Privacy Policy

1. Who We Are

Lesson Studio is operated by LANALTX.

In this policy, "Lesson Studio", "we", "our" and "us" refer to LANALTX and the Lesson Studio service.

Contact details:

LANALTX

79 Ellados Avenue, Office 201

Pafos, 8020

Cyprus

VAT number: CY005503795H

Email: [email protected]

Website: www.lanaltx.com

2. What This Policy Covers

This policy covers personal data processed through:

• The Lesson Studio website and application.
• Teacher and organisation accounts.
• Independent adult learner accounts.
• The student portal.
• Lesson generation tools.
• Lesson libraries and records.
• Shared lesson links.
• Vocabulary, homework, quiz and progress features.
• Schedule and lesson-history features.
• Optional Google Calendar connection.
• Support, security and administration tools.

The general LANALTX Privacy Policy may also apply when you use the main LANALTX website, purchase a subscription or contact LANALTX outside Lesson Studio.

2A. Service Availability and Excluded Territories

Lesson Studio is currently offered for use by customers and adult learners outside the United States and Canada.

If we reasonably believe that an account, learner, organisation, transaction or use of Lesson Studio involves the United States or Canada, we may refuse, suspend, cancel or close access and delete or return personal data where appropriate.

If you are located in the United States or Canada, please do not create an account, accept an invitation, link a learner account, submit personal data or use Lesson Studio.

3. Strictly Adults Only

Lesson Studio is strictly limited to people aged 18 or over.

Teachers, tutors, organisations and other users must not:

• Create an account for anyone under 18.
• Create a learner profile for anyone under 18.
• Enter or upload information about anyone under 18.
• Invite anyone under 18 to the student portal.
• Use Lesson Studio to plan, record or manage lessons for anyone under 18.
• Use Lesson Studio shared links as part of teaching anyone under 18.

If we reasonably believe that information about a person under 18 has been entered, we may restrict the relevant account and delete or return the information where appropriate.

Other LANALTX teaching services may have different age rules. Those separate services do not change the strict 18+ rule for Lesson Studio.

4. Data-Protection Roles

LANALTX acts as a data controller for personal data used for its own purposes, including:

• Creating and administering Lesson Studio accounts.
• Managing subscriptions and payment status.
• Providing independent adult learner accounts.
• Providing support.
• Protecting the security of the Service.
• Preventing fraud and misuse.
• Maintaining legal, tax and accounting records.

Where a teacher or organisation decides what adult learner information to enter and why it should be used, that teacher or organisation will normally act as the data controller for that learner information.

In that situation, LANALTX processes the information on behalf of the teacher or organisation to provide Lesson Studio.

Additional processor terms are contained in the Lesson Studio Data Processing Addendum.

An adult learner may use Lesson Studio independently or choose to link their account to a teacher. The applicable role may depend on who entered the information and who decides how it is used.

5. Where Personal Data Comes From

We may receive personal data:

• Directly from a teacher, tutor, organisation or account administrator.
• Directly from an adult learner.
• From activity within Lesson Studio.
• From lesson source material uploaded or pasted by a user.
• From Google when a user chooses to connect Google Calendar or use Google sign-in.
• From payment providers when a subscription is purchased.
• From technical, security and diagnostic systems.
• From support messages and feedback.

Where a teacher enters information about an adult learner, the teacher or organisation is responsible for ensuring that the learner receives appropriate privacy information.

6. Account and Contact Information

Depending on the account type, we may process:

• Name.
• Email address.
• Login and authentication information.
• Account role.
• Organisation or business name.
• Profile settings.
• Subscription plan and account status.
• Preferences.
• Legal acceptance records.
• Adult eligibility confirmation.
• Support messages.

Passwords are handled through authentication systems and should not be visible to LANALTX in plain text.

7. Adult Learner Information

Teachers and organisations may enter information about adult learners such as:

• Name.
• Email address where supplied.
• Language level.
• Native language.
• Learning goals.
• Interests.
• Course or group information.
• Lesson history.
• Vocabulary records.
• Grammar and pronunciation notes.
• Homework.
• Teacher feedback.
• Progress notes.
• Scheduling information.

Teachers must keep learner information relevant, proportionate and connected to the teaching purpose.

8. Lesson and Content Data

Lesson Studio may process:

• Lesson titles and topics.
• Prompts and instructions.
• Uploaded or pasted source material.
• Website and video links.
• Transcripts.
• Generated slides and lesson documents.
• Teacher briefs.
• Student briefs.
• Quizzes and answers.
• Vocabulary activities.
• Homework.
• Feedback.
• Grammar and pronunciation content.
• Notes and lesson history.
• Generated images, diagrams or media references where enabled.

