Privacy Policy

Website: https://www.yourtoeflprep.com

Effective date: 29 September 2026

1. Who We Are and Scope

Dallakyan Tigran Suren (Դալլաքյան Տիգրան Սուրենի), a sole proprietor registered in the Republic of Armenia under taxpayer identification number (TIN) 73046309, with registered business address at 29 Gyulbenkyan Street, Apt. 13, Yerevan, Armenia ("Operator," "we," "us," or "our"), operates https://www.yourtoeflprep.com and the related online practice and mock examination service (the "Service").

For the personal data described in this Privacy Policy, we are generally the controller or person responsible for deciding why and how it is processed. This Policy applies to website visitors, account holders, students, purchasers, and people who contact us.

It does not govern a third party's independent processing, including the processing that a payment provider or Merchant of Record, a bank, a card network, or an independently operated service linked from our website performs for its own purposes. Those parties provide their own privacy notices.

2. Personal Data We Collect

Depending on how you use the Service, we may collect the following categories.

2.1 Account and identity data

Name, surname, email address, account identifier, password in hashed form, date of birth, gender if provided, profile image if provided, role, plan, and the versions and timestamps of legal terms you accepted.

2.2 Purchase and transaction data

Product purchased, price, currency, tax amount, date and time, order or receipt number, payment status, refund or dispute status, Merchant-of-Record or gateway identifier, billing country, and limited payment metadata provided by the payment provider.

We do not store full payment-card numbers or card security codes. Those details are collected and processed by the payment provider or Merchant of Record, the acquiring bank, the card network, and/or your card issuer.

2.3 Test answers, recordings, and results

Test registrations, attempts, start and completion times, your typed answers and essays, your selected multiple-choice responses, your speaking audio recordings, the text transcripts derived from those recordings, practice band scores and subscores, written feedback and highlighted corrections, time spent, integrity signals, and your progress history across attempts.

2.4 Device, log, and usage data

IP address, browser type and version, device and operating-system information, language, time zone, approximate location derived from IP, referring page, pages and features used, clicks, session identifiers, timestamps, crash and diagnostic data, and security or fraud signals.

2.5 Communications and support data

Messages, support requests, refund requests, survey responses, complaint records, and other information you choose to send us.

2.6 Cookie and similar-technology data

Identifiers and information collected through cookies, local storage, pixels, SDKs, and similar technologies, as described in Section 12.

3. How We Collect Personal Data

We collect personal data:

• directly from you when you register, purchase, take an Exam, submit a response, or contact us;
• automatically from your browser or device when you use the Service;
• from the payment provider or Merchant of Record and other payment or fraud-prevention providers;
• from a parent, guardian, school, or organization that lawfully arranges access for you; and
• from service providers that help us operate, secure, measure, and support the Service.

4. Why We Use Personal Data and Our Legal Bases

The legal basis depends on the purpose and the law that applies to you. Where the EU or UK GDPR applies, we rely on the following bases.

4.1 To perform a contract or take requested pre-contract steps

We use account, purchase, exam, and communication data to:

• create and administer your Account;
• process and confirm Orders and provide purchased access;
• deliver Exams, calculate practice scores, and provide feedback and reports;
• remember progress and maintain your exam history;
• provide support and administer refunds; and
• send essential service, security, and transaction communications.

Without necessary account, transaction, and exam data, we may not be able to provide the Service.

4.2 For our legitimate interests or those of another party

Where those interests are not overridden by your rights, we use data to:

• secure accounts, prevent fraud, enforce exam integrity, and investigate misuse;
• operate, troubleshoot, test, and improve the Service;
• understand aggregate usage and service performance;
• protect our Content, users, systems, and legal rights;
• manage business records, claims, audits, and corporate transactions; and
• provide limited marketing for similar services where law permits and you can opt out.

We consider the nature of the data, your reasonable expectations, and safeguards before relying on legitimate interests.

4.3 To comply with legal obligations

We process and retain data where necessary for tax, accounting, consumer-protection, sanctions, anti-fraud, regulatory, court-order, or other legal requirements, and to respond to lawful requests from authorities.

4.4 With your consent

Where required, we rely on consent for non-essential cookies, certain analytics or advertising, optional marketing, or processing that applicable law specifically requires to be consensual. You may withdraw consent at any time. Withdrawal does not affect processing that was lawful before withdrawal.

4.5 To protect vital interests or legal claims

In exceptional cases, we may process data to protect someone's life or safety or to establish, exercise, or defend legal claims.

5. Test Answers, Recordings, Results, and Scoring

We process your test answers, speaking recordings, transcripts, and practice results in order to deliver the test, detect technical or integrity issues, generate practice scores and written feedback, show you your own history, and improve the quality and reliability of our independent practice materials.

