1. Introduction

Welcome to English, no kidding. Your privacy is critically important to us. This Privacy Policy outlines how English, no kidding ("we," "us," or "our") collects, uses, processes, and protects your information when you use our classroom apps, our websites, and related services (collectively, the "Services").

Your English, no kidding account is also your sign-in for the other apps in the No Kidding suite. This policy covers English, no kidding and Reading, no kidding (reading.englishnokidding.com); Writing, no kidding and Listening, no kidding publish their own privacy policies on their sites. What Reading processes on top of what is described here is set out in Section 3C.

We are committed to protecting the privacy of our users, especially students and educators, and handling their data transparently and securely in compliance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

This policy is information we owe you under Articles 13 and 14 GDPR, not a contract: you do not need to accept it, and the legal grounds we rely on are set out in Section 4.

2. Data Controller and Data Processor

Under the GDPR, it is important to understand the roles regarding your data:

• Data Controller: When an educational institution (e.g., a school, university, or a teacher in their professional capacity) uses our Services to manage the learning process for its students, the institution is the Data Controller. The institution determines the purposes and means of processing personal data.
• Data Processor: In this relationship, English, no kidding acts as the Data Processor. We process personal data on behalf of the Data Controller and in accordance with their instructions, this Privacy Policy, and our Data Processing Addendum (DPA).

If you are an individual user subscribing to our services for personal use, we will be the Data Controller for your personal data.

3. What Information We Collect and Why

We collect only the information necessary to provide and improve our Services.

A. Information You or Your Institution Provides to Us:

• Account Information: When you (or your institution) create an account, we collect information such as your name, email address and your role (e.g., teacher, student). Passwords are handled by Google Firebase Authentication and are never stored or seen by us. This is necessary to create and manage your account and provide you with access to the Services.
• User-Generated Content: As you use the Services, you may create content, such as activities and lessons you generate and your settings. When students join a live session with a code, we store the name they type and their answers so the teacher can run the session. We collect this information to deliver the core functionality of our apps.
• Payments: if you buy a plan or credits, Stripe collects your payment details directly. We receive your email address, what you bought and the payment status, never your card number.
• Communications: If you contact us for support or other inquiries, we will collect your name, email address, and the content of your message to respond to your request.

B. Information We Collect Automatically:

• Usage Data: We collect information about how you interact with our Services. This includes which applications you use, the features you engage with, time spent on activities, and performance data (e.g., scores on quizzes). This helps us understand usage patterns and improve the educational experience. We measure this with Google Analytics only if you accept analytics cookies in the cookie banner.
• Device and Technical Information: We collect technical information about the device you use to access our Services, such as IP address, device type, operating system and browser type. This is for security purposes and to ensure compatibility.
• Cookies and Similar Technologies: We use cookies to operate and administer our website, gather usage data, and improve your experience. For more detailed information, please see our separate Cookie Policy.

C. Reading, no kidding:

Reading, no kidding is the suite's reading app for teachers. It uses the same account as English, no kidding, and processes:

• Your suite profile: Reading reads your name and school from your English, no kidding profile to label your workspace, and publishes a few totals back to it (for example, how many reading texts, classes and live lessons you have).
• Teaching content: reading texts you write, generate or import, vocabulary lists, lessons, class plans, diary entries and to-dos. When you import a web page, we fetch the page at the address you give us to extract its text.
• Class lists: the names of students you add to a class.
• Live lessons: students join a live lesson with a code and a first name or nickname. They do not create an account or give an email address or password; their device gets an anonymous sign-in for that lesson. The name they type and the answers they give are stored with the lesson and shown to the teacher running it.
• AI features: text you submit to AI features (generating or re-levelling texts, glosses, questions and read-aloud audio) is sent to Google's Gemini API, and so are the words students type in the Word Storm game, to check them. Student names are never sent. Google processes this data as our sub-processor and does not use paid API traffic to train its models. AI-generated texts and audio are machine-made and may contain mistakes; review them before using them in class.
• Support messages: the subject and message you send through Reading's support form, and the page you sent it from. These are not linked to your account.

Reading's data is stored with Google Cloud (Firebase) and kept until you delete it. From your profile in Reading you can erase everything Reading holds for you — texts, classes, class lists, live lessons and students' answers — in one step; this does not affect your data in the other apps. To delete your account itself, write to support@englishnokidding.com. Glosses and audio are also cached by text so the same passage is not processed twice; those caches contain no personal data.

