Privacy Policy

The platform is operated by FlowerEh Inc., an exam-preparation service based in Ontario, Canada. Throughout this Policy, "we", "us", and "our" refer to FlowerEh Inc. For privacy questions or to exercise your rights, contact us at support@delfprep.com.

Mailing address: FlowerEh Inc., 4900 Bathurst St, North York, ON M2R 1X6, Canada.

This Policy applies to the DELF Prep website at delfprep.com, user accounts, paid plan purchases, mock exams, writing and speaking practice, reports, reminders, and related services we operate.

By creating an account, completing checkout, or using the platform, you acknowledge that we may collect and use information as described here. If you do not agree, do not use the platform.

Depending on how you use the platform, we may collect:

• Account and profile data: email address, name, password hash (for email sign-in) or Google account identifier (for Google sign-in), account creation and login timestamps, password-reset records, and email-verification status.
• Study and product data: target DELF level, mock-exam and practice history, scores, CEFR estimates, streaks, usage counters, and the question IDs you have seen.
• Writing and speaking content: writing submissions you send to the AI feedback feature, transcripts of your spoken responses produced by our speech-to-text provider, AI-generated rubric scores and feedback, and messages you send through the contact form.
• Purchase and plan data: selected plan or product, Stripe checkout-session and payment-intent identifiers, amount and currency, applicable taxes, billing-address country, subscription status, plan purchase and expiry dates, and refund records.
• Email and communication preferences: per-category opt-ins, unsubscribe flags and tokens, and related delivery tracking.
• Technical and usage data: IP-derived request information, browser and device details, session activity, security and rate-limit logs, error reports, and product-analytics events.
• Administrative records: when our staff take an action on your account (for example, a refund or a plan adjustment), we retain an audit-log entry that includes the actor, the action, the IP and user-agent of the actor, and a before/after snapshot of the affected record.
• Mobile-app data: if you use the iOS or Android app, a device push token, the device time zone and the app version (used to send study reminders at a sensible local time), the device name shown on your sign-in sessions, and, if you sign in with Apple, the Apple sign-in identifier and the relay email address Apple provides.
• In-app purchase records: when you buy a plan through the App Store or Google Play, we receive the purchase record from Apple or Google through RevenueCat: product, transaction identifiers, dates, price, currency, and whether it is a sandbox (test) or production purchase. We never receive your card data.

Payment-card numbers and other full payment instruments are handled by Stripe and are not stored on our servers. We receive purchase metadata (amount, currency, tax, billing-address country, payment status, and Stripe identifiers) from Stripe.

When you use a speaking-practice feature, your microphone records audio in your browser or in the app and the recording is sent to our servers and forwarded to a third-party speech-to-text provider for transcription. We keep the recording. It is stored in our file storage (Vercel Blob), linked to the exam or practice session it belongs to, so that a grade can be retried and reviewed. It is deleted when your account is deleted.

In the app, the microphone is used only while you record, and only with the permission you grant in your system settings. A recording that has not been sent yet stays on your phone until it is sent, and is then removed from the phone.

We retain the resulting transcript, basic audio metadata (such as duration), the rubric scores, and the AI feedback associated with the session, linked to your account as part of your study history. Transcripts and AI feedback may also be used in aggregate, with identifiers removed, to evaluate and improve our grading rubrics and prompts.

The DELF Prep iOS and Android apps use the same account and the same data as the website. In addition:

• Microphone: used only while you record a speaking answer, after you allow it in the system permission prompt.
• Notifications: optional, and the app works fully without them. There are two kinds of study reminders: an exam countdown before your exam date, and a practice reminder after several days without practice. You can turn each kind off in Profile, or turn notifications off in your system settings. Reminders are about studying only.
• Usage analytics:the "Share usage analytics" switch controls whether the app sends product-analytics events to PostHog. You can change it at any time.
• What the phone stores:your sign-in tokens, kept in the phone's secure storage, and any answers or recordings you have not sent yet.
• Purchases: plans bought in the app are charged by the App Store or Google Play, and the purchase is validated by RevenueCat. Your plan on our servers decides what you can access.
• AI grading permission: before your first answer is sent to our AI providers for transcription and grading, the app asks for your permission and tells you which providers receive it.

