Privacy Policy

LPB Platform is operated by [LEGAL ENTITY NAME] (“PaavanAI”), a Canadian company. For individual accounts, PaavanAI is responsible for your personal information. If you use the Service through a training organisation, that organisation controls your membership data and results within its workspace, and PaavanAI processes that data to provide the Service to the organisation.

This policy is written to comply with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and, for users in India, the Digital Personal Data Protection Act, 2023 (DPDP Act).

• Account data: name, email address, hashed password (or Google sign-in identifiers), organisation membership and role.
• Test content you create: answers to reading/listening questions, written essays and letters, and — for speaking sections — recordings of your voice and their text transcripts.
• Results: scores, band estimates, AI-generated feedback, and progress history.
• Payment data: handled by Stripe. We store your plan and billing status, never full card numbers.
• Technical data: log and security data (IP address, timestamps) used for rate limiting and abuse prevention; essential session cookies only. We do not use advertising or cross-site tracking cookies.

We use your information to operate the Service: run practice tests, score them, show progress, notify you, and bill for paid plans. Two uses deserve plain-language emphasis:

• AI evaluation: your written responses and speaking transcripts are sent to Anthropic (a US AI provider) to generate scores and feedback. Your speaking recordings are sent to Deepgram (a US provider) to be converted to text. These providers process your content solely to provide these functions to us.
• Organisation visibility: if you belong to an organisation, its administrators and instructors can see your results, evaluations and progress within that organisation.

We do not sell personal information, and we do not use your responses to advertise to you.

The Service is hosted on Amazon Web Services and Vercel in the United States, and our service providers (below) also process data in the United States. This means your personal information is stored and processed outside Canada and outside India, and may be accessible to authorities under the laws of the United States. By using the Service you consent to these transfers. We use contractual protections with each provider.

Service providers: Amazon Web Services (hosting, storage), Vercel (application hosting), Anthropic (AI evaluation), Deepgram (speech-to-text), Stripe (payments), Resend (email delivery).

• Account and results data are kept while your account is active, so you and your organisation can track progress over time.
• When an organisation schedules deletion, its data is purged after a short grace period (during which deletion can be cancelled), with export files made available to the organisation first.
• You may request deletion of your individual account and associated personal information at any time (see Your Rights). Some records may be retained where the law requires (for example, billing records).

We protect personal information with safeguards appropriate to its sensitivity: encryption in transit (TLS), hashed credentials and API keys, role-based access control, organisation-scoped data isolation, rate limiting, and monitoring. No system is perfectly secure; if a breach creates a real risk of significant harm we will notify affected users and the relevant authorities as required by PIPEDA and the DPDP Act.

Everyone: you can access and correct your information, and request deletion, by contacting us or via your account.

Canada (PIPEDA): you may withdraw consent (subject to legal or contractual restrictions), request access to your personal information and challenge its accuracy, and complain to the Office of the Privacy Commissioner of Canada.

India (DPDP Act): you may access a summary of your personal data and processing activities, request correction and erasure, nominate an individual to exercise your rights, and raise a grievance with our contact below; if unresolved, you may complain to the Data Protection Board of India. Consent may be withdrawn at any time with effect for future processing.

If your data is managed by your organisation (results visible to its staff, membership records), we may direct your request to that organisation, which controls that data.

The Service is not directed to children under 16. Where a younger student is enrolled by an organisation, the organisation is responsible for obtaining verifiable parental or guardian consent as required by the law of the student’s jurisdiction (including the DPDP Act’s requirements for persons under 18 in India).

We will post updates to this policy here and, for material changes, notify you through the Service or by email.

Privacy questions, requests and grievances: privacy@paavanai.com. We aim to respond within 30 days.