Privacy Policy

1. The short version

• We collect what we need to run your account, grade your work and record your purchases.
• Your writing and speech are sent to AI and transcription providers so they can be evaluated.
• We do not keep your audio recordings. We keep the transcript and your results.
• We do not sell your personal information, and we do not use advertising or analytics cookies.
• We never receive your full card details. Payments are handled by Polar and its payment processor.
• You can ask us for a copy of your data, or ask us to correct or delete it.

2. Who we are and what this covers

BandApex (“BandApex”, “we”, “us”) provides AI scoring and rewrites for IELTS and TOEFL iBT writing and speaking practice. For the personal information described here, we are the data controller, meaning we decide why and how it is used.

This policy applies to our website and app. It does not apply to third-party sites we link to, or to the information Polar collects and controls when it sells you a pass, which is covered by Polar’s privacy policy. Our Terms of Service explain the rules for using BandApex.

3. Information we collect

Account information. Your name, email address, profile picture and a unique account identifier. You sign in with Google, which shares this basic profile with us. We never see your Google password.

Your study plan. If you tell us, the exam you are preparing for, the date of your test and the score you are aiming for. We use them to show your countdown and calendar, and you can change or remove them in your settings.

Your practice work. The essays and written responses you submit, your answers to sentence exercises, and the task each one belongs to, including any question you add yourself. We keep your score on each day’s Daily Vocab quiz, and the days you opened BandApex, which is how your streak is counted. Unsubmitted drafts stay in your browser and do not reach us.

Free paragraph checks. The paragraph you send to the free 2-minute check, which you can use without an account, is evaluated and then not stored. To cap free checks we keep a one-way code made from your IP address and the date, not the address itself, and delete it within two days.

Messages you send us. When you use the contact form, we keep your name, the email address you give for a reply, the topic and your message, and your account identifier if you were signed in. We use them only to answer you.

Official results you share. If you choose to add a real exam result, we keep the exam, test date, scores and any comment you write, and whether you agreed that we may quote your first name, score and comment on our website.

Speaking recordings. When you take a speaking task, your browser records your answers after you give microphone permission, and uploads them to be transcribed. We use the recording only for that purpose and do not store it. We keep the text transcript.

Results we generate. Band scores, written justifications, rewrites, highlighted edits and, for speaking, measures such as duration, words per minute, pauses and filler words.

Purchase records. The pass you bought, the amount, its start and end dates, and Polar’s order identifier. Polar also tells us the email address used at checkout. We do not receive your full card number or security code.

Technical information. Your IP address, used briefly to limit abuse of free evaluations, and the routine request and error logs generated by our hosting infrastructure, which can include your IP address, browser type and the pages requested.

4. How we use information, and our legal bases

If you are in the European Economic Area or the United Kingdom, data protection law requires a legal basis for each use of your personal information. Ours are:

Where we rely on legitimate interests, you have the right to object. We do not send marketing email.

5. How AI is used on your work

When you request an evaluation, the task and your response are sent to one of our AI evaluation providers, which returns scores, explanations and rewrites. For speaking tasks, your audio is first sent to our speech-to-text provider to be transcribed. If you add a photo or screenshot to fill in a question of your own, the image is sent to one of our AI evaluation providers to read it, and we do not store it.

• We do not train any AI model on your work, and our AI evaluation providers’ terms do not allow them to train their models on the content we send them.
• We send each recording for transcription with the provider’s model-improvement program turned off. The provider states that data from such requests is retained only as long as needed to process them.
• Our AI evaluation providers state that they keep inputs and outputs for no more than 55 days, to run the service and detect misuse, with exceptions that include content flagged for violating their usage policies and legal requirements.

Scores are automated estimates produced for practice. They have no legal effect, and they do not determine your actual exam result or your access to anything other than the practice feedback itself. Please avoid including sensitive personal details in your practice answers.

6. Who we share information with

We share personal information only with the following, and only as needed for the purposes described:

We may also disclose information if the law requires it, to protect the rights or safety of people or the service, or to a successor as part of a merger, acquisition or sale of assets. In a sale, this policy would continue to apply unless you are given notice of a change.