We use the information we collect to:

• Create and secure user accounts, sessions, and authentication flows (including Google sign-in).
• Provide practice sessions, save history, generate score reports, and enforce free-tier or paid-plan limits.
• Process purchases, calculate taxes, verify payment completion, manage subscriptions, refunds, and chargebacks.
• Generate automated AI feedback for writing and speaking, and improve the quality, safety, and reliability of those features.
• Send transactional and preference-based emails such as account notices, purchase and refund confirmations, password resets, and practice reminders.
• Detect abuse, prevent fraud, rate-limit sensitive routes, investigate misuse, troubleshoot issues, and maintain platform security.
• Measure product performance and understand how people use the platform through analytics and operational monitoring.
• Comply with legal obligations, respond to lawful requests, and enforce our Terms of Service and Refund Policy.

Our legal bases under the European General Data Protection Regulation (where applicable) include performance of our contract with you, our legitimate interests in operating and securing the Service, your consent for specific optional uses such as analytics, and compliance with legal obligations. Under Canadian federal and provincial privacy law, we collect, use, and disclose information for the purposes identified in this Policy and for which you would reasonably expect us to use it.

The rubric scores, CEFR estimates, and feedback you receive on writing and speaking submissions are generated by automated systems using third-party large language models. The factors considered include the text of your submission or its transcript, the prompt or scenario context, and our internal grading rubrics. No human is in the loop for routine grading.

These outputs are study aids only. They are not official assessments, certified scores, predictions of how you will perform on an actual DELF exam, or guarantees of any educational, immigration, or employment outcome.

If you live in Quebec, or otherwise have rights under legislation governing automated decisions (including Quebec Law 25), you may request that a member of our team review a specific score or piece of AI feedback and provide the factors that contributed to it. Send your request to support@delfprep.com with the session identifier and a brief description of the decision you would like reviewed.

We use named AI service providers to operate our writing- and speaking-feedback features:

• Speech-to-text transcription of your spoken responses is performed by Groq, Inc. (Whisper Large v3). The audio is sent to Groq for transcription. We keep our own copy of the recording, as described in Speaking recordings & transcripts.
• Speaking-feedback grading is generated by Google LLC (Gemini API). The transcript of your speech and the task context are sent to Google for processing, and to Anthropic, PBC (Claude) if Google's grading fails.
• Writing-feedback grading is generated by Anthropic, PBC (Claude) and/or Google LLC (Gemini API). The prompt, your written response, and any source material attached to the task are sent to the provider for processing.
• Each provider processes the data on our behalf under its own terms. We do not authorize these providers to use your inputs to train their general-purpose models, and we configure the integrations accordingly where the provider supports that setting.

We use cookies, browser local storage, and similar technologies for strictly necessary, functional, analytics, and operational purposes. Our Cookie Policy lists each cookie and storage key in detail.

Our product-analytics provider is PostHog, Inc. Where required by applicable law (for example, for visitors in the EEA, the UK, or Quebec), we ask for your consent through an in-product consent banner before enabling analytics, and you can change your choice at any time. Some strictly necessary cookies are required for the platform to work and cannot be disabled while you are signed in.

We may also use additional measurement or advertising-analytics tools in the future; if we do, we will update this Policy and our Cookie Policy and, where required, obtain your consent before any new processing begins. We do not sell your personal information.

We share information with the third-party service providers we use to operate the platform:

• Stripe Payments Canada Ltd.: payments, tax calculation, refunds (Canada / United States).
• Anthropic, PBC: AI writing-feedback grading, and speaking-feedback grading if Google's grading fails (United States).
• Google LLC (Gemini API): AI speaking- and writing-feedback grading (United States).
• Groq, Inc.: speech-to-text transcription (United States).
• Resend, Inc.: transactional and reminder email delivery (United States).
• PostHog, Inc.: product analytics (United States / EU region).
• MongoDB, Inc. (Atlas): application database hosting.
• Vercel Inc.: application hosting, content delivery, and file storage (Vercel Blob), including your speaking recordings.
• RevenueCat, Inc.: in-app purchase validation (United States).
• 650 Industries, Inc. (Expo): push notification delivery (United States).
• Apple Inc. and Google LLC, as platform providers: Sign in with Apple, App Store and Google Play billing, and the Apple Push Notification service and Firebase Cloud Messaging that deliver notifications to your device.

We may also disclose information to authorities, courts, regulators, or professional advisers where reasonably necessary to comply with law, respond to a valid legal request, enforce our Terms of Service, or protect the rights, property, or safety of users, the public, or FlowerEh Inc. In the event of a corporate transaction (merger, acquisition, sale of assets, reorganization, or bankruptcy), personal information may be transferred to the successor entity, subject to the protections in this Policy.

