NCLC Ready Privacy Policy

Effective 2026-09-23 · Last updated 2026-11-01 · Version 2026-11-01.3

1. Scope and accountability

This Privacy Policy explains how the individual operator of NCLC Ready, operating under the Certloom Learning brand ("we," "us," or the "Operator"), handles personal information in connection with the NCLC Ready application, our AI feedback server (the "gateway"), our website https://nclcready.com, and other online services that link to this Privacy Policy (collectively, the "Services").

Certloom Learning is a brand used by the Operator and is not represented as a corporation or separate legal entity.

This Privacy Policy does not govern the independent privacy practices of Apple, Google Play, your device operating system, your device's backup service, or third-party websites or services to which we link.

The Operator is accountable for the privacy practices described in this Privacy Policy and is the person in charge of the protection of personal information. Privacy questions and requests may be sent to certloomlearning@gmail.com.

NCLC Ready is an unofficial exam-preparation app. It is not affiliated with France Éducation International, CCI Paris Île-de-France or Immigration, Refugees and Citizenship Canada.

2. Plain-language summary

• Your practice stays on your phone. The app does not require you to create an account. Answers, scores, settings and your exam plans are stored in the app's local storage on your device.
• Your voice is never recorded. Speaking practice turns speech into text on your phone. Audio is never saved or sent, and we never create a voiceprint.
• AI feedback only when you ask for it. Only when you tap to get feedback, a score or the AI examiner, the text you wrote (or the transcript of what you said) and the task are sent through our server to Google (Gemini) on Google Cloud's Vertex AI for feedback. We do not keep it. Google does not use it to train its models. Google may keep a request for up to 90 days only if its automated abuse-detection systems flag it.
• No ad tracking in the app. No ads or ad tracking, pixels or session recording in the app. The app sends usage statistics and crash reports (Google Firebase), never an advertising ID, and you can turn them off at any time in Settings (§9A). On our website, Google Analytics counts page views only if you accept it in the cookie banner; there are no ads. We do not sell or rent personal information, and we do not share it for advertising.
• Purchases go through Apple or Google. We check your subscription each time you ask for AI feedback and do not store the proof. We do not receive your full payment-card number from Apple or Google.
• Phone backups: if your phone's iCloud or Google backup is on, it may include the app's local data. You control those backups.
• One agreement. Versions of the app after 1.2.8 ask you only once, at first launch, to accept the Terms of Use and this Privacy Policy; versions 1.2.8 and earlier also ask separately before each optional feature (§12).
• You are in control. Turn usage statistics off, export your data or delete everything in Settings › Privacy Center. Questions: certloomlearning@gmail.com.

3. Information stored locally in the app

The app stores the following information in local storage on your device, protected by your operating system:

Where this information is stored only locally and is not transmitted to the Operator, we cannot view, retrieve, restore, or provide a server-side copy of it. You can export all of it (Privacy Center › Export my data, a JSON file you share where you choose) or erase it (Delete everything). Uninstalling the app also removes it from the device.

Device backups. We allow your operating system's backup service to include the app's local data, so that your progress can move to a new phone (there is no account). If iCloud Backup (iPhone) or Google backup (Android) is turned on, the backup may include: your progress and settings; your saved essays and transcripts, only if you turned essay history on; and your consent records, including, if you signed the voice release in version 1.2.8 or earlier, the name you typed as your signature. These backups are stored in your own Apple or Google account, are governed by Apple's or Google's terms, and are controlled by you. We cannot access them. You can turn backups off in your phone's settings. Deleting data in the app does not delete copies already in an existing backup until your backup service replaces them.

Uninstalling the app, clearing application data, resetting or replacing the device, or loss or corruption of local storage may result in loss of locally stored information that is not in a backup.

4. Information we never collect

• Audio recordings. Speech recognition runs on your device in on-device mode. The audio is processed in memory and discarded. It is never written to storage or sent to us or anyone else.
• Biometric identifiers or information, including voiceprints. See our Biometric Information Policy (https://nclcready.com/biometric-policy).
• Your name, email address or phone number through the app (except the name typed for the voice release in versions 1.2.8 and earlier, which stays on your device and in any device backup you keep).
• Location, contacts, photos, advertising identifiers, device identifiers for tracking, or browsing history through the app. Usage statistics and crash reports are described in §9A. On the website, page statistics are collected only if you accept Google Analytics (section 9).

