Privacy Policy

1. Who we are

Testera is run by Aqta Technologies Limited, a company registered in Ireland (CRO 807530), 20 Harcourt Street, Dublin 2, D02 H364, Ireland. We decide how the personal data described here is used, and we are responsible for it.

2. What we collect

• Account: your email address, your name if you give it, how you signed in (an email code or link, or Google), your age range and, if you are 13 to 17, your confirmation that a parent or guardian agrees.
• Learning: your practice answers, scores, time spent, study goals, saved words and flashcards, Language Lab review results (the level and the criteria behind it), essays you submit for scoring, star ratings, and feedback you write (with your email address and browser type).
• Conversations with Tera: your messages, and any image you send, are processed to write Tera’s reply. We do not store a history of these conversations.
• Language Lab: the spoken conversation takes place with ElevenLabs, which receives your voice and produces the transcript. We fetch the transcript to write your corrections and level estimate, and we do not store it. We keep the words you save and the review result.
• IELTS speaking practice: your browser turns your speech into text (in Chrome this uses Google’s speech service; in Safari, Apple’s). If it returns nothing, we send that recording to Google Gemini to transcribe it, and do not keep the recording.
• Snap: a photo you send is passed to Google Gemini to write a practice question and is not stored by us.
• Invite a friend: who invited whom, and whether the invitation earned a reward. Your invite link contains your Testera account number, so anyone you share it with can see that number.
• Payments: Revolut handles your card. We keep a record of each order (amount, currency, date and Revolut’s order reference).
• Technical: IP address, browser and device type, and server logs.
• Guests: if you use Testera without an account, your Language Lab cards, review results and speaking sessions are linked to a random number held by your browser (section 8), not to your name or email.

3. Why we use it

• To provide Testera, on the free plan and on Pro, because you asked us to (our agreement with you).
• To keep Testera secure, prevent abuse and share free use fairly (our legitimate interest in running a safe service).
• To keep payment records (our legal obligations under tax law).
• To send Testera news and optional study reminders (your consent, which you can withdraw at any time).
• To improve questions, using answers that are no longer linked to you (our legitimate interest in improving Testera).

We never sell your data and never use it for advertising.

4. Who processes it for us

• Google Cloud (Cloud Run and Cloud SQL, in Belgium): our servers and database. Google Cloud’s Vertex AI also runs the Gemini models that write most AI replies (section 5).
• Seal, Aqta’s own AI gateway (run by us, on Google Cloud in Belgium): see section 5.
• Anthropic (Claude): a backup when Gemini is unavailable.
• ElevenLabs: the Language Lab voice tutors, and the voices of Tera and the IELTS examiner. ElevenLabs holds the audio and transcript of each Language Lab conversation.
• Google Cloud Text-to-Speech: pronunciation audio in the Word Lab.
• Firebase Authentication (Google): email sign-in links and Google sign-in.
• Vercel (functions in Dublin): our website, and visitor counts (Vercel Web Analytics).
• Resend: sending emails.
• Revolut: card payments. Revolut receives the amount, a description and an order reference that contains your Testera account number. It does not receive your email address from us.

5. AI processing, Seal and where it happens

Text. Most AI requests (Tera’s replies, explanations, essay scoring, Language Lab reviews and the IELTS examiner) pass through Seal, Aqta’s own gateway, which applies our policies and signs a record of each decision. Seal then sends the request to Google Gemini on Vertex AI. Seal does not store your words; it keeps a one-way fingerprint of each request and technical details such as the model, the time and the cost. We do not add your name, email or account number to these requests, though anything you type yourself is sent as you wrote it. If Seal is unavailable, the request goes to Anthropic directly, and if that fails, to Google Gemini directly.

Images and recordings. Images you send to Tera or Snap, and IELTS recordings that need transcribing, go straight to Google Gemini on Vertex AI, not through Seal.

Account actions. When you pay for Patron, when our staff grant Pro by hand, and when you delete your account, Seal checks and records the decision. The record refers to you by a one-way fingerprint of your account number, never your email address or the account number itself. These signed records are kept, and a one-way fingerprint of each one is added to Seal’s public transparency log, which cannot be edited. Neither the log nor the record contains your name, email or the content of what you wrote. How this interacts with deletion requests is under review.

Where it happens. Our servers, database and Seal are in Belgium, and our website functions run in Dublin. Google runs Gemini at its global endpoint, so a request may be processed outside the European Economic Area. Anthropic processes backup requests in the United States. ElevenLabs, Resend and Vercel’s global network may also process data outside the European Economic Area. We are reviewing the safeguards for each of these transfers and will set them out here; ask us at legal@aqta.ai for the current position.

Training. Under the business terms of Google Cloud’s Vertex AI and Anthropic’s API, our requests are not used to train their models.

