Privacy Policy

April 28, 2026 (version 2026-04-28).

The platform is operated by tcftefprep, an exam-preparation service based in Ontario, Canada. Throughout this Policy, "we", "us", and "our" refer to tcftefprep.

For privacy questions or to exercise your rights under this Policy, contact us at support@tcftefprep.com or through our contact page.

This Policy applies to the TEF TCF Canada Practice website at tcftefprep.com, user accounts, paid plan and credit purchases, mock exams, writing tools, speaking practice, reports, reminders, and related services we operate.

By creating an account, completing checkout, or using the platform, you acknowledge that we may collect and use information as described here. If you do not agree, do not use the platform.

Depending on how you use the platform, we may collect:

• Account and profile data: email address, name, password hash, account creation and login timestamps, password-reset records, and email-verification status.
• Study and product data: exam type and target CLB, exam countdown date, mock-exam history, scores, CEFR/CLB estimates, streaks, longest streak, badge progress, daily-challenge attempts, leaderboard visibility flag, free-tier and paid-plan usage counters, lists of question IDs you have seen, AI-credit balance, and store-credit balance.
• Speaking and writing content: writing submissions you send to the AI feedback feature, transcripts of your spoken responses produced by our speech-to-text provider, AI-generated rubric scores and feedback, conversation turns from speaking practice, and messages you send through the contact form or referral feature.
• Purchase and plan data: selected plan or product, Stripe checkout session and payment-intent identifiers, amount and currency, applicable taxes, billing-address country, plan purchase and expiry dates, refund records, store-credit and referral ledger entries, and abandoned-checkout recovery email tracking.
• Email and communication preferences: reminder frequency, per-category opt-ins, hard-unsubscribe flag, unsubscribe tokens, welcome-series and milestone-email tracking, plan-expiration warning history, and exam-countdown settings.
• Technical and usage data: IP-derived request information, browser and device details, session activity, security and rate-limit logs, error reports, and product-analytics events.
• Anonymous free-trial tracking: a locally generated browser fingerprint and the related question-count usage we use to enforce anonymous-trial limits before signup.
• Browser-stored preferences: locale preference, exam preferences, dismissal state for in-product banners, local progress migration prompts, and other client-side convenience settings.
• Administrative records: when our staff take an action on your account (for example, a refund, a credit grant, or a referral payout), we retain an audit-log entry that includes the actor, the action, the IP and user-agent of the actor, and a before/after snapshot of the affected record.

Payment-card numbers and other full payment instruments are handled by Stripe and are not stored on our servers. We receive purchase metadata (amount, currency, tax, billing-address country, payment status, Stripe identifiers) from Stripe.

When you use a speaking-practice feature, your microphone records audio in your browser and the recording is sent to our servers and forwarded to a third-party speech-to-text provider for transcription. We do not retain the raw audio file after transcription completes.

We retain the resulting French-language transcript, the audio duration in seconds, the audio size in bytes, the rubric scores, and the AI feedback associated with the session. These records are linked to your account and are retained as part of your study history. If you do not want your spoken responses transcribed and analyzed in this way, do not use the speaking-practice features.

Voice transcripts and AI feedback are also used in aggregate, with identifiers removed, to evaluate and improve the quality of our grading rubrics and prompts.

We use the information we collect to:

• Create and secure user accounts, sessions, and authentication flows.
• Provide practice sessions, save history, generate score reports, and enforce free-tier or paid-plan limits.
• Process purchases, calculate taxes, verify payment completion, manage refunds and chargebacks, and operate the referral and store-credit ledgers.
• Generate automated AI feedback for writing and speaking, and improve the quality, safety, and reliability of those features.
• Send transactional, preference-based, and milestone emails — including welcome, reminder, expiration, achievement, weekly-report, exam-countdown, abandoned-checkout, and referral emails.
• Detect abuse, prevent fraud, rate-limit sensitive routes, investigate misuse, troubleshoot issues, and maintain platform security.
• Measure product performance and understand how people use the platform through analytics and operational monitoring.
• Operate referrals, streak rewards, badges, leaderboard visibility, and similar community-style features.
• Comply with legal obligations, respond to lawful requests, and enforce our Terms of Service, Acceptable Use Policy, and Refund Policy.