5. AI feedback (only when you ask for it)

When: only when you ask for it, by tapping the button to get feedback or a score, or by using the AI examiner. Nothing is sent before that. In versions of the app after 1.2.8, this is covered by your acceptance of the Terms of Use and this Privacy Policy at first launch, and there is no separate pop-up. Versions 1.2.8 and earlier also ask for your consent in a pop-up (an unticked box and Agree & send) the first time you use writing feedback and, separately, speaking feedback and the AI examiner. Using AI feedback is voluntary: if you do not use it, the rest of the app keeps working. AI feedback is hidden for users who tell the app they are under 18 (§19).

What is sent:

• Writing feedback: the text of your answer, the task identifier, the exam and your interface language.
• Speaking feedback and AI examiner: the text transcript of your answers (made on your phone), the examiner's lines, the task identifier, the exam, the duration and your interface language. Never audio.
• With each request: the time it was sent, a label naming the AI feature and a notice version that our gateway checks, proof that the request comes from the genuine app (Apple App Attest or Google Play Integrity), and proof of your subscription from Apple or Google (§7) or, on the one-time free try, a random code made on your phone (§7). These proofs are checked by our gateway, then discarded. They are not sent to the AI model. On iPhone, the App Attest proof includes the identifier of a cryptographic key that your phone creates for this app alone; it is not a device or advertising identifier, the app replaces it at least every 30 days, and Delete everything removes it. On Android, Google Play services produces the Play Integrity proof and our gateway decodes it with Google.

Who receives it: our gateway, which runs on Google Cloud in Montréal, Canada, sends the text and task to Google's Gemini models on Vertex AI (Google Cloud), using the gateway's own Google Cloud identity. We use Google's global endpoint, so Google may process the request in any Google Cloud location, including the United States. Google acts as our service provider (data processor) under its Cloud Data Processing Addendum.

Why: only to produce feedback on your answer (and, for the examiner, the examiner's next line) and return it to you.

What is kept:

• By us: nothing. The gateway processes the request in memory and keeps no copy. It never logs the content.
• By Google: Google's terms state that Google will not use customer data to train or fine-tune any AI/ML models without the customer's permission. We turn off Vertex AI's default in-memory data cache (which otherwise keeps inputs and outputs for up to 24 hours to reduce latency). If Google's automated safety classifiers detect suspected misuse, Google may log the prompt, solely to check for violations of its acceptable-use policies, and store it for up to 90 days. We use only Gemini models that are not subject to Google's broader logging for "Advanced AI" models.

Automated feedback: the feedback and the estimated NCLC range are produced automatically by an AI model. They are practice estimates, not official scores, and they are not used to make any decision about you. You can ask us how the feedback works at certloomlearning@gmail.com.

Stopping: nothing is sent unless you ask for feedback, so you can stop at any time by not using it. In versions 1.2.8 and earlier, you can also turn the feature off in Settings › Privacy Center. Text already sent cannot be recalled, but we keep none of it, and Google keeps it only in the flagged-misuse case above.

6. Voice practice

Voice practice is covered by your acceptance of the Terms of Use and this Privacy Policy at first launch, and your phone asks for microphone and speech-recognition permission the first time you use it; you can refuse and type your answers instead. Versions 1.2.8 and earlier also show, before that permission request, a written release that you sign by typing your name. Your phone's built-in speech recognizer converts your voice to text on the device. The app requires on-device mode and never uses online recognition. If on-device French recognition is not available, you can type your answers. On Android, the app can ask your phone's speech service (a Google service) to download the offline French model; that download happens between your phone and Google, under Google's terms. We do not collect, capture, store or share voiceprints or any other biometric identifier. The transcript stays on your phone unless you ask for speaking feedback or use the AI examiner (§5); it is then sent as text, like a typed answer. Voice practice is hidden for users who tell the app they are under 18 (§19). The AI examiner's lines may be read aloud by your phone's built-in text-to-speech, using only voices that work offline; that text is the AI's reply, not anything you said.

7. Purchases through app marketplaces

Purchases of NCLC Ready subscriptions are processed by Apple's App Store or Google Play. The applicable marketplace processes payment and related store-account information under its own terms and privacy practices. We do not receive your full payment-card number from Apple or Google.

When you ask for AI feedback, the app sends the store's proof of your subscription (Apple's signed transaction or Google's purchase token). Our gateway checks it, by verifying Apple's signature (including a certificate-status check with Apple) or by asking Google's Play Developer API, and then discards it. The gateway uses the proof only to confirm that a subscription of this app is active, whether it is a free trial, and the subscription's stable identifier for the counter below.