Speaking recordings are stored in our file storage and are linked to your attempt. A recording is transcribed to text so that the response can be assessed. Recordings, transcripts, and results are retained with your Account until you delete the attempt or your Account, or until the retention period in Section 10 ends.

Scoring may use rule-based processing, statistical methods, artificial-intelligence-assisted tools, human review, or a combination. Practice scores are educational feedback only. They are not official TOEFL scores and are not used by us to make a decision that produces legal or similarly significant effects concerning you. We do not use identifiable student responses, recordings, transcripts, or results to train general-purpose AI models, and we do not sell or license them for that purpose. Writing text and speaking transcripts are sent to OpenAI's API solely to return a suggested band and written feedback for you. OpenAI API inputs and outputs are not used to train OpenAI models by default unless the Operator separately opts in, which it has not done; OpenAI may retain limited API data under its then-current service and abuse-monitoring rules.

Where required by law, we will provide meaningful information about a scoring process and a way to ask for human review of a suspected material error. Contact support@yourtoeflprep.com and identify the relevant Exam and result.

5.1 Who can access test information?

Your test answers, speaking recordings, transcripts, practice scores and reports are private to your Account. The only exception is a teacher whose class you join yourself (see 5.2).

Teachers, tutors, coaches, schools and employers cannot see your results unless you join their class. This includes MyTOEFLCoach, the independently operated coaching service recommended on our website.

Limited internal access is possible, and only where necessary:

• Authorized platform personnel. A small number of authorized administrative accounts operated by us can access account and result records in order to run the platform: to provide support you request, investigate a reported scoring or technical fault, enforce test integrity, manage plans and billing status, and comply with law. Access is limited to the personnel who need it for those purposes and is subject to confidentiality obligations. These are our own internal operator accounts, not external teachers, and not accounts belonging to any coaching service.
• Technical service providers. The processors listed in Section 7 handle result data strictly on our instructions in order to host it, store recordings, transcribe speech, and generate AI-assisted feedback. They may not use it for their own purposes.

We do not sell your test information, and we do not publish it or use it to identify you publicly.

Do not include unnecessary sensitive information about health, religion, politics, sexuality, biometrics, criminal matters, or another person's confidential information in a response. We do not intentionally ask for those categories. If an open-ended response incidentally contains such information, we process it only as necessary to deliver and protect the Service and otherwise as permitted by law.

5.2 Teacher classes

A teacher can see your information only after you join their class and agree on screen. Before you agree, we show you what they can see: your name, email address, date of birth, gender and plan status; all your test results, including tests taken before you joined; your answers and essays; your speaking recordings while we store them; your transcripts, AI feedback, Word Quiz progress and homework.

Your teacher can give you homework, send you messages by email and in the Service, and comment on your tests. We share this information with your teacher based on your consent. You can withdraw your consent by leaving the class from Homework in your dashboard. The teacher loses access at once. Anything the teacher already downloaded or saved before you left is outside our control. Messages and comments already sent stay in your account.

Teachers are independent. They are not our employees or agents. We do not sell, schedule or take payment for their teaching. Teachers must agree to use your information only to teach you. Joining a class does not give you Premium. Some homework may use tests that need Premium; the Service tells you when a test needs it.

6. Payment Processing and Merchant of Record

Paid Orders are processed by a third-party payment provider or Merchant of Record identified at checkout. Where a Merchant of Record is used, it acts as the authorized reseller and seller for payment purposes. It independently processes payment, billing, tax, fraud, and transaction data as its own controller, under its own privacy notice, and shares limited data back with us — such as the order identifier, product, amount, payment status, billing country, and refund or dispute status — so that we can fulfill the Order, support you, and keep the records that tax and accounting law require.

The acquiring bank, the card networks, and your issuing bank also process payment credentials and transaction data for their own purposes. We receive confirmation and limited metadata, never your full card number or card security code.

The identity of the payment provider, the price, the currency, the applicable taxes, and the statement descriptor are shown at or before checkout. Where no online checkout is offered on this website, no payment data is collected here and no payment provider is engaged on your behalf.