4. Legal Basis for Processing Your Data (GDPR)

We process your personal data based on the following legal grounds under GDPR:

Where we process data based on legitimate interest, we have carried out a balancing test to ensure that our interests do not override your fundamental rights and freedoms.

5. Data Sharing and Disclosure

We do not sell your personal data. We will only share your information in the following circumstances:

• With Your Institution (the Data Controller): We share student progress and usage data with their respective teachers and school administrators who have authorized access.
• Third-Party Service Providers: we use these providers, under their data processing terms, to run the Services:
  • Google Cloud / Firebase (Google Ireland Ltd) — hosting, database, sign-in.
  • Google Gemini API — generating activities and other AI features, from the text you submit.
  • Stripe Payments Europe, Ltd. — payments and invoicing.
  • Mailjet SAS (France) — sending account emails and the newsletter.
  • Google Analytics and Google Ads — usage and ad-campaign measurement, only if you accept analytics cookies. Google Ads may also use this data under Google's own privacy policy.
• For Legal Reasons: We may disclose your information if required to do so by law or in the good faith belief that such action is necessary to comply with a legal obligation, protect and defend our rights or property, or protect the personal safety of users or the public.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred. We will provide notice before your personal information is transferred and becomes subject to a different privacy policy.

6. Your Data Protection Rights Under GDPR

If you are in the European Economic Area (EEA), you have the following rights:

• The Right to Access: You have the right to request copies of your personal data.
• The Right to Rectification: You have the right to request that we correct any information you believe is inaccurate or complete information you believe is incomplete.
• The Right to Erasure (The "Right to be Forgotten"): You have the right to request that we erase your personal data, under certain conditions.
• The Right to Restrict Processing: You have the right to request that we restrict the processing of your personal data, under certain conditions.
• The Right to Object to Processing: You have the right to object to our processing of your personal data, under certain conditions.
• The Right to Data Portability: You have the right to request that we transfer the data that we have collected to another organization, or directly to you, under certain conditions.

Where we rely on your consent (analytics cookies), you can withdraw it at any time without affecting what was done before.

To exercise any of these rights, please contact us at support@englishnokidding.com. If you are a student or teacher at an educational institution, please direct your request to your institution (the Data Controller) first. We will assist them in responding to your request.

7. Data Security

We take the security of your data very seriously. We use a range of technical and organizational measures to protect your personal data from unauthorized access, use, or disclosure. These include data encryption, access controls, and secure software development practices.

8. International Data Transfers

Your information may be transferred to — and maintained on — computers located outside of your state, province, country, or other governmental jurisdiction where the data protection laws may differ. If we transfer personal data from the EEA to other countries, we will ensure that a similar degree of protection is afforded to it by using appropriate safeguards, primarily the European Commission's approved Standard Contractual Clauses (SCCs).

9. Children's Privacy

Protecting the privacy of young learners is especially important. Our Services are intended for use by educational institutions. The institution, as the Data Controller, is responsible for obtaining any necessary parental consent as required by law before allowing a child to use our Services. We do not knowingly collect personal information from children below the age of digital consent — 14 in Italy (Article 2-quinquies of the Italian Privacy Code), or the age set by the child's own country — without such consent. If we become aware that we have collected personal data from a child without verification of parental consent, we will take steps to remove that information from our servers.

In Reading, no kidding, students take part only through live lessons run by their teacher, using a first name or nickname and no account of their own (see Section 3C). We ask teachers not to use students' full names.

10. Data Retention

We will retain your personal data only for as long as is necessary for the purposes set out in this Privacy Policy, or as required by our contract with the Data Controller (your institution). We will retain and use your data to the extent necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. To have your account and its data deleted, write to support@englishnokidding.com.

11. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. For material changes, we will notify you either through the email address you have provided us, or by placing a prominent notice on our Service.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your data, please contact us.

Privacy contact:
Vito Schiuma
Email: support@englishnokidding.com

Company Address:
English, no kidding
Strada Giovinazzo-Terlizzi
70038 - Terlizzi (BA)

You also have the right to lodge a complaint with a supervisory authority. As we are based in Italy, our lead supervisory authority is the Garante per la protezione dei dati personali.