Privacy Policy

This policy explains how personal data is handled when you use testlyn.com and the Testlyn apps (the "Service"). It applies to teachers, center staff, students, parents and tutors.

1. Who is responsible

2. What we collect

We do not collect card numbers (Stripe does), and we do not ask for health data, religion, political opinions, biometric templates or precise location. Identity documents and selfies for verification are processed by the verification provider; we keep only the result.

3. Why we use it and our legal basis

We do not sell personal data, do not share it for cross-context behavioural advertising, and never advertise to students. Students who joined through a teacher's class receive no marketing from Testlyn.

4. AI processing

Writing and speaking submissions are sent to AI and speech-assessment providers to produce scores and feedback. Only the content of the submission and the task are sent, not your name or email. Under our agreements these providers do not use the content to train their models. Automated scores are estimates; teachers can review them, and you can ask for a human review by writing to us. We do not make decisions with legal or similarly significant effects about you solely by automated means.

5. Who receives your data

All service providers act on our instructions under contracts that require confidentiality and security. If Testlyn is sold or merged, data may pass to the successor under this policy, and we will tell you.

6. International transfers

Data is processed outside the country where you live, including in the United States, Singapore and Vietnam.

• From the EU, EEA, UK and Switzerland: we rely on the European Commission's standard contractual clauses (and the UK addendum) or an adequacy decision.
• From Vietnam: transfers are made under the Law on Personal Data Protection No. 91/2025/QH15 and Decree No. 356/2025/ND-CP. Testlyn LLC and 8020 English keep the cross-border transfer records the law requires, and submit them to the competent authority where the law requires.

7. How long we keep data

8. Children

• Testlyn is designed for adult learners, teachers and parents. Children under 18 use the Service through a parent's account or a teacher's class; see Parental Consent.
• United States: we do not knowingly collect personal information from a child under 13 without verifiable parental consent. A parent paying for a child's lesson by card gives that consent. We collect only what is needed for the lessons, never condition participation on more data, never use it for advertising, and delete it on request.
• Vietnam: for a child aged 7 or older, both the child and a parent or guardian must consent to processing of the child's data, and the parent or guardian exercises the child's rights.
• EU, EEA and UK: a child under 16 (or the lower age set in your country) uses the Service only with parental consent.
• If we learn we hold a child's data without the required consent, we delete it.

9. Security

We use encryption in transit, database row-level access rules so that each record is visible only to its owner, the relevant teacher or center, or the other side of a booking, restricted and logged staff access, separate secrets for payment systems, and regular backups. We maintain a written information security programme and review it at least yearly. If a personal data breach is likely to harm you, we tell you and the competent authority within the time the law requires (72 hours under the EU GDPR).

10. Your rights

Depending on where you live, you have the right to:

• know how your data is processed and get a copy;
• correct inaccurate data;
• delete data, or restrict or object to processing;
• withdraw consent at any time, without affecting processing before withdrawal;
• receive your data in a portable format;
• complain to a supervisory authority.

Residents of Vietnam have the rights in Article 4 of Law 91/2025/QH15. Residents of California have the right to know, delete, correct and opt out of sale or sharing (we do not sell or share), and not to be discriminated against for using these rights. Residents of the EU, EEA and UK may complain to their data protection authority.

To use any right, email [email protected] from your account email, or ask a parent to do so for a child. We may ask you to confirm your identity. We answer within 30 days, or sooner where the law of your country sets a shorter period. Teachers can export and delete class data themselves in Teach. Requests about data a center controls are passed to that center.

11. Cookies and similar technologies

We do not use advertising cookies.

12. Changes

We publish changes on this page with a new version number and date, and email account holders before material changes take effect. Past versions are available on request.

13. Contact

Testlyn LLC · [email protected] · 30 N Gould St Ste N, Sheridan, WY 82801, USA. For data held by 8020 English: Công ty TNHH Ngoại Ngữ 8020, 171/1 Cô Bắc, Ho Chi Minh City, Vietnam.