To enforce weekly fair-use limits, the gateway keeps a count of AI requests per subscription per week. It is stored under a scrambled code (a keyed hash of the subscription identifier, the week number and the feature used), never the identifier itself, in Google Cloud Firestore in Montréal. It deletes itself after 8 days, and Google usually removes expired records within a day after that. Without the store's identifier we cannot link it to anyone, and we cannot look it up for a particular person. A per-minute limit works the same way, with a scrambled code held only in the server's memory for about a minute and never written anywhere.

Free AI try (from version 1.2.4). Without a subscription, the app offers adults one free writing correction and one free speaking correction per installation, as a one-time try of a Premium feature. Instead of a subscription proof, the app sends a random code it created on your phone. The code is not derived from you, your device or your store account. The gateway still checks that the request comes from the genuine app (App Attest or Play Integrity). So that each installation gets one try, the gateway keeps a count of free tries in Google Cloud Firestore in Montréal, stored under scrambled codes (keyed hashes of the random code and, on iPhone, of the app's App Attest key identifier, with the feature used), never the codes themselves, and nothing about what you wrote or said. This count does not delete itself: it is kept while the free try is offered and deleted within 30 days after the free-try offer ends. We cannot link it to you. We also keep a monthly total of what free tries cost us, which is not personal information, for about 40 days.

Apple and Google may independently collect and process information relating to your purchase, device, store account, fraud prevention, taxation and use of their services. Their processing is governed by their respective privacy policies.

8. Our server, technical data and logs

• Our code never logs the content of requests, your IP address or your device's user agent. It records only technical events: the route, the result code, which check failed, the response time and the amount of AI processing used.
• Our hosting provider's network necessarily sees your IP address to deliver the response. Google Cloud's own request logs for our server can record the IP address and user agent of each request. We configure our project to exclude those request logs and to keep technical logs for 1 day; in any case Google deletes such logs automatically after at most 30 days.
• The Operator administers the Google Cloud project and can see these technical logs, which contain no content or identifiers.

9. Website technical data, cookies and tracking technologies

Our website consists of static pages hosted on Google Firebase Hosting. It uses no advertising, tracking pixels, session recording, chat widgets, or third-party embeds or fonts, and the only third-party script it can load is Google Analytics 4, and only after you choose "OK" in the cookie banner. Until then, and if you decline or your browser sends Global Privacy Control, nothing from Google Analytics is loaded and no cookie is set.

It stores two strictly necessary records in your browser's localStorage: your cookie-banner choice (banner version, decision, date and time), which you can change with Cookie settings in the footer, and, only if you change a setting in the Accessibility tools, your display preferences (text size, contrast, underlined links, font, animations), which Reset removes. Neither record contains an identifier or leaves your browser.

Website analytics (only with your consent). If you accept, Google Analytics 4 (Google LLC, as our service provider) receives, for each page you view, the page address and title, the referring page, your browser and device type, screen size and language, an approximate location derived from your IP address, and the random identifiers stored in its _ga and _ga_<ID> cookies. Google states that Google Analytics 4 does not log or store IP addresses. We send no user ID, name, e-mail address or anything you type or choose on the site, we collect page views only, and Google signals, advertising features and ad personalisation are off. We use the aggregated reports to see which pages help people. The cookies expire about 2 months after your last visit and Google Analytics keeps the statistics for 2 months. Withdraw at any time with Cookie settings: Google Analytics stops and its cookies are deleted. App usage statistics are described separately (§9A).

We do not intercept, record or share your communications with third parties. Like any website host, Google processes your IP address and browser information to deliver pages, detect abuse and protect the service; Google states that Hosting retains IP data for a few months (https://firebase.google.com/support/privacy). We have not enabled Hosting's optional web request logs, so we do not receive that data. Details are in our Cookie & Tracking Technologies Policy (https://nclcready.com/cookies).

Current non-essential provider: Google Analytics 4 (Google LLC), only after you accept.

Global Privacy Control is treated as declining optional cookies: Google Analytics never loads for a browser that sends it.

