ARUORA / LEGAL
ARUORA IELTS — Privacy Notice
1. Who we are
Operator: [OPERATOR LEGAL ENTITY] ("ARUORA", "we"). Privacy requests: [PRIVACY@CONTACT] · Security: [SECURITY@CONTACT].
2. What we collect
| Category | Examples | Purpose |
|---|---|---|
| Account data | email, display name | authentication, recovery |
| Profile data (optional) | country, exam date, bio, avatar, goal/target band | product features, readiness estimate |
| Learning content | practice essays, speaking transcripts | AI-estimated feedback |
| Learning history | attempts, scores, cards, programs, lessons | progress, export |
| Voice recordings | speaking practice audio | transcription/scoring only — deleted after processing (max 30 min); never used for speaker identification |
| Security metadata | hashed IP, device string, audit events | fraud and abuse prevention |
| Product analytics | content-free events (names, counts, cohort tags) | improving the product — never raw essays, transcripts or audio |
We do not collect nationality, date of birth, gender or identity documents.
3. AI processing
Practice content is processed by third-party AI providers via the OpenRouter router to produce estimated feedback. Current sub-processors are listed in our vendor register; the active model routes are recorded per release. Speech-to-text runs locally on our server — no third party receives raw audio. Your content is not used to train models.
AI band scores are estimates and are not official IELTS results.
4. Retention
| Data | Retention |
|---|---|
| Account + learning data | until account deletion; then removed (de-identified financial/audit records excepted) |
| Raw audio | deleted immediately after transcription (max 30 min) |
| Security/audit metadata | bounded security retention |
| Analytics events | max 180 days |
| Expired sessions/tokens | purged within 72 h / 168 h of expiry |
5. Your rights
You may request access/export, correction, deletion and (where consent is the basis) withdrawal. In the app: Settings → Export, Settings → Delete account, or profile editing. You can also email [PRIVACY@CONTACT]; we verify identity in-app before sensitive operations.
6. Cookies
Strictly necessary only: an opaque session cookie and a CSRF cookie. No advertising or cross-site tracking.
7. International transfers
AI sub-processors may process content outside your country; regions and transfer bases are recorded per release. We apply the strictest available retention/training opt-outs at the router.
8. Security & breach contact
Encryption in transit, least-privilege database roles, ephemeral audio. Report suspected breaches to [SECURITY@CONTACT]. We are prepared to meet statutory notification timelines, including Indonesia PDP 3×24-hour written notification where applicable.
9. Children
This beta is adult-only (see Terms) and is not directed at minors.