Our legal bases under the European General Data Protection Regulation (where applicable) include the performance of our contract with you, our legitimate interests in operating and securing the service, your consent for specific optional uses, and compliance with legal obligations. Under Canadian federal and provincial privacy law, we collect, use, and disclose information for the purposes identified in this Policy and for which you would reasonably expect us to use it.

The rubric scores, CLB and CEFR estimates, and feedback you receive on writing and speaking submissions are generated by automated systems using third-party large language models. The factors considered include the text of your submission or its transcript, the prompt or scenario context, and our internal grading rubrics. No human is in the loop for routine grading.

These outputs are study aids only. They are not official assessments, certified scores, predictions of how you will perform on an actual TEF or TCF exam, or guarantees of any educational, immigration, or employment outcome.

If you live in Quebec, or otherwise have rights under legislation governing automated decisions (including Quebec Law 25), you may request that a member of our team review a specific score or piece of AI feedback and provide you with the factors that contributed to it. Send your request to support@tcftefprep.com with the session identifier and a brief description of the decision you would like reviewed.

We use named AI service providers to operate our writing- and speaking-feedback features:

• Audio transcription is performed by Groq, Inc. (Whisper Large v3). The audio file is sent to Groq for transcription and is processed in-memory; we do not persist the raw audio file on our servers.
• Speaking grading and conversational practice replies are generated by Google LLC (Gemini 2.5 Flash). The transcript of your speech, the scenario context, and the conversation history are sent to Google for processing.
• Writing feedback is generated by Anthropic, PBC (Claude Haiku). The writing prompt, your written response, and any source material attached to the task are sent to Anthropic for processing.
• Each provider processes the data on our behalf under its own terms and applicable safeguards. We do not authorize these providers to use your inputs to train their general-purpose models, and we configure the integrations accordingly where the provider supports that setting.

For the avoidance of doubt: do not include sensitive personal information, government identifiers, payment-card numbers, or third-party confidential information in writing or speaking submissions. We have no practical way to remove such content once it is sent to an AI provider for processing.

We use cookies, browser local storage, session-storage entries, and similar technologies for the categories below. Our Cookie Policy lists each cookie or storage key in detail.

• Strictly necessary: authentication session, CSRF protection, locale preference, anonymous-trial fingerprint (used only to enforce free-tier limits before signup).
• Functional: dismissal state for in-product banners, exam-preferences cache, local progress prior to migration into your account.
• Analytics: PostHog product analytics, including a randomly generated, anonymized user identifier and event properties.
• Operational: error tracking, rate-limit and security logs handled by our hosting and infrastructure providers.

Our product-analytics provider is PostHog Inc. We do not use Google Analytics on this site. You can opt out of analytics tracking at any time through the controls described in the Cookie Policy and through your browser settings; some functional cookies are required for the platform to work and cannot be disabled while using a logged-in account.

We do not use the platform to deliver third-party advertising. If we materially change that, we will update this Policy and present a clear notice in-product before any new processing begins.

We share information with the third-party service providers we use to operate the platform. The current list is:

• Stripe Payments Canada Ltd. — payments, tax calculation, refunds.
• Anthropic, PBC — AI writing-feedback evaluation.
• Google LLC (Gemini API) — AI speaking-grading and conversational practice replies.
• Groq, Inc. — audio transcription.
• Resend, Inc. — transactional and reminder email delivery.
• PostHog Inc. — product analytics.
• MongoDB, Inc. (Atlas) — application database hosting.
• Vercel Inc. — application hosting and content delivery.

See the full Sub-processors page for the data each provider processes, the region in which it processes that data, and a link to its privacy policy.

We may also disclose information to authorities, courts, regulators, or professional advisers where disclosure is reasonably necessary to comply with law, respond to a valid legal request, enforce our Terms of Service, or protect the rights, property, or safety of users, the public, or tcftefprep.

If you opt in to the leaderboard, limited profile information becomes visible to other users. We display your name if you provide one; otherwise, we generate an anonymous label and we do not expose your email address.

In the event of a corporate transaction (merger, acquisition, sale of assets, reorganization, or bankruptcy), personal information may be transferred to the successor entity, subject to the protections in this Policy.

We send transactional and service-related emails such as account notices, purchase confirmations, refund confirmations, plan-expiration reminders, password resets, welcome messages, practice reminders, weekly reports, achievement emails, exam countdowns, and abandoned-checkout recovery emails. Some of these are required to operate the service; others are governed by your email preferences.

