NCLC Ready Privacy Policy

Effective 2026-09-23 · Version 2026-09-23.1

1. Scope and accountability

This Privacy Policy explains how the individual operator of NCLC Ready, operating from Israel under the Certloom Learning brand ("we," "us," or the "Operator"), handles personal information in connection with the NCLC Ready application, our AI feedback server (the "gateway"), our website https://nclcready.com, and other online services that link to this Privacy Policy (collectively, the "Services").

Certloom Learning is a brand used by the Operator and is not represented as a corporation or separate legal entity.

This Privacy Policy does not govern the independent privacy practices of Apple, Google Play, your device operating system, your device's backup service, or third-party websites or services to which we link.

The Operator is accountable for the privacy practices described in this Privacy Policy and is the person in charge of the protection of personal information. Privacy questions and requests may be sent to certloomlearning@gmail.com.

NCLC Ready is an unofficial exam-preparation app. It is not affiliated with France Éducation International, CCI Paris Île-de-France or Immigration, Refugees and Citizenship Canada.

2. Plain-language summary

• Your practice stays on your phone. The app does not require you to create an account. Answers, scores, settings and your exam plans are stored in the app's local storage on your device.
• Your voice is never recorded. Speaking practice turns speech into text on your phone. Audio is never saved or sent, and we never create a voiceprint.
• AI feedback is optional. Only when you agree, the text you wrote (or the transcript of what you said) and the task are sent through our server to Google (Gemini) on Google Cloud's Vertex AI for feedback. We do not keep it. Google does not use it to train its models. Google may keep a request for up to 90 days only if its automated abuse-detection systems flag it.
• No tracking. No ads, analytics, crash reporting, trackers, pixels, session recording or cookies, in the app or on our website. We do not sell or rent personal information, and we do not share it for advertising.
• Purchases go through Apple or Google. We check your subscription each time you ask for AI feedback and do not store the proof. We do not receive your full payment-card number from Apple or Google.
• Phone backups: if your phone's iCloud or Google backup is on, it may include the app's local data. You control those backups.
• You are in control. Withdraw any consent, export your data or delete everything in Settings › Privacy Center. Questions: certloomlearning@gmail.com.

3. Information stored locally in the app

The app stores the following information in local storage on your device, protected by your operating system:

Where this information is stored only locally and is not transmitted to the Operator, we cannot view, retrieve, restore, or provide a server-side copy of it. You can export all of it (Privacy Center › Export my data, a JSON file you share where you choose) or erase it (Delete everything). Uninstalling the app also removes it from the device.

Device backups. We allow your operating system's backup service to include the app's local data, so that your progress can move to a new phone (there is no account). If iCloud Backup (iPhone) or Google backup (Android) is turned on, the backup may include: your progress and settings; your saved essays and transcripts, only if you turned essay history on; and your consent records, including the name you typed as your signature. These backups are stored in your own Apple or Google account, are governed by Apple's or Google's terms, and are controlled by you. We cannot access them. You can turn backups off in your phone's settings. Deleting data in the app does not delete copies already in an existing backup until your backup service replaces them.

Uninstalling the app, clearing application data, resetting or replacing the device, or loss or corruption of local storage may result in loss of locally stored information that is not in a backup.

4. Information we never collect

• Audio recordings. Speech recognition runs on your device in on-device mode. The audio is processed in memory and discarded. It is never written to storage or sent to us or anyone else.
• Biometric identifiers or information, including voiceprints. See our Biometric Information Policy (https://nclcready.com/biometric-policy).
• Your name, email address or phone number through the app (except the name you type for the voice release, which stays on your device and in any device backup you keep).
• Location, contacts, photos, advertising identifiers, device identifiers for tracking, browsing history, analytics, or crash-reporting data.

5. AI feedback (only with your consent)

When: only after you tick the box and tap Agree & send in the pop-up for that feature. Writing feedback and speaking feedback (including the AI examiner) are asked for separately. Providing this information is voluntary. If you say no, the only consequence is that AI feedback is unavailable; the rest of the app keeps working.