7. How We Share Personal Data

We may share personal data with the following recipients only for legitimate purposes and subject to appropriate contractual, technical, or legal safeguards:

• Teachers whose classes you join: the teachers you choose to share with, as described in Section 5.2;
• Payment and commerce providers: the payment provider or Merchant of Record identified at checkout, acquiring banks, card networks, issuers, and fraud-prevention providers;
• Hosting and infrastructure providers: Vercel for application hosting, Supabase for authentication, database and file storage, and Cloudflare for DNS, security and human-verification services;
• Exam and scoring providers: OpenAI processes written answers, speaking recordings or transcripts, and the relevant exam rubric to provide transcription, scoring, and educational feedback;
• Analytics providers: Google Analytics 4, operated by Google, receives page-view and basic device data only from visitors who accept analytics cookies, and never receives your answers, recordings, transcripts, or practice scores;
• Email and messaging providers: Resend and Supabase for authentication and transactional email, Cloudflare Email Routing for inbound aliases, and Google Gmail for the support inbox;
• Professional advisers: lawyers, accountants, auditors, insurers, and consultants under confidentiality duties;
• Corporate transaction parties: a prospective or actual buyer, investor, lender, successor, or adviser in a merger, financing, restructuring, or sale, with appropriate protections; and
• Authorities and other parties: courts, regulators, law enforcement, consumer-protection bodies, or others where disclosure is required by law or reasonably necessary to protect rights, safety, security, and legal claims.

Service providers may use personal data only under our instructions for contracted services unless they are independently responsible for their own processing. We do not sell personal data for money. If we ever use data for targeted advertising or another activity treated as a "sale" or "sharing" under applicable law, we will provide the required notice and opt-out mechanism before doing so.

8. Aggregated and De-identified Data

We may create statistics or de-identified data that does not reasonably identify you. We may use and share it for analytics, research, security, product improvement, and business reporting. We will not attempt to re-identify data that applicable law treats as de-identified, except to test whether our de-identification measures work where legally permitted.

9. International Data Transfers

We are established in Armenia and serve users worldwide. Your personal data may be processed in Armenia and in other countries where our providers or recipients operate. Those countries may have privacy laws different from those where you live.

Where the EU, UK, or another law restricts international transfers, we use a legally recognized transfer mechanism where required. Depending on the transfer, this may include an adequacy decision, approved standard contractual clauses, a legally permitted derogation, or another valid safeguard. We also assess and apply supplementary technical or organizational measures where appropriate.

You may contact support@yourtoeflprep.com for information about the relevant transfer safeguards and, where legally available, a copy of them with confidential information removed.

10. Data Retention

We keep personal data only as long as reasonably necessary for the purposes described in this Policy, including to provide the Service, maintain exam history, comply with law, resolve disputes, prevent fraud, and enforce agreements.

Retention periods vary by category:

• Account and profile data is generally kept while the Account is active and for a reasonable period after closure to complete deletion, prevent abuse, and address claims;
• test answers, speaking recordings, transcripts, practice scores, and feedback are kept while your Account is open so that you can review your own history, and are deleted when you delete the attempt or close your Account, except where a copy must be retained briefly in backups or for an active investigation or legal claim;
• transaction, tax, refund, and accounting records are kept for the period required by Armenian and other applicable law and by the relevant Merchant of Record or payment provider;
• security, integrity, and technical logs are kept for a limited period appropriate to the risk, unless needed for an active investigation or legal claim; and
• consent and opt-out records are kept as necessary to demonstrate compliance.

When retention is no longer necessary, we delete, anonymize, or securely isolate the data unless continued storage is required by law. Backup copies may persist for a limited cycle and are protected from ordinary use until overwritten.

11. Security

We use reasonable administrative, technical, and organizational safeguards appropriate to the nature and risk of the data. These may include access controls, least-privilege permissions, encryption in transit, password hashing, logging, backups, vulnerability management, vendor review, staff confidentiality, and incident-response procedures.

No online service is completely secure. You are responsible for using a strong unique password, protecting your device, and notifying us promptly of suspected unauthorized access. Do not send full card details or passwords by email.

If a personal-data breach occurs, we will investigate, mitigate harm, and notify affected individuals and authorities when applicable law requires it.

12. Cookies, Local Storage, and Similar Technologies

The Service uses technologies needed to operate, secure, and remember the Service. These include Supabase authentication storage, browser local storage and IndexedDB for session state, preferences, exam progress, and resilient local copies, and Cloudflare Turnstile signals used to prevent automated abuse. These are strictly necessary and are not optional.

We also use Google Analytics 4 to understand which pages and practice tests are used, so we can improve them. This is optional, and it is switched off until you choose otherwise: the Google Analytics tag is not loaded and its cookies are not set unless you accept analytics cookies in our cookie banner. Declining changes nothing about how the Service works.

Google Analytics receives page addresses, referring page, approximate location derived from a truncated IP address, and basic device and browser information. It does not receive your answers, recordings, transcripts, practice scores, or reports. Before any address is reported we remove URL fragments and every query parameter except campaign-attribution tags, and analytics is switched off entirely on pages that carry a sign-in or password-reset link, so authentication tokens are never transmitted. IP anonymization is enabled, advertising and remarketing features are disabled, and we do not use Google Analytics data for advertising or share it with advertising networks. Google processes this data as described in its own privacy documentation and retains it under the retention period configured on our property. Data may be processed outside your country, including in the United States, under the transfer safeguards described in this Policy.