9A. App usage statistics and crash reports (you can turn them off)

When: depending on your app version:

• Versions after 1.2.8: usage statistics and crash reports are on by default once you accept the Terms of Use and this Privacy Policy at first launch, with no separate pop-up. If you update from an earlier version, your earlier choice is kept: if you had answered Not now or Don't allow, or turned them off in Settings, they stay off until you turn them on in Settings.
• Versions 1.2.8 and earlier: nothing is collected until you tap Allow in the app's "Help improve NCLC Ready?" notice. If you tap Not now (Don't allow in earlier versions), nothing is sent.

In either case you can turn them off at any time (see Turning them off below), and the app works exactly the same whether they are on or off. Users who tell the app they are under 18 never send statistics or crash reports. In Canada, we rely on the consent you give by accepting this Policy (or by tapping Allow in earlier versions), which you can withdraw at any time with the switch.

What is collected: app interactions (events), such as the screens you view; the features you use; starting and finishing a practice set, mock exam or level check, with a score range and a question-count range (never your answers or anything you write or say); reaching a free limit and tapping a Premium-only item; views of the Premium screen, the plan you select, and whether a subscription purchase was started, cancelled, failed or completed (product and period only, never a purchase token or payment details); restoring purchases; choosing an interface language; and ranges such as how many questions you have answered or how many days you have used the app. Google Analytics for Firebase also records a few automatic events (for example first open, session start and engagement time) and collects a random app instance ID created by Firebase, your device model, operating-system version, app version, and an approximate location (country, region or city) derived from your IP address. We also set these properties: your exam, interface language, whether you have Premium, the store (App Store or Google Play) and the week you started using the app.

What is not collected: your name, email address, account, answers, text you write or say, purchase tokens, precise location, or advertising identifiers (Apple IDFA or the Android advertising ID). The app does not collect the iOS identifier for vendors (IDFV) or the Android ID for analytics. Advertising storage, ad user data, ad personalization and Google signals are off. We do not link the statistics to your identity.

Why: only to understand which features help learners and what leads people from the free plan to a subscription, so we can improve the app. Not for advertising or profiling, and the statistics are never sold or shared for cross-context behavioural advertising.

Crash reports (from version 1.2.4): under the same setting, Firebase Crashlytics (Google) receives a report when the app crashes: the technical stack trace of the error, your device model, operating-system version, app version, the time of the crash, a random Crashlytics installation ID, and three labels we set (your exam, app version and interface language). Reports never include your name, account, answers, text you write or say, or audio, and we never set a user ID. Crashes that happen while the setting is off are deleted from your phone without being sent. Development builds never send reports. We use crash reports only to keep the app stable (find and fix crashes); Google is our service provider (data processor), and keeps crash reports for 90 days.

Who receives it: Google LLC (Google Analytics for Firebase and Firebase Crashlytics), as our service provider (data processor) under Google's data processing terms. Google may process the statistics in the United States or in other countries where Google operates (§14).

Offline use: the app works the same without a connection. Statistics and crash reports wait on your phone and are sent when you are back online; nothing waits for them.

Retention: Google Analytics keeps event-level statistics for 2 months, and Crashlytics keeps crash reports for 90 days, then they are deleted. We see only aggregated reports.

Turning them off: switch Usage statistics and crash reports off at any time in Settings › Privacy (from version 1.2.4) or Settings › Privacy Center. Collection stops immediately, and the app deletes from your phone the app instance ID and any statistics or crash reports not yet sent. Delete everything does the same. Switching it back on resumes collection. Data already sent is deleted by Google at the end of the retention periods above. Questions: certloomlearning@gmail.com.

10. Voluntary communications

If you contact us voluntarily at certloomlearning@gmail.com, we receive the information you choose to provide, such as your email address, message and attachments. Our mailbox is provided by Google (Gmail). We use that information to respond to you, provide support, diagnose problems, handle privacy requests, maintain appropriate records and comply with applicable law. We keep this correspondence only as long as needed to handle your request, and at most 12 months after it is closed, then delete it. We may keep a short record of privacy requests (date, type of request and our response, without the message content) for as long as the law requires us to be able to show how we handled them.

Do not send unnecessary sensitive personal information in a support request.

11. Purposes for which we process information

We process personal information only to:

• provide AI feedback and the AI examiner when you ask for them;
• verify your subscription and enforce fair-use limits;
• protect the Services against fraud, abuse and security incidents (app-integrity checks, rate limits, the spend limit);
• produce usage statistics and crash reports to improve the app and keep it stable, unless you turn them off (§9A);
• respond to support and privacy requests; and
• comply with applicable law and establish, exercise or defend legal rights.