Content may contain personal data if a user includes it. Users should avoid including names or private information unless it is genuinely needed.

9. Activity and Progress Information

Depending on the features used, Lesson Studio may process:

• Lesson access and completion records.
• Quiz answers.
• Vocabulary review status.
• Homework status.
• Shared-link access information.
• Lesson feedback.
• Progress records.
• Student portal activity.
• Dates and times of relevant actions.

These records are used to provide teaching, review and progress features. They are not used to make legal or similarly significant decisions about a learner.

10. Technical and Security Information

We may process technical information needed to operate and protect Lesson Studio, including:

• IP address.
• Browser type.
• Device and operating-system information.
• Login and session information.
• Security events.
• Error and diagnostic logs.
• Page and feature usage records.
• Dates and times of requests.
• Account and access-control information.

This information may be used to maintain security, diagnose faults, prevent misuse and improve reliability.

11. Payment Information

Where a paid Lesson Studio plan is purchased, we may process:

• Subscription type.
• Payment status.
• Billing period.
• Transaction or invoice reference.
• Renewal and cancellation status.

Complete payment-card details are handled by the payment provider and are not normally stored directly by Lesson Studio.

Payment providers process payment information under their own privacy policies and terms.

12. Sensitive and Prohibited Information

Lesson Studio is not designed to store extensive sensitive personal information.

Users must not enter unnecessary:

• Medical or health records.
• Safeguarding disclosures or case notes.
• Counselling or therapy notes.
• Criminal-record information.
• Government identification documents or numbers.
• Complete payment-card or bank details.
• Passwords or security codes.
• Religious, political, sexual or similar sensitive information unrelated to language teaching.
• Employee disciplinary or formal human-resources records.
• Private information about unrelated third parties.

If sensitive information is genuinely necessary, the person or organisation entering it must have a valid legal basis and apply appropriate safeguards.

Lesson Studio may still be unsuitable for that information.

13. Why We Process Personal Data

Depending on the feature and context, personal data may be processed to:

• Create and manage accounts.
• Confirm that users and learners are adults.
• Provide teacher and adult learner features.
• Generate and store lesson materials.
• Personalise lessons for an adult learner or group.
• Provide student portal access.
• Create and manage shared lesson links.
• Store vocabulary, homework, feedback and progress records.
• Connect linked teacher and adult learner accounts.
• Import and organise lesson scheduling information.
• Provide optional Google Calendar features.
• Process subscriptions and payment status.
• Respond to support messages.
• Maintain security and access controls.
• Diagnose technical problems.
• Prevent fraud, misuse and unauthorised access.
• Improve the performance and usability of the Service.
• Meet tax, accounting and legal obligations.
• Establish, exercise or defend legal claims.

14. Legal Bases

Where LANALTX acts as controller, processing may rely on:

Contract

Processing that is necessary to create an account, provide requested Lesson Studio features, manage a subscription or supply the Service.

Legitimate interests

Processing that is reasonably necessary for security, fraud prevention, technical support, product administration, service improvement and protection of legal rights.

We consider the effect on users before relying on legitimate interests.

Legal obligation

Processing needed to comply with tax, accounting, court, regulatory or other legal requirements.

Consent

Processing based on consent where consent is required, such as certain optional communications or optional features.

Consent may be withdrawn at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.

Where a teacher or organisation acts as controller for learner information, that teacher or organisation is responsible for identifying and documenting the appropriate legal basis.

15. Artificial-Intelligence Processing

Lesson Studio uses artificial-intelligence services to generate or assist with:

• Lessons.
• Slides.
• Briefs.
• Exercises.
• Quizzes.
• Vocabulary.
• Homework.
• Corrections.
• Feedback.
• Summaries.
• Suggested learning activities.

When a user requests AI generation, information selected for that request may be sent to an AI service provider.

This may include:

• The user's prompt.
• Lesson goals.
• Source material.
• Selected adult learner context.
• Language level.
• Previous vocabulary or lesson information.
• The resulting AI output.

Users should avoid including unnecessary personal or sensitive information in AI prompts.

LANALTX does not use teacher or learner content to train its own general-purpose AI models.

Lesson Studio uses commercial AI services. The current primary commercial AI provider does not use commercial API inputs and outputs to train its models by default.

