Privacy Policy

Lengify is a private learning platform for the students, families and staff of one language academy. It is not a public website, it is not advertising-supported, and there is nothing on it to sign up for. This page says plainly what is held, why, and for how long.

Who is responsible

The academy that enrolled you is the data controller. The platform is operated on its behalf by Wexels, acting as a data processor — meaning we run the software and follow the academy's instructions, and we do not use anybody's information for our own purposes.

What is held, and why

Accounts

• Name, and a way to sign in — an email address or a Student ID.
• An optional phone number, where the academy has one.
• A parent or guardian's name and email, where a student's results are sent to them.
• The role, level and group a person belongs to.

Many students have no email address at all, and that is a normal enrolment here rather than an omission. Where a student has none, their results go to a linked parent.

Work

• Answers submitted to tasks, the marks awarded, and any feedback a teacher writes.
• When a task was opened, handed in, and whether it ran past its timer or due date.
• Practice attempts in Extras are not recorded as results. The scratchpad holding an unfinished practice run is deleted after 30 days.

Messages

Conversations between staff, students and parents are stored so they can be read again. Nobody can delete a conversation from the platform — archiving hides it from an inbox and keeps it intact. An academy owner can be granted permission to read any conversation in their own academy; that is a deliberate setting, not the default.

Sign-in and devices

• A record of the devices an account is signed in on, capped at two, so a lost phone can be signed out.
• The time of the last sign-in.

Passwords are stored hashed. Nobody at the academy or at Wexels can read one, and no screen will ever show you an existing password.

What is not held

• No payment or card details — there is no payment processing on this platform.
• No advertising identifiers, and no profiles built for marketing.
• No location tracking.
• No audio or video recordings of students.
• No data sold or shared with anybody for their own purposes. Ever.

Email

This academy has notifications switched on, so the platform emails a student and any linked parent when work is marked, and when a message arrives.

Everything else is sent only when a member of staff presses a button: an invite, a password reset, or a progress report. There is no marketing email of any kind, so there is no marketing list to unsubscribe from.

Cookies and measurement

No analytics or advertising scripts run on this site. The only cookies set are the ones that make signing in work: a session cookie and a security token. Both are essential, neither tracks you anywhere, and neither is shared.

Embedded video

Some tasks include a video. Those are played from YouTube's no-cookie service, which sets nothing at all until somebody actually presses play. Related-video suggestions are switched off, so a video never leads a student somewhere else. If a student does press play, YouTube sees that request — we cannot make that untrue, and we would rather say so than pretend otherwise.

Children

Students on this platform include children. Accounts for them are created by the academy as part of enrolment, never by the child, and never through public sign-up.

• A child's account holds their name, their work and their marks — nothing more than teaching requires.
• A parent account sees a read-only mirror of their own child, and can never act as them.
• Children can only message the staff who teach them. They cannot message each other, and they cannot be contacted by anyone outside the academy.
• Message sending is rate-limited for students, to keep the feature calm.

Where consent is the basis for anything concerning a child, it is the parent or guardian's to give, through the academy.

Your rights

Under the UK/EU GDPR and equivalent laws, you may ask the academy to:

• See what is held about you or your child.
• Correct anything wrong.
• Delete an account. Note that marked work is kept as an academic record for as long as the academy needs it — deleting a student's grades on request would make the academy's own records untrue.
• Export a copy in a portable format.
• Object to a particular use, or withdraw a consent you gave.

Ask the academy and they will act on it. If you are not satisfied, you may complain to your national data protection authority.

How long things are kept

• Accounts — for as long as somebody is enrolled, and afterwards only as long as the academy needs the academic record.
• Work and marks — kept as the academic record.
• Messages — kept, because a conversation about a child is often exactly what somebody needs to produce later.
• Practice runs in Extras — deleted after 30 days.
• Device records — until signed out or revoked.

Security

• Traffic is encrypted in transit.
• Passwords are hashed, never stored or displayed in a readable form.
• Sign-in attempts are rate-limited, and public forms are protected against automated abuse.
• Each academy's data is isolated from every other academy at the database layer.
• Who can see what is governed by named permissions rather than by job title.

Changes

If this page changes in a way that affects you, the academy will tell you. The date at the top always reflects the current version.

Getting in touch

Questions about this page, or about information held on you or your child, go to the academy directly. Ask, and you will get an answer from a person.