We do not use personal information for advertising, profiling, personalization across services, or model training, and we do not sell it. With your consent, the website uses Google Analytics statistics only to understand which pages are used (section 9). The app sends usage statistics only to understand which features are used (§9A).

12. Consent and privacy choices

How the app asks depends on your app version:

• Versions after 1.2.8: the only agreement the app asks for is your acceptance of the Terms of Use and this Privacy Policy on the first screen. It covers AI feedback and the AI examiner when you ask for them (§5), voice practice (§6), and usage statistics and crash reports, which are on by default and which you can turn off at any time (§9A). There are no separate pop-ups, checkboxes or signatures, and the app does not ask again when this Policy changes (§21).
• Versions 1.2.8 and earlier: accepting the Terms does not send any data. Each optional feature asks for your consent separately, just before it is first used, with an unticked checkbox: AI writing feedback, AI speaking feedback and examiner, and voice practice (with a written release you sign by typing your name). Usage statistics are asked once, with Allow and Not now (Don't allow in earlier versions) shown together (§9A).

Whatever your version, you can decline AI feedback and voice practice by not using them and keep using the rest of the app; you can turn usage statistics and crash reports off at any time in Settings; and you can export or delete your data and change your age answer in Settings › Privacy Center. Withdrawal applies to future processing.

13. Service providers and other recipients

We do not sell or rent personal information, and we do not share it for cross-context behavioural advertising.

We may also disclose information to professional advisers where reasonably necessary; to governmental, regulatory, law-enforcement or judicial authorities where disclosure is legally required or permitted; and to a purchaser, successor or other relevant party in connection with a lawful sale, restructuring or transfer of the business, subject to this Policy. The current list of service providers is at https://nclcready.com/subprocessors.

14. International processing and transfers

Our gateway and counters run in Montréal, Canada. AI feedback requests are processed by Google through its global endpoint, which may use any Google Cloud location, including the United States. Emails you send us are handled through Gmail. While usage statistics are on in the app, or if you accept Google Analytics on the website, its statistics are processed by Google, including in the United States. As a result, personal information may be processed in Canada, the United States, and other countries in which we or our providers operate, outside the province, territory or country in which you live. It may be subject to the laws and lawful-access regimes of those jurisdictions, including access by courts, law-enforcement and national-security authorities.

Before these transfers, we carried out the privacy impact assessment required by Quebec law (s. 17), and our agreement with Google (Cloud Data Processing Addendum) limits Google's use of the data to providing the service. Where applicable law requires an assessment, contractual protection, consent or another measure for an international transfer, we apply the legally required measure.

NCLC Ready is available worldwide except in the European Union, the European Economic Area and the United Kingdom. If you use AI feedback, your text leaves your country; while usage statistics are on, they do too. This Policy tells you about these transfers, and versions 1.2.8 and earlier also describe them in the AI pop-up and the usage-statistics notice. Every other feature works without any transfer. International transfers may carry risks, because the destination countries may not offer the same level of protection as your own country's law; you can avoid them entirely by not using AI feedback and by turning usage statistics off.

Alberta residents: for questions about our policies on service providers outside Canada, contact the Operator at certloomlearning@gmail.com.

15. Retention

16. Security

We use reasonable administrative, technical and organizational measures appropriate to the nature of the information we handle and the Services we provide. These include encryption in transit (TLS), app-integrity checks, strict input limits, no database of users, no AI API key (the gateway uses its Google Cloud identity), the HMAC key held in Google Secret Manager, and a written incident-response plan.

No system, network, device, transmission method or storage technology can be guaranteed to be completely secure, so we cannot guarantee absolute security. Protect your phone with a passcode: the data in §3 is only as safe as your device and your backup account.

If we become aware of a security incident involving personal information that requires notification, reporting, recordkeeping or other action under applicable law, we will take the action required by that law.

17. Access, correction, withdrawal of consent and complaints

Subject to applicable law, you may have rights relating to personal information that we actually hold about you. These include rights to request access, correction or deletion; to withdraw consent; to receive your information in a structured, commonly used technological format; and to raise a privacy complaint. Because the information stored only on your device is not held by the Operator, we cannot provide a server-side copy of information that we do not possess. The Privacy Center lets you view, export and delete it yourself.

To make a privacy request or complaint, email certloomlearning@gmail.com. We answer within 30 days. We may request information reasonably necessary to verify your identity and the request, and never more than we need. Legal exceptions may apply.