What is sent:

• Writing feedback: the text of your answer, the task identifier, the exam and your interface language.
• Speaking feedback and AI examiner: the text transcript of your answers (made on your phone), the examiner's lines, the task identifier, the exam, the duration and your interface language. Never audio.
• With each request: the time it was sent, which consent you gave and its version, proof that the request comes from the genuine app (Apple App Attest or Google Play Integrity), and proof of your subscription from Apple or Google (§7). These proofs are checked by our gateway, then discarded. They are not sent to the AI model. On iPhone, the App Attest proof includes the identifier of a cryptographic key that your phone creates for this app alone; it is not a device or advertising identifier, the app replaces it at least every 30 days, and Delete everything removes it. On Android, Google Play services produces the Play Integrity proof and our gateway decodes it with Google.

Who receives it: our gateway, which runs on Google Cloud in Montréal, Canada, sends the text and task to Google's Gemini models on Vertex AI (Google Cloud), using the gateway's own Google Cloud identity. We use Google's global endpoint, so Google may process the request in any Google Cloud location, including the United States. Google acts as our service provider (data processor) under its Cloud Data Processing Addendum.

Why: only to produce feedback on your answer (and, for the examiner, the examiner's next line) and return it to you.

What is kept:

• By us: nothing. The gateway processes the request in memory and keeps no copy. It never logs the content.
• By Google: Google's terms state that Google will not use customer data to train or fine-tune any AI/ML models without the customer's permission. We turn off Vertex AI's default in-memory data cache (which otherwise keeps inputs and outputs for up to 24 hours to reduce latency). If Google's automated safety classifiers detect suspected misuse, Google may log the prompt, solely to check for violations of its acceptable-use policies, and store it for up to 90 days. We use only Gemini models that are not subject to Google's broader logging for "Advanced AI" models.

Automated feedback: the feedback and the estimated NCLC range are produced automatically by an AI model. They are practice estimates, not official scores, and they are not used to make any decision about you. You can ask us how the feedback works at certloomlearning@gmail.com.

Withdrawing: turn the feature off at any time in Settings › Privacy Center. Nothing more is sent. Text already sent cannot be recalled, but we keep none of it, and Google keeps it only in the flagged-misuse case above.

6. Voice practice

Before your phone asks for microphone and speech-recognition permission, the app shows a written release that you sign by typing your name. Your phone's built-in speech recognizer converts your voice to text on the device. The app requires on-device mode and never uses online recognition. If on-device French recognition is not available, you can type your answers. On Android, the app can ask your phone's speech service (a Google service) to download the offline French model; that download happens between your phone and Google, under Google's terms. We do not collect, capture, store or share voiceprints or any other biometric identifier. The transcript stays on your phone unless you separately agree to speaking feedback (§5). The AI examiner's lines may be read aloud by your phone's built-in text-to-speech, using only voices that work offline; that text is the AI's reply, not anything you said.

7. Purchases through app marketplaces

Purchases of NCLC Ready subscriptions are processed by Apple's App Store or Google Play. The applicable marketplace processes payment and related store-account information under its own terms and privacy practices. We do not receive your full payment-card number from Apple or Google.

When you ask for AI feedback, the app sends the store's proof of your subscription (Apple's signed transaction or Google's purchase token). Our gateway checks it, by verifying Apple's signature (including a certificate-status check with Apple) or by asking Google's Play Developer API, and then discards it. The gateway uses the proof only to confirm that a subscription of this app is active, whether it is a free trial, and the subscription's stable identifier for the counter below.

To enforce weekly fair-use limits, the gateway keeps a count of AI requests per subscription per week. It is stored under a scrambled code (a keyed hash of the subscription identifier, the week number and the feature used), never the identifier itself, in Google Cloud Firestore in Montréal. It deletes itself after 8 days, and Google usually removes expired records within a day after that. Without the store's identifier we cannot link it to anyone, and we cannot look it up for a particular person. A per-minute limit works the same way, with a scrambled code held only in the server's memory for about a minute and never written anywhere.

Apple and Google may independently collect and process information relating to your purchase, device, store account, fraud prevention, taxation and use of their services. Their processing is governed by their respective privacy policies.

8. Our server, technical data and logs

• Our code never logs the content of requests, your IP address or your device's user agent. It records only technical events: the route, the result code, which check failed, the response time and the amount of AI processing used.
• Our hosting provider's network necessarily sees your IP address to deliver the response. Google Cloud's own request logs for our server can record the IP address and user agent of each request. We configure our project to exclude those request logs and to keep technical logs for 1 day; in any case Google deletes such logs automatically after at most 30 days.
• The Operator administers the Google Cloud project from Israel and can see these technical logs, which contain no content or identifiers.