Authorised human access to content may occur only where reasonably necessary for support, security, abuse investigation, legal compliance or where the user has requested assistance.

AI-generated content may be inaccurate, incomplete, biased or unsuitable. Teachers and adult learners must review it before relying on or sharing it.

16. Google Calendar Integration

Google Calendar connection is optional.

If a user connects Google Calendar, Lesson Studio may access selected calendars on a read-only basis to import lesson-related scheduling information.

Depending on the information available in an event, this may include:

• Calendar identifiers.
• Event identifiers.
• Event titles.
• Event dates.
• Start and end times.
• Descriptions.
• Locations.
• Update timestamps.
• Attendee names and email addresses.
• The source calendar.
• Event links and status information.

Lesson Studio does not create, edit or delete events in Google Calendar through the read-only connection.

Google Calendar data is used to provide visible scheduling and lesson-organisation features requested by the user.

If a user deliberately creates a lesson from an imported event, selected event details may be included as context in the AI request used to generate that lesson.

OAuth access and refresh tokens may be stored securely so that the connection can continue.

A user may disconnect Google Calendar at any time. Disconnecting stops future access and synchronisation and removes or disables the stored connection token.

Calendar information already imported into Lesson Studio may remain until the user deletes the imported records, deletes the account or requests deletion.

Google user data is not sold or used for advertising.

Human access to Google user data is limited to situations where:

• The user has requested or agreed to specific support.
• Access is necessary to investigate security or abuse.
• Access is required by law.
• The data has been appropriately aggregated for lawful internal operations.

The use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

17. Linked Teacher and Adult Learner Accounts

An adult learner may choose to link their Lesson Studio account to a teacher.

Linking may allow authorised sharing of:

• Lesson summaries.
• Lesson materials.
• Vocabulary.
• Homework.
• Feedback.
• Reports.
• Progress information.
• Scheduling information.

Users should review the information displayed before accepting or using a link.

Unlinking accounts stops future linked access but does not necessarily delete records already lawfully held by the teacher, organisation or learner.

Deletion of teacher-controlled learner records and deletion of an independent learner account are separate actions.

18. Shared Links

Teachers may create links to student-facing lesson materials, reports or briefs.

A shared link may allow the person holding the link to view its contents without signing into a full account.

Teachers are responsible for:

• Checking the content before sharing it.
• Sharing it only with the intended adult recipient.
• Avoiding unnecessary personal information.
• Disabling or deleting links when they are no longer needed.

Recipients must not forward private links without permission.

Share links should not be used for highly sensitive or confidential information.

19. Service Providers and Recipients

We do not sell personal data.

We may use service providers to operate Lesson Studio.

Current provider categories include:

• Hosting and application infrastructure.
• Database and authentication services.
• Artificial-intelligence services.
• Google authentication and Calendar services.
• Payment processing.
• Email and support tools.
• Security and diagnostic services.

Current core providers may include Supabase, Railway, Anthropic and Google.

Payment providers may include Stripe, PayPal, Wix Payments or another provider displayed during purchase.

Providers may process information only for the relevant service purposes and under applicable contractual and data-protection requirements.

We may also disclose information:

• Where required by law or a competent authority.
• To investigate fraud, misuse or security incidents.
• To protect users, LANALTX or third parties.
• To establish, exercise or defend legal claims.
• During a merger, sale, restructuring or transfer of the business, subject to appropriate safeguards.

20. International Data Transfers

Some service providers may process personal data outside Cyprus or the European Economic Area.

Where required, international transfers are protected through recognised legal mechanisms such as:

• European Commission adequacy decisions.
• Standard Contractual Clauses.
• Contractual and technical safeguards.
• Another lawful transfer mechanism.

Users may contact LANALTX for further information about the safeguards relevant to a particular transfer.

21. Cookies and Browser Storage

Lesson Studio uses strictly necessary cookies and similar browser storage to:

• Keep users signed in.
• Maintain secure sessions.
• Apply account and access controls.
• Remember essential preferences.
• Support the operation of application features.

Lesson Studio does not currently use advertising cookies within the application.

Some features may use local storage or similar browser technology to remember interface settings or temporary workflow information.

The main LANALTX website may use separate cookie controls described in the LANALTX Cookie Policy.

22. Security

We use technical and organisational measures intended to protect personal data.

These may include:

• Account authentication.
• Role and ownership checks.
• Database access controls.
• Row-level security.
• Protected server routes.
• Secure session management.
• Encrypted connections.
• Restricted administrative access.
• Share-link tokens.
• Logging and monitoring.
• Backup and recovery processes.
• Deletion and export workflows.