• Canada: you have rights under PIPEDA and, in Quebec, under the Act respecting the protection of personal information in the private sector. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada (www.priv.gc.ca), the Commission d'accès à l'information du Québec (www.cai.gouv.qc.ca) or another applicable provincial privacy regulator.
• United States: depending on your state, you may have the right to know or access, delete and correct personal information; to obtain a portable copy; to opt out of sale, sharing, targeted advertising and profiling (we do none of these); and not to be discriminated against for exercising your rights. We extend these rights to all users, whether or not a given state law applies to us. You may use an authorized agent. If we decline a request, you can appeal by replying to our decision with "Appeal" in the subject line; we will answer within the time your state's law requires and tell you how to contact your state attorney general.
• Other countries: you can exercise the rights your local law gives you (for example under India's DPDP Act, Brazil's LGPD, Nigeria's NDPA or Morocco's Law 09-08) by writing to certloomlearning@gmail.com.

California notice at collection. In the last 12 months we collected, only from you and only when you asked for AI feedback, user content (essays and speaking transcripts sent for AI feedback) and commercial information (proof of an active subscription, checked and not kept). We also kept a pseudonymous weekly usage count for 8 days, a pseudonymous free-try count while the free try is offered (§7) and, while usage statistics were on, collected internet or other electronic network activity information (app interactions, an app instance ID, device and app details) and approximate location derived from your IP address, which we disclosed to our service provider Google for analytics (§9A). We use them to provide AI feedback and enforce fair-use limits, and we disclosed user content to our service provider Google for that purpose. We did not sell or share personal information, and we do not use or disclose sensitive personal information for purposes that require a right to limit. Retention periods are in §15.

Consumer health data. We do not ask for, and do not intend to collect, consumer health data as defined by Washington's My Health My Data Act, Connecticut's Data Privacy Act or similar laws, and we do not record voice. Please do not include health information in your answers. If you do, it is handled like any other text you send for feedback (§5) and we do not keep it.

18. If you are in the EEA, Switzerland or the UK

This section gives the information that the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, and the Swiss Federal Act on Data Protection (FADP) require. It applies when you use the Services from the European Economic Area (EEA), Switzerland or the United Kingdom, and where it differs from the rest of this Policy, this section prevails. The apps are available in Switzerland. They are not yet offered in the EEA or the UK (§14); this section will apply there as soon as they are.

Controller. The controller of your personal information is the individual operator of NCLC Ready, operating under the Certloom Learning brand (§1). Write to certloomlearning@gmail.com with any privacy question or request. We have not appointed a data protection officer, because the law does not require one for processing of this kind.

Representatives. We have no establishment in the EU or the UK. Before the apps become available in the EEA or the UK, we will designate a representative in the EU and a representative in the UK, as Article 27 of the GDPR and of the UK GDPR requires, and we will add their names and contact details to this section. You will then be able to contact them as well as us. We have not designated a representative in Switzerland: the FADP requires one only for processing that is, among other conditions, large-scale and high-risk (FADP art. 14), which ours is not.

Purposes and legal bases.

Information that stays on your device (§3), including your consent records, is not received by us; the app stores it only to provide the features you use. For the technical items based on legitimate interests (integrity checks, logs and website delivery), the information contains nothing you write and is kept only briefly (§15). You can object to any processing based on our legitimate interests. The FADP does not require a legal basis for each purpose; in Switzerland we apply the same grounds. You are not required by law or by contract to give us any information: if you do not use AI feedback, the only consequence is that you do not receive it.

Automated evaluation. AI feedback evaluates the answer you send against the task and a fixed rubric (task achievement, coherence, vocabulary, grammar and, for interactive speaking tasks, interaction) and gives an estimated NCLC level. The GDPR and the UK GDPR may treat this automated evaluation as profiling. It happens only when you ask for it, and only to give you the feedback. It is practice feedback, not a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you (GDPR art. 22, UK GDPR arts. 22A–22D and FADP art. 21): it is not an official score, it is returned only to you, we do not keep it on our server, and neither we nor anyone else uses it to decide anything about you. When this Policy says that we do not use personal information for profiling, it means that we build no profile of you and make no decision about you. You can ask us how the feedback works at certloomlearning@gmail.com.