We send transactional and service-related emails such as account notices, purchase and refund confirmations, password resets, welcome messages, and practice reminders. Some are required to operate the Service; others are governed by your email preferences.

You can adjust per-category email preferences in your account settings or use the unsubscribe link in any non-essential email. Account-related and billing emails are treated as essential and are not subject to marketing opt-out.

We retain different categories of data for different periods:

• Account, study history, scores, and AI feedback: retained while your account exists, and for a reasonable period afterward to support reactivation and to defend against fraud and chargebacks.
• Speaking transcripts and rubric scores: retained as part of your study history, on the same schedule as other study data.
• Speaking recordings: kept in our file storage, linked to the exam or practice session, and deleted when your account is deleted.
• Push tokens: deleted when you sign out, when your account is deleted, when the push service reports the device as unregistered, or after 90 days without use.
• Purchase and refund records: retained for at least seven (7) years to meet Canadian tax and accounting obligations.
• Administrative audit logs: retained for at least seven (7) years for fraud prevention and regulatory inquiries.
• Marketing-suppression records: retained indefinitely so we continue to honor your unsubscribe choice.

Several of our service providers process information in the United States or in other jurisdictions outside of Canada. By using the platform, you understand that your personal information may be processed in those jurisdictions and may be subject to access requests from foreign authorities under applicable local law. We rely on contractual safeguards, including standard data-protection clauses where available, with each provider.

Subject to verification of your identity and to legal limits that may apply, you may exercise the following rights with respect to the personal information we hold about you:

• Access: request a copy of the personal information we hold about you.
• Correction: ask us to correct information that is inaccurate or out of date.
• Deletion: ask us to delete your account and the personal information associated with it, subject to records we are required or permitted to retain (for example, transaction records for tax purposes).
• Portability: request a structured export of the core account and study data we hold about you.
• Objection or restriction: object to specific processing or ask us to restrict it where applicable law allows.
• Withdrawal of consent: where we rely on your consent for a specific use, withdraw it at any time without affecting prior processing.
• Complaint: lodge a complaint with the privacy authority in your jurisdiction.

You can delete your account yourself, in the app or in your settings on the web. See How to delete your account for the steps and for what is deleted and kept.

Canadian residents (PIPEDA / provincial law). You may file a complaint with the Office of the Privacy Commissioner of Canada or with your provincial privacy authority if you believe we have not handled your information consistently with applicable law.

Quebec residents (Law 25). You may contact the person responsible for the protection of personal information at FlowerEh Inc. at support@delfprep.com. You also have the right to data portability, to be informed of automated decisions that significantly affect you, and to request human review of such a decision.

EEA, UK & Swiss residents (GDPR / UK GDPR). You have the right to object to or restrict certain processing, to withdraw consent at any time, and to lodge a complaint with your supervisory authority. Where we transfer personal information out of the EEA, the UK, or Switzerland, we rely on standard contractual clauses or other lawful transfer mechanisms.

California residents (CCPA / CPRA). You may request to know, delete, or correct personal information, and to opt out of any sale or sharing of personal information. We do not sell personal information and do not share it for cross-context behavioral advertising. You will not be discriminated against for exercising these rights.

We use administrative, technical, and organizational safeguards intended to protect personal information, including HTTPS in transit, authenticated account access, password hashing, role-based access controls for our staff, hardened webhook handling, a Content-Security-Policy, and operational monitoring. No system is perfectly secure; we cannot guarantee absolute security and we encourage you to use a strong, unique password and to protect access to your devices and credentials.

If we become aware of a security incident affecting your personal information that triggers notification obligations under applicable law, we will notify you and the competent authorities as required.

The platform is intended for users aged fourteen (14) and older. We do not knowingly collect personal information from children under fourteen. If you believe a child has provided us with personal information, contact us at support@delfprep.com so we can review and address the issue.

We may update this Privacy Policy from time to time. When we do, we will post the updated version on this page and revise the "Last updated" date and version. For material changes, we will give reasonable advance notice through in-product messaging or email, except where applicable law requires us to obtain your renewed consent.

Privacy questions, requests, or complaints can be sent to support@delfprep.com, or by mail to FlowerEh Inc., 4900 Bathurst St, North York, ON M2R 1X6, Canada.