9. Website technical data, cookies and tracking technologies

Our website consists of static pages hosted on Google Firebase Hosting. It uses no cookies, analytics, advertising, tracking pixels, session recording, chat widgets, or third-party embeds, scripts or fonts. It stores at most two strictly necessary records in your browser's localStorage, and nothing else: your cookie-banner choice (banner version, decision, date and time), which you can change with Cookie settings in the footer, and, only if you change a setting in the Accessibility tools, your display preferences (text size, contrast, underlined links, font, animations), which Reset removes. Neither record contains an identifier or leaves your browser. We do not intercept, record or share your communications with third parties. Like any website host, Google processes your IP address and browser information to deliver pages, detect abuse and protect the service; Google states that Hosting retains IP data for a few months (https://firebase.google.com/support/privacy). We have not enabled Hosting's optional web request logs, so we do not receive that data. Details are in our Cookie & Tracking Technologies Policy (https://nclcready.com/cookies).

Current non-essential third-party tracking providers: none.

Because we do no tracking, browser signals such as Global Privacy Control are honoured automatically: there is nothing to opt out of.

10. Voluntary communications

If you contact us voluntarily at certloomlearning@gmail.com, we receive the information you choose to provide, such as your email address, message and attachments. Our mailbox is provided by Google (Gmail). We use that information to respond to you, provide support, diagnose problems, handle privacy requests, maintain appropriate records and comply with applicable law. We keep this correspondence only as long as needed to handle your request, and at most 12 months after it is closed, then delete it. We may keep a short record of privacy requests (date, type of request and our response, without the message content) for as long as the law requires us to be able to show how we handled them.

Do not send unnecessary sensitive personal information in a support request.

11. Purposes for which we process information

We process personal information only to:

• provide AI feedback and the AI examiner when you ask for them;
• verify your subscription and enforce fair-use limits;
• protect the Services against fraud, abuse and security incidents (app-integrity checks, rate limits, the spend limit);
• respond to support and privacy requests; and
• comply with applicable law and establish, exercise or defend legal rights.

We do not use personal information for advertising, analytics, profiling, personalization across services, or model training, and we do not sell it.

12. Consent and privacy choices

Accepting the Terms of Use does not give consent to send any data. Each optional feature asks for your consent separately, just before it is first used, with an unticked checkbox: AI writing feedback, AI speaking feedback and examiner, and voice practice. You can decline and keep using the rest of the app.

You may withdraw consent at any time in Settings › Privacy Center. Withdrawal applies to future processing. If a notice changes materially, the app asks for your consent again before that feature sends anything.

13. Service providers and other recipients

We do not sell or rent personal information, and we do not share it for cross-context behavioural advertising.

We may also disclose information to professional advisers where reasonably necessary; to governmental, regulatory, law-enforcement or judicial authorities where disclosure is legally required or permitted; and to a purchaser, successor or other relevant party in connection with a lawful sale, restructuring or transfer of the business, subject to this Policy. The current list of service providers is at https://nclcready.com/subprocessors.

14. International processing and transfers

The Operator is based in Israel. Our gateway and counters run in Montréal, Canada. AI feedback requests are processed by Google through its global endpoint, which may use any Google Cloud location, including the United States. Emails you send us are handled through Gmail. As a result, personal information may be processed in Canada, Israel, the United States, and other countries in which our providers operate, outside the province, territory or country in which you live. It may be subject to the laws and lawful-access regimes of those jurisdictions, including access by courts, law-enforcement and national-security authorities.

Before these transfers, we carried out the privacy impact assessment required by Quebec law (s. 17), and our agreement with Google (Cloud Data Processing Addendum) limits Google's use of the data to providing the service. Where applicable law requires an assessment, contractual protection, consent or another measure for an international transfer, we apply the legally required measure.

NCLC Ready is available worldwide except in the European Union, the European Economic Area and the United Kingdom. If you use AI feedback, your text leaves your country. Your consent in the AI pop-up covers this transfer. Every other feature works without any transfer. International transfers may carry risks, because the destination countries may not offer the same level of protection as your own country's law; you can avoid them entirely by not using AI feedback.

Alberta residents: for questions about our policies on service providers outside Canada, contact the Operator at certloomlearning@gmail.com.

15. Retention

16. Security

We use reasonable administrative, technical and organizational measures appropriate to the nature of the information we handle and the Services we provide. These include encryption in transit (TLS), app-integrity checks, strict input limits, no database of users, no AI API key (the gateway uses its Google Cloud identity), the HMAC key held in Google Secret Manager, and a written incident-response plan.

