymised usage statistics)
• Stripe Payments Europe, Ltd. (payment processing) receives your name, email, order details and payment information to process payments, send receipts, handle refunds and prevent fraud. Stripe acts as an independent data controller for some of this data. See Stripe's Privacy Policy.
• Professional advisers, such as accountants or legal advisers, when necessary.
• Authorities where disclosure is required by law.

5. How long we keep it

Assessment submissions are kept for as long as you are a prospective or active client, and for up to 24 months after our last interaction, after which they are deleted. Hashed IP rate-limit records are retained for a maximum of 24 hours.

Coaching and payment records are kept while needed to provide the service, resolve disputes and meet applicable accounting or tax record-keeping obligations. They are deleted or anonymised when no longer needed. Stripe retains its own records under its Privacy Policy.

6. Your rights

Under UK GDPR you have the right to access, rectify, erase, restrict or port your personal data, and to object to processing. To exercise any of these rights, email john@agileenglish.tech. You also have the right to withdraw consent at any time without affecting earlier lawful processing. We normally respond to rights requests within one month, subject to lawful extensions. You may also lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

7. International transfers

Some of our processors may transfer data outside the UK/EEA. Where this happens, transfers are protected by Standard Contractual Clauses or equivalent safeguards.

8. Security measures

We use appropriate technical and organisational safeguards, including HTTPS encryption in transit, restricted access to stored submissions and payment records, and server-side validation and abuse controls. Payment administration is protected by a passcode and private payment links use unguessable tokens. Do not share your payment link publicly. Card processing is handled by Stripe's secure checkout. No online service can guarantee absolute security; contact us if you suspect unauthorised use of your information.

9. Cookies

Essential storage supports site functionality and remembers your cookie preference. Optional analytics cookies are controlled by the accept or decline options in our cookie banner. We do not use advertising cookies. Checkout may use necessary payment and fraud prevention technologies. See our Cookie Policy and Stripe's Privacy Policy.

10. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top reflects the latest revision.