Privacy Policy — Lesson Elf

1. Who We Are

Lesson Elf is operated by Fiona Sloane (trading as Lesson Elf), a sole trader based in the United Kingdom. We are the data controller for personal data collected through this service.

Contact: [email protected]

2. What Data We Collect

Account data

When you register, we collect your email address and (optionally) your name. This is used to create and manage your account, send essential service communications, and process subscription payments.

Lesson generation inputs

When you generate a lesson, the inputs you provide are transmitted to our platform. This includes lesson topic, vocabulary words, CEFR level, age group, grammar focus, and any additional notes you enter. We retain a record of the number of lessons generated per account for usage limit enforcement and billing purposes. We do not store the full text of your lesson inputs or generated lessons on our servers by default.

Payment data

Payments are processed by Stripe. We do not store your card details. Stripe may collect and retain payment information in accordance with their own privacy policy. We receive limited billing data from Stripe (subscription status, last four digits of card, billing country) to manage your account.

Usage and technical data

We collect standard technical data through Cloudflare (our hosting and infrastructure provider), including IP addresses, browser type, pages visited, and request timestamps. This data is used for security, performance monitoring, and abuse prevention. It is not used for advertising or profiling.

Cookies

Lesson Elf uses only essential cookies required for the service to function (authentication session cookies). We do not use advertising cookies, tracking pixels, or third-party analytics cookies. No cookie consent banner is shown because we do not use non-essential cookies.

3. How We Use Your Data

To provide the service — processing lesson generation requests, managing your account and subscription, delivering audio and images
To manage payments — processing subscription fees through Stripe, issuing receipts, handling cancellations and refunds
To communicate with you — sending account confirmation, password reset, billing notifications, and (with your consent) product updates
To improve the service — analysing usage patterns and generation inputs (anonymised) to improve lesson quality and develop new features and content
To prevent abuse — detecting and preventing fraudulent activity, enforcing usage limits, and maintaining platform security

4. Legal Basis for Processing (UK GDPR)

Contract performance — processing necessary to deliver the service you have signed up for (account management, lesson generation, billing)
Legitimate interests — security monitoring, fraud prevention, service improvement using anonymised data
Consent — optional marketing communications (you can opt out at any time)
Legal obligation — retaining financial records as required by UK tax law (7 years)

5. Third-Party Data Processors

We use the following third-party services to operate Lesson Elf. Each acts as a data processor under our instruction, except where noted.

Processor	Purpose	Data transferred	Location
Anthropic (Claude API)	Generating lesson text content	Lesson inputs (topic, vocab, level, notes)	USA
ElevenLabs	Voice synthesis for dialogue audio	Dialogue text lines (no personal data)	USA
Cloudflare	Hosting, CDN, edge compute, image generation	All web traffic (IP, request data); image prompts	Global (EU/UK nodes available)
Stripe	Payment processing and subscription management	Email, billing details, subscription status	USA / EU
Supabase	User authentication and account data storage	Email, account ID, usage counts	EU

Transfers to the USA are made under appropriate safeguards (Standard Contractual Clauses or equivalent mechanisms recognised under UK GDPR).

6. Data Retention

Account data: Retained while your account is active and for up to 2 years after account deletion, unless a longer period is required for legal or financial compliance.
Financial records: Retained for 7 years as required by UK tax law.
Usage data: Retained for 12 months for billing and abuse prevention, then deleted or anonymised.
Technical logs: Retained by Cloudflare for up to 30 days.

7. Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

Right to access

Request a copy of the personal data we hold about you.

Right to rectification

Ask us to correct inaccurate or incomplete personal data.

Right to erasure

Request deletion of your personal data, subject to legal retention requirements.

Right to portability

Receive your data in a structured, machine-readable format.

Right to restrict processing

Ask us to pause processing of your data in certain circumstances.

Right to object

Object to processing based on legitimate interests or for direct marketing.

To exercise any of these rights, email [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

8. Children's Data

Lesson Elf accounts are for teachers only — you must be 18 or older to register. While lessons may be used with younger students, no personal data about students is collected by our platform. Students do not interact with Lesson Elf directly and do not need an account.

9. Security

We take reasonable technical and organisational measures to protect your personal data from unauthorised access, disclosure, or loss. These include encrypted connections (HTTPS), secure credential storage, and access controls. However, no internet service can guarantee absolute security.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes by email. The date at the top of this page shows when the policy was last updated.

11. Contact

For any privacy-related queries or to exercise your data rights, please contact: [email protected]