6. How long we keep things

• Your account and learning data: while your account is open. When you delete your account, we delete it straight away, with the exceptions below.
• Kept after you delete your account: payment records; your Testera news sign-up, which is separate (section 10); a waitlist sign-up, if you made one; records of payment notifications from Revolut; topic suggestions you sent; and daily usage counts used to share free use fairly.
• Your sign-in record at Firebase Authentication is removed when you delete your account.
• Payment records: kept for as long as Irish tax law requires. There is no automatic deletion yet; the period is under review.
• Guest data linked to a browser: no expiry is set yet; this is under review. Clearing your browser’s site data breaks the link. Guest data linked only to a network address is deleted by a daily job from 14 November 2026.
• Language Lab audio and transcripts at ElevenLabs: kept under ElevenLabs’ settings for our account. We have not yet set a shorter period, and deleting your Testera account does not delete them at ElevenLabs. Both points are under review; ask us at legal@aqta.ai to have a conversation removed.
• Server logs: up to 30 days.
• Abuse prevention: short codes derived from network addresses (a shortened one-way hash of the IP address, which can be matched against a known address, so we treat it as personal data), used to count free use; and a note on an account when its allowance has been reduced.
• Seal records for Patron payments, staff grants and deletions: kept, as described in section 5.

7. Your rights

You can ask for a copy of your data, its correction or deletion, a copy in a portable format, a restriction of its use, or object to its use, and you can withdraw consent at any time.

• Signed-in learners can delete their account in Settings, and download their main learning data there. The download does not yet include every record (for example payment history, feedback and invitations); ask us for a complete copy.
• Write to legal@aqta.ai. We reply within one month.
• You can also complain to the Data Protection Commission at dataprotection.ie.

8. Cookies and browser storage

Testera sets one cookie, for guests only, and keeps everything else in your browser’s own storage:

• testera_guest (cookie, guests only, 180 days): a random number, signed by us, that links a guest’s Language Lab cards, review results and speaking sessions to this browser. It is sent only to our own servers and page scripts cannot read it.
• testera_device (browser storage): a random number used the same way, and to count a guest’s free conversations per device rather than per network.
• auth_token (browser storage, valid for 30 days): keeps you signed in. Firebase Authentication also keeps its own sign-in record in your browser’s storage, and while you sign in we briefly keep your email address, an invite link’s reference and your age answer in browser storage so the sign-in can finish.
• testera_cookie_consent (browser storage): your answer to the cookie notice.
• Preferences and drafts (browser storage): theme, voice and reading settings, score goals, essay and scratchpad drafts, focus timers, and guest progress in the Skills Lab and Word Lab. These stay on your device.
• Offline copies (service worker): pages, scripts, styles and images are kept for up to 24 hours, and fonts for up to a year, so Testera loads quickly. Answers from our servers, such as your profile, history and exports, are never kept in this cache.

Visitor counts. Vercel Web Analytics counts page visits only if you choose Accept on the cookie notice. It sets no cookie and stores nothing on your device. If you choose Decline, or have not chosen, it does not run. Everything else above is needed for Testera to work and is not affected by your choice.

We use no advertising or tracking cookies. Clearing your browser’s site data for testera.org removes everything listed above, including your choice, and the notice will ask again.

9. Children and young people

• Testera accounts are for learners aged 13 and over. Every account created since 16 July 2026 is asked for an age range straight after sign-in; we do not ask for a date of birth.
• If you tell us you are under 13, we delete the account at once.
• If you are 13 to 17, you confirm that a parent or guardian agrees to your use of Testera. We do not check that confirmation.
• Until such an account answers the age question, our servers refuse everything except answering it, viewing or downloading the account, and deleting it.
• Guests, who use Testera without an account, are not asked their age. That includes guests who use the voice features. This is under review.
• A parent or guardian can ask us to delete a young person’s account by writing to legal@aqta.ai.

10. Testera news by email

Testera news is optional and separate from your account. If you sign up, we keep your email address, where on the site you signed up, any topics you chose, which version of the sign-up wording you saw, and when you asked, confirmed and, if you do, unsubscribed, plus one-way hashes of the codes in your confirmation and unsubscribe links. We do not keep your name or your IP address with it.

• Basis: your consent (Article 6(1)(a) GDPR). We send nothing until you confirm, through the link in the confirmation email. A request that is not confirmed within 7 days stops working and is deleted.
• Withdrawing consent: every email has a one-click unsubscribe link, signed-in learners can switch Testera news off in Settings, and you can write to legal@aqta.ai. After you unsubscribe we keep your address marked as unsubscribed, so that we do not write to you again; ask us and we will delete it.
• Sending: these emails are sent through Resend, our email provider, which processes your address to deliver them.

11. Security

• Sign-in is passwordless (an email code or link, or Google); we do not store passwords.
• All connections to Testera use HTTPS.
• Access to our systems is limited to the people who run Testera.

12. Changes

We update this page when what we do changes, and change the date at the top when we do.