No online system can guarantee absolute security.

Users are responsible for protecting their passwords, devices, accounts and shared links.

23. Data Retention

Personal data is kept only for as long as reasonably needed for the relevant purpose.

Retention is determined using factors such as:

• Whether the account remains active.
• Whether the information is needed to provide requested features.
• Whether the teacher or learner has deleted the information.
• Security and fraud-prevention requirements.
• Support and dispute requirements.
• Tax, accounting and legal obligations.
• Applicable limitation periods.

Account, learner and lesson data may remain while the relevant account is active unless deleted earlier.

Google authentication tokens are retained until the connection is disconnected, the account is deleted or the token is otherwise no longer needed.

Imported Google Calendar records remain until deleted through Lesson Studio, removed as part of account deletion or deleted following an appropriate request.

Shared links and associated materials remain until they are disabled, deleted or the underlying information is removed.

Security and diagnostic logs are retained for a limited period appropriate to their purpose.

Billing and transaction records may be retained for the period required by tax, accounting and legal rules.

Deleted information may remain temporarily in protected backups until those backups are overwritten or securely removed.

Anonymous or properly aggregated information that no longer identifies an individual may be retained for statistical and service-improvement purposes.

24. Deletion and Account Closure

Users may delete information using available account controls or contact LANALTX.

Deleting an independent adult learner account does not automatically require a teacher to delete separate lesson records for which the teacher is the controller.

Deleting a learner from a teacher workspace does not automatically delete the learner's independent account.

When an account is closed:

• Access may end.
• Shared links may stop working.
• Lesson and learner records may be deleted.
• Google Calendar access will be disconnected.
• Subscription-only features will become unavailable.

Some limited information may be retained where required for legal, tax, security, fraud-prevention or dispute purposes.

25. Your Data-Protection Rights

Depending on the circumstances and applicable law, individuals may have the right to:

• Be informed about how personal data is used.
• Request access to personal data.
• Request correction of inaccurate or incomplete information.
• Request deletion of personal data.
• Request restriction of processing.
• Object to processing based on legitimate interests.
• Receive certain information in a portable, machine-readable format.
• Withdraw consent where processing is based on consent.
• Complain to a data-protection authority.
• Request safeguards concerning qualifying automated decisions.

These rights are not absolute and may be subject to legal exceptions.

26. Exercising Your Rights

To exercise a right concerning account information for which LANALTX is the controller, contact:

[email protected]

We may need to confirm your identity before completing a request.

Where a request concerns learner information entered and controlled by a teacher or organisation, the learner should normally contact that teacher or organisation first.

LANALTX will assist the relevant controller where required.

If a learner contacts LANALTX directly, we may refer the request to the teacher or organisation responsible for that information.

Requests will be handled without undue delay and normally within the period required by applicable law.

27. Automated Decisions and Profiling

Lesson Studio uses automated tools to generate educational content and suggestions.

Lesson Studio does not use personal data to make decisions based solely on automated processing that produce legal or similarly significant effects on a teacher or learner.

Teachers remain responsible for educational decisions and for reviewing AI-generated suggestions.

28. Service and Marketing Communications

We may send necessary service communications such as:

• Account verification messages.
• Password-reset messages.
• Security alerts.
• Subscription and billing notices.
• Important product or legal updates.
• Responses to support requests.

These communications may be necessary to provide or protect the Service.

Marketing messages will be sent only where legally permitted.

Users may unsubscribe from marketing messages without losing necessary service communications.

29. Changes to This Policy

We may update this Privacy Policy to reflect changes in:

• Lesson Studio features.
• Law and regulatory guidance.
• Service providers.
• Security practices.
• Data-processing activities.

The updated version will show a revised date.

Where a change is material, we will take reasonable steps to notify affected account holders or display the change prominently.

Where new consent is legally required, it will be requested separately.

30. Complaints

Please contact LANALTX first if you have a privacy concern so that it can be investigated.

You also have the right to complain to a data-protection supervisory authority.

The supervisory authority in Cyprus is:

Office of the Commissioner for Personal Data Protection

You may also contact the supervisory authority in the country where you live or work, or where you believe a data-protection infringement occurred.

31. Contact

For privacy, data-access, correction, deletion or complaint requests, contact:

LANALTX

79 Ellados Avenue, Office 201

Pafos, 8020

Cyprus

VAT number: CY005503795H

Email: [email protected]

Website: www.lanaltx.com