You can adjust per-category email preferences in your account settings or use the unsubscribe link in any non-essential email. The hard-unsubscribe link suppresses all non-essential email from our system. Account-related and billing emails are treated as essential and are not subject to marketing opt-out.

We retain different categories of data for different periods:

• Account, study history, scores, and AI feedback: retained while your account exists, and for a reasonable period afterward to support reactivation and to defend against fraud and chargebacks.
• Voice transcripts and rubric scores: retained as part of your study history, on the same schedule as other study data.
• Raw audio files: not persisted after transcription completes.
• Purchase and refund records: retained for at least seven (7) years to meet Canadian tax and accounting obligations.
• Administrative audit logs: retained for at least seven (7) years for fraud prevention and regulatory inquiries.
• Abandoned-checkout records: retained for up to ninety (90) days after the abandoned event for recovery messaging and analysis.
• Anonymous-trial fingerprints: retained only for as long as needed to enforce free-tier limits.
• Marketing-suppression records: retained indefinitely so that we continue to honor your unsubscribe choice.

Several of our service providers process information in the United States or in other jurisdictions outside of Canada. By using the platform, you understand that your personal information may be processed in those jurisdictions and may be subject to access requests from foreign authorities under applicable local law. We rely on contractual safeguards, including standard data-protection clauses where available, with each provider.

Subject to verification of your identity and to legal limits that may apply, you may exercise the following rights with respect to the personal information we hold about you:

• Access — request a copy of the personal information we hold about you.
• Correction — ask us to correct information that is inaccurate or out of date.
• Deletion — ask us to delete your account and the personal information associated with it, subject to records we are required or permitted to retain (for example, transaction records for tax and accounting purposes).
• Portability — request a structured export of the core account and study data we hold about you.
• Objection or restriction — object to specific processing or ask us to restrict it where applicable law allows.
• Withdrawal of consent — where we rely on your consent for a specific use, you may withdraw that consent at any time without affecting the lawfulness of prior processing.
• Complaint — lodge a complaint with the privacy authority in your jurisdiction.

Canadian residents (PIPEDA / provincial law). You may file a complaint with the Office of the Privacy Commissioner of Canada or with your provincial privacy authority if you believe we have not handled your information consistently with applicable law.

Quebec residents (Law 25). You may contact the person responsible for the protection of personal information at tcftefprep at support@tcftefprep.com. You also have the right to obtain a copy of personal information in a structured, commonly used technological format, to be informed of automated decisions that produce legal effects or significantly affect you, and to request that a member of our team review such a decision.

EEA, UK, and Swiss residents (GDPR / UK GDPR). In addition to the rights above, you have the right to object to or restrict certain processing, to withdraw consent at any time, and to lodge a complaint with your supervisory authority. Where we transfer personal information out of the EEA, the UK, or Switzerland, we rely on standard contractual clauses or other lawful transfer mechanisms.

California residents (CCPA / CPRA). You may request to know the categories and specific pieces of personal information we have collected about you, to delete personal information, to correct inaccurate information, and to opt out of any sale or sharing of personal information. We do not sell personal information, and we do not share personal information with third parties for cross-context behavioral advertising. You will not be discriminated against for exercising any of these rights.

We may need to verify your identity before acting on certain requests, and we may keep limited records where retention is necessary for legal compliance, fraud prevention, or payment documentation.

We use administrative, technical, and organizational safeguards intended to protect personal information. These include HTTPS in transit, authenticated account access, password hashing, role-based access controls for our staff, hardened webhook handling, and operational monitoring. No system is perfectly secure; we cannot guarantee absolute security and we encourage you to use a strong, unique password and to protect access to your devices and account credentials.

If we become aware of a security incident affecting your personal information that triggers notification obligations under applicable law, we will notify you and the competent authorities as required.

The platform is intended for users aged fourteen (14) and older. We do not knowingly collect personal information from children under fourteen. If you believe a child has provided us with personal information, contact us at support@tcftefprep.com so we can review and address the issue.

We may update this Privacy Policy from time to time. When we do, we will post the updated version on this page and revise the "Last Updated" date and version. For material changes, we will give reasonable advance notice through in-product messaging or email. Your continued use of the platform after the updated version becomes effective means you accept the revised Policy, except where applicable law requires us to obtain your renewed consent.

Privacy questions, requests, or complaints can be sent to support@tcftefprep.com or through our contact page.