Privacy Policy

Batalden Data enk: a sole proprietorship registered in Norway (org. nr 928144488), which operates Vocabest, is the data controller for the personal data described here. As we are based in Norway (within the EEA), the GDPR applies to our processing. If you have any privacy question or want to exercise your rights, contact us at support@vocabest.com; see Section 12.

We collect only what we need to run the marketplace and provide your lessons.

Account & profile data

• Name, display name, email address, password (stored only as a secure hash), and role (student or teacher).
• Profile details you choose to add: for students, your learning preferences and level; for teachers, your headline, bio, languages taught, rates, availability, and avatar.

Booking & lesson data

• Lessons you request, accept, complete, or cancel, including times, durations, and the teacher or student involved.
• Reviews and ratings you give or receive.

Payment metadata (via Stripe)

• We use Stripe to process payments and teacher payouts. Stripe handles your card details directly, and we do not store full card numbers. We receive limited metadata such as payment status, amounts, currency, and references needed to reconcile bookings and payouts.

Video session metadata (via Cloudflare)

• 1-on-1 lessons run over video powered by Cloudflare. We process technical session metadata (such as session identifiers, timing, and connection quality) to deliver and support the lesson. We do not routinely record lessons.

Placement quiz results

• If you take the placement quiz, we store your answers and resulting level to match you with suitable teachers and lessons.

Cookies, device & usage data

• An essential session cookie keeps you signed in, plus limited technical data such as IP address, browser type, and pages used to keep the service secure and working. See our Cookie Policy.

Analytics data (via Microsoft Clarity)

• With your consent, we use Microsoft Clarity to understand how the Platform is used (page views, clicks, scrolls, and aggregated session replays) so we can find issues and improve it. Clarity sets its own cookies/identifiers and, by default, masks text you type. It runs only after you accept optional cookies. See our Cookie Policy.

Advertising data (via the Google Ads tag)

• With your consent, we use the Google Ads tagto measure how many people who click one of our adverts go on to sign up or book a lesson, and to show you relevant Vocabest adverts on Google’s network. It sets cookies and identifiers through Google and DoubleClick domains and may receive your IP address and details of the pages you visited on Vocabest. It runs only after you accept optional cookies. See our Cookie Policy.

Under the GDPR we always rely on a lawful basis. Here is how that maps to what we do:

• To provide the service: creating your account, processing bookings, running lessons, enabling reviews. Legal basis: performance of a contract.
• To process payments and payouts via Stripe. Legal basis: performance of a contract and compliance with legal obligations.
• To keep the Platform safe and secure: preventing fraud and abuse, debugging, and protecting users. Legal basis: our legitimate interests.
• To meet legal duties: such as tax, accounting, and responding to lawful requests. Legal basis: legal obligation.
• To communicate with you: service emails about your bookings and account. Any optional marketing is sent only with your consent. Legal basis: legitimate interests or consent.
• For optional analytics: Microsoft Clarity, to understand and improve how the Platform is used. Legal basis: your consent.
• For optional advertising: the Google Ads tag, to measure the results of our advertising and show you relevant Vocabest adverts. Legal basis: your consent.

We never sell your personal data. We share it only with service providers (“processors”) who help us run Vocabest, and only as needed:

• Stripe: payment processing and teacher payouts (Stripe Connect).
• Cloudflare: video delivery for live lessons and network/security services.
• Microsoft Clarity: optional product analytics and session replay to improve the Platform, used only with your consent.
• Google: optional advertising measurement and remarketing via the Google Ads tag, used only with your consent. Google determines how it uses this data for its own advertising purposes, so for that activity it acts as an independent controller rather than purely as our processor.
• Hosting & infrastructure providers: to host the application and database that store your account and booking data.
• The other party to a lesson:students and teachers see each other’s relevant profile and booking details so a lesson can take place.
• Authorities or advisors: where required by law, or to establish, exercise, or defend legal claims.

Each processor is bound by a data-processing agreement and may only use your data on our instructions.

Vocabest serves students and teachers worldwide, and some of our providers (such as Stripe, Cloudflare, Microsoft, and Google) operate globally. When personal data is transferred outside the EEA, we rely on appropriate safeguards, typically the European Commission’s Standard Contractual Clauses or an adequacy decision, so your data keeps an equivalent level of protection. You can ask us for details of the safeguards used.

We keep personal data only as long as necessary for the purposes above, then delete or anonymise it.

• Account & profile data: for as long as your account is active, and a short period afterwards if you close it.
• Booking & payment records: retained as long as needed to support the service and to meet tax and accounting obligations (which may require several years).
• Reviews: may remain visible after account closure but can be anonymised.
• Support messages and logs: kept for a limited period for security and quality.

If you are in the EEA (and in many other regions) you have the following rights over your personal data. We will respond within the time the law requires, usually within one month.

• Access: get a copy of the personal data we hold about you.
• Rectification: correct inaccurate or incomplete data.
• Erasure:ask us to delete your data (“right to be forgotten”), subject to legal retention duties.
• Portability: receive certain data in a structured, machine-readable format, or have it sent to another controller where technically feasible.
• Restriction: ask us to pause processing in certain cases.
• Objection: object to processing based on our legitimate interests, including any direct marketing.
• Withdraw consent: where we rely on consent, you can withdraw it at any time without affecting prior processing.
• Complain to a supervisory authority: you may lodge a complaint with your local Data Protection Authority. In Norway this is Datatilsynet.

To exercise any right, email support@vocabest.com. We may need to verify your identity first.

We use a small number of cookies, including an essential session cookie that keeps you signed in. We explain each cookie and how to manage your choices in our Cookie Policy.

Vocabest is intended for users aged 18 and over. Where a parent or legal guardian manages an account for a minor, they are responsible for that minor’s data and use of the Platform. If you believe a child has provided us personal data without appropriate consent, contact us at support@vocabest.com and we will take appropriate steps.

We use technical and organisational measures to protect your data, including encryption in transit, hashed passwords, access controls, and reputable processors such as Stripe and Cloudflare. No system is perfectly secure, but we work to protect your information and to notify you and the relevant authority of a qualifying data breach as the law requires.

We may update this Privacy Policy as our service or legal obligations evolve. We will revise the “Last updated” date above and, for material changes, take reasonable steps to let you know.

For any privacy question, to exercise your rights, or to reach our data protection contact, email support@vocabest.com. We will route your request to the right person, including our data protection officer where one is appointed.