We do not sell your personal information and do not share it for cross-context behavioral advertising.

7. Cookies and browser storage

We use only what the service needs to work, so there is no cookie banner to accept. Blocking these will stop parts of the site from working.

• Sign-in cookies keep you logged in and protect your session.
• A preference cookie remembers whether you are preparing for IELTS or TOEFL iBT, so the site shows that exam.
• A time zone cookie holds the name of your browser’s time zone once you are signed in, so the dates in your history are your own days.
• Browser local storage holds your unsubmitted draft, the time left on its clock and your place in a mock exam on your own device, so you don’t lose them. Each is cleared when its evaluation or mock exam finishes, and you can clear them through your browser at any time.

We do not use advertising cookies or third-party analytics. Polar’s checkout page and Google’s sign-in page are operated by those companies under their own cookie policies.

8. How long we keep information

• Account information, practice work and results: for as long as your account exists, so your history stays available, even after a pass ends. You can delete a single evaluation from your history, a question you added, with your evaluations of it, from your own questions page, or your whole account from your settings, at any time.
• Photos of questions: we do not store them. They pass through our servers only while being read.
• Purchase records: for as long as tax, accounting and other legal obligations require. This can continue after your account is closed.
• Audio recordings: we do not store them. They pass through our servers only while being sent for transcription.
• Abuse-prevention counters tied to IP addresses: held in memory for about an hour.
• Free paragraph check codes: deleted within two days. The paragraph itself is not stored.
• Official results you share: for as long as your account exists. Email us to remove a result or withdraw your permission to quote it, and we will stop showing it.
• Hosting logs: kept for the limited period set by our infrastructure providers.
• Information held by service providers: kept according to their own retention terms, as described above where they apply.

9. Deleting your account and data

You can delete your account yourself from your settings. To make sure the request is yours, we email you a link, which works for an hour, and the account is deleted when you open it and confirm. That deletes your practice work, results and account profile straight away, keeping only what we are legally required to retain, such as purchase records. The same page lets you download a copy of your data first. If you can’t sign in, email support@bandapex.com from the address on your account and we will do it for you.

Removing BandApex from the third-party access in your Google account stops it from signing you in, but does not by itself erase your practice history from our database, so delete your account first if you want that removed too.

10. Your privacy rights

Depending on where you live, you may have the right to:

• know what personal information we hold about you and get a copy of it;
• correct information that is inaccurate;
• have your information deleted;
• receive your information in a portable format;
• object to, or ask us to restrict, certain uses of your information;
• withdraw consent, where we rely on it, without affecting earlier use; and
• complain to your local data protection authority.

California residents and residents of other US states with similar laws have the rights to know, delete and correct their personal information, and not to be treated differently for exercising those rights. We do not sell personal information or share it for targeted advertising, so there is nothing to opt out of. An authorized agent may make a request on your behalf.

To make a request, email legal@bandapex.com. We may need to verify your identity, and we aim to respond within 30 days, or sooner if the law requires. Requests are free unless they are manifestly unfounded or excessive.

11. International transfers

Our service providers operate in several countries, including the United States, so your information may be processed outside the country where you live, under laws that may differ from your own. Where the law requires a safeguard for these transfers, we rely on recognized mechanisms made available by our providers, such as the European Commission’s standard contractual clauses.

12. Security

We protect information using encrypted connections, restricted access to production systems and credentials, ownership checks so that each report can be opened only by its owner, and signature checks on payment notifications. No online service can be guaranteed to be perfectly secure, so please use a strong, unique password. If a breach affects your personal information, we will notify you and the relevant authorities where the law requires.

13. Children

BandApex is not directed to children under 16, and they may not create an account. If you believe a child under 16 has given us personal information, contact legal@bandapex.com and we will delete it.

14. Changes to this policy

We may update this policy as the service or the law changes. We will revise the date at the top of this page and, for material changes, give reasonable notice through the service or by email before they take effect.

15. Contact us

For privacy questions or requests, email legal@bandapex.com.