No system, network, device, transmission method or storage technology can be guaranteed to be completely secure, so we cannot guarantee absolute security. Protect your phone with a passcode: the data in §3 is only as safe as your device and your backup account.

If we become aware of a security incident involving personal information that requires notification, reporting, recordkeeping or other action under applicable law, we will take the action required by that law.

17. Access, correction, withdrawal of consent and complaints

Subject to applicable law, you may have rights relating to personal information that we actually hold about you. These include rights to request access, correction or deletion; to withdraw consent; to receive your information in a structured, commonly used technological format; and to raise a privacy complaint. Because the information stored only on your device is not held by the Operator, we cannot provide a server-side copy of information that we do not possess. The Privacy Center lets you view, export and delete it yourself.

To make a privacy request or complaint, email certloomlearning@gmail.com. We answer within 30 days. We may request information reasonably necessary to verify your identity and the request, and never more than we need. Legal exceptions may apply.

• Canada: you have rights under PIPEDA and, in Quebec, under the Act respecting the protection of personal information in the private sector. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada (www.priv.gc.ca), the Commission d'accès à l'information du Québec (www.cai.gouv.qc.ca) or another applicable provincial privacy regulator.
• Israel: the Operator is subject to Israel's Protection of Privacy Law, 5741-1981, as amended by Amendment No. 13 (in force since 14 August 2025). You may ask to access personal information about you that we keep in a database, and to have it rectified or deleted if it is incorrect, incomplete, unclear or out of date. You may complain to Israel's Privacy Protection Authority (www.gov.il).
• United States: depending on your state, you may have the right to know or access, delete and correct personal information; to obtain a portable copy; to opt out of sale, sharing, targeted advertising and profiling (we do none of these); and not to be discriminated against for exercising your rights. We extend these rights to all users, whether or not a given state law applies to us. You may use an authorized agent. If we decline a request, you can appeal by replying to our decision with "Appeal" in the subject line; we will answer within the time your state's law requires and tell you how to contact your state attorney general.
• Other countries: you can exercise the rights your local law gives you (for example under India's DPDP Act, Brazil's LGPD, Nigeria's NDPA or Morocco's Law 09-08) by writing to certloomlearning@gmail.com.

California notice at collection. In the last 12 months we collected, only from you and only with your consent for the feature, user content (essays and speaking transcripts sent for AI feedback) and commercial information (proof of an active subscription, checked and not kept). We also kept a pseudonymous weekly usage count for 8 days. We use them to provide AI feedback and enforce fair-use limits, and we disclosed user content to our service provider Google for that purpose. We did not sell or share personal information, and we do not use or disclose sensitive personal information for purposes that require a right to limit. Retention periods are in §15.

Consumer health data. We do not ask for, and do not intend to collect, consumer health data as defined by Washington's My Health My Data Act, Connecticut's Data Privacy Act or similar laws, and we do not record voice. Please do not include health information in your answers. If you do, it is handled like any other text you send for feedback (§5) and we do not keep it.

18. Children and minors

NCLC Ready is intended for adults preparing for Canadian immigration French tests. A neutral age screen asks for your birth year, and only the result (18 or older, or not) is stored. Users under 18 can use offline practice only: AI feedback and voice practice are hidden, so no information leaves their device. If applicable law requires parental or guardian authorization for a particular user's use of the Services, the user should use the Services only with the required authorization. We do not knowingly collect personal information from children. If you believe a child has sent us information, contact certloomlearning@gmail.com and we will delete it.

19. Third-party services

The Services rely on or link to services supplied by Apple, Google, government websites and test administrators. Those third parties may independently collect and process information under their own terms and privacy policies. We are not responsible for their independent privacy practices.

20. Changes to this Privacy Policy

We may update this Privacy Policy when the Services, technologies, providers, legal requirements or our privacy practices change. The effective date and version will be updated when the Policy changes. Where a change affects a feature you have consented to, the app asks for your consent again before that feature sends anything, and where applicable law requires additional notice, we will provide it.

21. Contact

Privacy questions, requests, complaints and other privacy-related communications may be sent to:

NCLC Ready Operated from Israel under the Certloom Learning brand Person in charge of the protection of personal information: the Operator Email: certloomlearning@gmail.com

Do not send unnecessary sensitive personal information in an email request.