Privacy
What we do with your work.
Amigo sees the essays you write, the answers you speak aloud and the conversations you have with Iris. That is unusually personal for a study tool, so this page says plainly what happens to it. No advertising, no third-party trackers, no analytics company, and nothing sold to anyone.
Who we are
Amigo at ielts.infercia.com is operated by INFERCIA INNOVATION & ARTIFICIAL INTELLIGENCE RESEARCH & CONSULTANCIES CO. L.L.C, a Limited Liability Company (Single Owner) registered with the Dubai Department of Economy and Tourism under commercial licence 1383440 (commercial register 2357508), Office 100, B Block, NGI Building, Port Saeed, Deira, Dubai, United Arab Emirates. We are the data controller for the personal data described here. Reach us at [email protected].
We are based in the United Arab Emirates and are subject to UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. Because we offer Amigo to people in the United Kingdom and the European Economic Area, UK GDPR and the EU GDPR also apply to what we do with your data, and the rights set out below are available to you wherever you are.
What we collect
Your account
Your name and email address. A hashed password if you signed up with one, or a Google account identifier if you used Google sign-in — we never see or store your Google password. Whether and when you confirmed your email, and the dates your free trial started and ends.
Your work, and what we infer from it
The essays you submit, the audio of your speaking answers, the transcripts made from that audio, your answers to reading and listening questions, and your conversations with Iris — including voice notes. From these we build a model of you as a learner: an estimated band with its margin, per-skill proficiency, recurring grammar patterns with examples taken from your own sentences, and reads on how you work (how you respond to difficulty, how you take feedback, session length that suits you). Your saved vocabulary, reading highlights and notes are stored as you left them.
Payment
Card details never reach our servers. Stripe processes payments and we store only the Stripe customer identifier, your plan, its status and the date it renews.
Technical and anti-abuse
Server logs containing request metadata. To stop one person taking unlimited free trials we store, against a trial signup: a normalised form of your email address, and salted SHA-256 hashes of your IP address and a browser identifier. We keep the hashes, not the underlying IP address or identifier, and the hashes are erased after 90 days. A match never blocks a signup — at most it shortens the free trial, and you can ask us to review that.
Usage analytics
On our public pages — the home page and the sign-up screen — we count visits so we can see what people read and where they give up. Nothing is stored on your device to do it. No cookie, no identifier, nothing for you to clear later.
Instead our own server works out a one-way fingerprint of the request, from a secret that is regenerated every 24 hours and never written down. The practical effect: if you visit today and again next week, the two visits cannot be connected to each other — not by us, and not by anyone who ever got hold of the database. Yesterday’s secret no longer exists, so yesterday’s visits can never be recomputed.
Your IP address is never stored. It goes into that one-way calculation and is discarded — it is not written to the analytics table, and not kept in any log we keep for this purpose. This is all self-hosted: no analytics company, no third-party script, and nothing about your visit sent to Google Analytics or any equivalent.
Once you have an account we stop counting you this way altogether. Everything we need to improve the product — which tasks get finished, where people get stuck — is already in your own records, so there is nothing to gain from also following your browser around.
Why we use it, and on what basis
- To provide the tutoring you asked for — marking your work, building the learner model, planning what comes next. Basis: performance of our contract with you.
- To run accounts and take payment — sign-in, email confirmation, subscriptions. Basis: performance of our contract.
- To keep the service working and stop abuse of the free trial — logs, rate limits, the hashed signals above. Basis: our legitimate interest in a service that stays available and is not given away without limit.
- To understand how the product is used and improve it — the anonymous visit counting described above, and aggregate reporting over accounts. Basis: our legitimate interest in knowing which parts of the product work. No consent is sought for it because nothing is stored on or read from your device.
- To meet legal duties — tax and accounting records for payments. Basis: legal obligation.
Who processes it for us
We use a small number of providers, each acting on our instructions under a contract. We do not sell personal data and we do not share it for advertising.
- Google (Gemini) — marks your work, powers Iris’s replies and generates her speech. Your essays, transcripts and messages are sent for processing.
- OpenAI — transcribes your speaking recordings and creates the embeddings used to pick fresh content. Your audio and unit text are sent for processing.
- Stripe — payments and the billing portal.
- Google Sign-In — only if you choose it, to confirm who you are.
- Our hosting provider — runs the servers and stores the database and your audio files.
Analytics is deliberately absent from that list: we run it ourselves, so there is no analytics processor to name.
We are based in the United Arab Emirates and most of these providers are based in the United States or the European Union, so your data is transferred internationally. Where UK or EU law governs a transfer, we rely on the UK International Data Transfer Addendum or the EU Standard Contractual Clauses; you can ask us for a copy of the safeguards in place.
How long we keep it
- Your account, work and learner model: while your account exists.
- Speaking recordings: stored on our servers with your submission, and deleted with it.
- Hashed IP and device signals: erased after 90 days.
- Payment records: as long as tax law requires, normally six years.
- If you delete your account, your work, learner model, conversations and recordings are deleted with it. Ask us at [email protected] and we will confirm when it is done.
Cookies
We use one cookie. amigo_session keeps you signed in. It is HTTP-only, cannot be read by scripts, and the app cannot know who you are without it — so it is strictly necessary, and the law does not require us to ask permission for it.
There are no others. No analytics cookie, no advertising pixel, no third-party tracker, and nothing on this site follows you to other websites. That is why you have never seen a cookie banner here: we have nothing optional to ask you about, and asking anyway — to train you into clicking “accept” — would be its own small dishonesty.
Your browser does keep your own preferences locally: theme, text density, Iris’s tone, whether you have seen the latest release note. Those are yours, they never leave your device, and clearing your browser data removes them.
Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, withdraw a consent you have given, or send it to another provider in a portable form. Ask at [email protected] and we will respond within one month.
If you are unhappy with how we have handled it, you can complain to your data protection regulator. In the UK that is the Information Commissioner’s Office at ico.org.uk; in the EEA it is your national supervisory authority; in the UAE it is the UAE Data Office. We would rather you told us first so we can put it right.
Automated decisions
Iris estimates your band and decides what to set you next automatically. These are study recommendations and practice estimates — they are not official IELTS results, they have no legal effect, and they do not decide anything about you outside this app. You can disagree with any of it in the chat panel, and you can ask a human to look at it.
Children
Amigo is not for children under 16. If you believe a child has given us personal data, tell us and we will delete it.
Changes
If we change this notice we will update the date at the top, and we will tell you in the app before any change that materially affects you.