Your choice is stored on your device and applies until you change it. You can change or withdraw it at any time using the Cookie settings link in the site footer, which reopens the banner; withdrawing consent clears the Google Analytics cookies this site set. Withdrawal is as easy as consent and has no effect on your account or results.

We do not use advertising cookies, cross-site behavioral advertising, or any other non-essential technology beyond the analytics described above. If we introduce one, we will update this Policy and provide any notice and choice required by applicable law before activating it.

You can clear browser storage or block cookies through your browser, but doing so may sign you out, remove locally saved progress, or prevent security and account features from working.

13. Your Privacy Rights

Subject to applicable law and exceptions, you may have the right to:

• obtain confirmation of whether we process your personal data and access a copy;
• correct inaccurate or incomplete data;
• request deletion;
• restrict processing;
• object to processing based on legitimate interests or to direct marketing;
• receive data you provided in a structured, commonly used, machine-readable format and transmit it to another controller;
• withdraw consent at any time;
• request information about international-transfer safeguards;
• obtain human review and express your view where a qualifying solely automated decision has legal or similarly significant effects; and
• complain to a competent data-protection or consumer-protection authority.

To exercise a right, email support@yourtoeflprep.com with the subject "Privacy Request." Describe your request and the Account email concerned. We may ask for proportionate information to verify identity and authority. We will respond within the period required by applicable law and explain any lawful refusal or extension.

You may use an authorized agent where local law permits. We will not discriminate against you for exercising a privacy right. A request to delete data may result in Account closure or loss of exam history where the data is necessary to provide the Service. We may retain limited data despite a request where law permits or requires it.

For data processed independently by a payment provider, a Merchant of Record, or an independently operated service you contacted through a link on our website, you may need to submit the request directly to that party. We will reasonably assist where the law requires.

EU and EEA complaints

If the EU GDPR applies, you may complain to the supervisory authority in the EU or EEA country of your habitual residence, place of work, or the alleged infringement. We encourage you to contact us first so we can try to resolve the concern.

Armenia complaints

You may also have the right to contact the competent Armenian personal-data-protection authority or seek another remedy under the Law of the Republic of Armenia on Protection of Personal Data.

14. Children's Privacy

The Service is not intended for children under 16, and we do not knowingly permit them to create their own Accounts. A student who is 16 or 17, or otherwise below the legal age of majority where they live, must use the Service with the authorization and supervision required by our Terms of Service and local law.

If we later offer a parent-managed or school-managed service for younger students, we will provide any additional notice and obtain any verifiable parental, guardian, or institutional authorization required before collecting their data.

If you believe a child below the permitted age provided personal data without valid authorization, contact support@yourtoeflprep.com. We will investigate and delete or otherwise handle the data as required by law.

15. Email and Marketing Choices

We send service messages needed for your Account, Orders, Exams, security, and policy changes. You generally cannot opt out of essential messages while keeping an active Account.

We send promotional email only where permitted. You may unsubscribe through the link in a marketing message or by contacting support@yourtoeflprep.com. Opting out of marketing does not stop essential service communications.

16. External Links and External Coaching Links

The Service may link to websites or services we do not control. Their privacy practices are governed by their own notices. Review those notices before providing data.

16.1 External coaching links

Our website recommends MyTOEFLCoach, an independently operated coaching service run by an external TOEFL coach. We do not provide, sell, schedule, or process payments for coaching.

The link is a plain link to the coach's own website. No personal data is attached to it. We do not append your name, email address, Account identifier, attempt identifiers, practice scores, or any other information to the link or to its query string, and we do not send the coach any notification that you clicked it.

We do not share your Account information, answers, recordings, transcripts, practice scores, or reports with the coach, and the coach has no access to the Service's data unless you join that coach's class using the class feature (see 5.2).

If you decide to contact the coach, you leave our website. Anything you then send the coach — your name, contact details, goals, or any results you choose to forward yourself — is collected by the coach as an independent controller, under the coach's own privacy practices, not ours. We are not responsible for that processing.

17. Changes to This Policy

We may update this Policy to reflect changes in law, technology, providers, or our practices. We will post the revised version with a new effective date. If a change is material, we will provide additional notice or obtain consent where required by law.

18. Contact Us

For privacy questions or requests:

Dallakyan Tigran Suren

Armenian TIN: 73046309

Registered address: 29 Gyulbenkyan Street, Apt. 13, Yerevan, Armenia

Website: https://www.yourtoeflprep.com

Privacy and support email: support@yourtoeflprep.com