Transfers outside your country. Our gateway and counters run in Montréal, Canada. The European Commission, the UK and Switzerland recognise Canada, for organisations subject to Canada's federal private-sector privacy law, as providing an adequate level of protection. The Operator may access technical logs and emails from outside Canada; where that is a transfer, we rely on an adequacy decision or another safeguard the law requires. AI feedback requests may be processed by Google in the United States or in other countries where Google Cloud operates (§5), and emails you send us are handled through Gmail. For these transfers to Google, we rely on Google LLC's certification under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework, and, for Google Cloud services, on the standard contractual clauses in Google's Cloud Data Processing Addendum. You can ask us for more information about these safeguards at certloomlearning@gmail.com.

Retention. The periods are in §15. In short: we keep none of the text you send for feedback; the weekly count deletes itself after 8 days; the free-try count is deleted within 30 days after the free-try offer ends; our technical logs are kept for 1 day; and emails are kept at most 12 months after your request is closed. App usage statistics, while on, are kept 2 months by Google Analytics.

Your rights. You have the right to access your personal information, to have it corrected or erased, to restrict or object to its processing (in particular processing based on our legitimate interests), to receive the information you gave us in a portable format, and to withdraw your consent at any time, without affecting processing that took place before. The FADP gives you similar rights. Most of your information is on your device, where the Privacy Center lets you see it, export it, delete it and turn usage statistics off yourself. For anything else, write to certloomlearning@gmail.com. It is free. We answer within one month; if a request is complex, we may extend this by up to two further months and will tell you why within the first month. In Switzerland, we answer within 30 days. We may ask for information to confirm that a request comes from you, never more than we need. We keep no account or user database, and the weekly count is stored under a scrambled code that we cannot link to you without information held by Apple or Google, so we usually cannot find information about a particular person on our server; if that is the case, we will tell you.

Complaints. You can complain to a data protection supervisory authority. In the EEA, because we have no establishment in the EU, no authority acts as our lead authority, and you can complain to any supervisory authority, in particular the one in the country where you live or work or where you think the problem occurred (list: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en). In the UK, you can complain to the Information Commissioner's Office (https://ico.org.uk). In Switzerland, you can contact the Federal Data Protection and Information Commissioner (https://www.edoeb.admin.ch). We would welcome the chance to address a concern first: you can complain to us at certloomlearning@gmail.com, and we acknowledge a complaint within 30 days and answer it without undue delay.

Device storage. The app stores information on your device only as needed for the features you use (§3). The app-integrity proofs are created only when you ask for AI feedback (§5). Google Analytics for Firebase stores its app instance ID and queued statistics on your device only while usage statistics are on (§9A): in versions after 1.2.8, from your acceptance of the Terms and this Policy until you turn them off; in versions 1.2.8 and earlier, only after you allow them. For the website, see §9 and our Cookie & Tracking Technologies Policy.

Children. AI feedback and voice practice are intended for users 18 or older and are hidden for users who tell the app they are under 18. For those users, nothing leaves the device (§19).

19. Children and minors

NCLC Ready is intended for adults preparing for Canadian immigration French tests. In versions 1.2.8 and earlier, a neutral age screen asks for your birth year, and only the result (18 or older, or not) is stored. Later versions do not ask your age during setup: they treat you as 18 or older unless you say otherwise in Settings › Privacy Center › Age. Users who say they are under 18 can use offline practice only: AI feedback and voice practice are hidden and usage statistics and crash reports stay off, so no information leaves their device. If applicable law requires parental or guardian authorization for a particular user's use of the Services, the user should use the Services only with the required authorization. We do not knowingly collect personal information from children. If you believe a child has sent us information, contact certloomlearning@gmail.com and we will delete it.

20. Third-party services

The Services rely on or link to services supplied by Apple, Google, government websites and test administrators. Those third parties may independently collect and process information under their own terms and privacy policies. We are not responsible for their independent privacy practices.

21. Changes to this Privacy Policy

We may update this Privacy Policy when the Services, technologies, providers, legal requirements or our privacy practices change. The "last updated" date and version will be updated when the Policy changes. We announce material changes on our website (https://nclcready.com) before they take effect. The app does not ask you to accept an updated Policy again. Where applicable law requires additional notice or consent, we will provide or obtain it.

22. Contact

Privacy questions, requests, complaints and other privacy-related communications may be sent to:

NCLC Ready Operated under the Certloom Learning brand Person in charge of the protection of personal information: the Operator Email: certloomlearning@gmail.com

Do not send unnecessary sensitive personal information in an email request.