Privacy Policy
This policy explains what personal data Still Brewing collects when you use stillbrewing.school or take part in our programs — including the 28-Day Speaking Sprint — why we collect it, who we share it with, and the rights you have over it.
1. Who is responsible for your data
The data controller for this website and our programs is Still Brewing, operating as FOP Yepanova Oleksandra Mykhaylyvna, based in Kyiv, Ukraine.
You can reach us about anything in this policy at contact@stillbrewing.school.
We have not appointed a Data Protection Officer, as we are not required to under Article 37 GDPR.
2. What we collect and why
| What | Why | Legal basis | Kept for |
|---|---|---|---|
| Name, email address and anything else you type into our enquiry or level-check forms | To reply to you, arrange a free call, and assess your English level | Article 6(1)(b) — steps taken at your request before entering a contract | 24 months after our last contact |
| Email correspondence | To answer your questions and keep a record of what was agreed | Article 6(1)(b) and 6(1)(f) — our legitimate interest in keeping business records | 24 months after our last contact |
| Your answers on our free fluency check page — the options you tap (why you need English, the conversation you find hardest, when you’re usually free, your guess), the questions you ask your tutor there and how far you got. No name or email; your approximate country only. If you book, they are linked to your booking. | To prepare your free call, and to understand what our visitors need so we can improve the check and the Sprint | Article 6(1)(f) — our legitimate interest in preparing your call and improving our service | 12 months |
| Booking details when you schedule a call | To hold the appointment and send you the joining link | Article 6(1)(b) | 24 months |
| Fluency check voice messages (Speaking Sprint) — the voice messages you send us via WhatsApp at the start, middle, and end of your cohort | To measure your spoken English, set your personal improvement targets, and show you your progress | Article 6(1)(b) — performance of our contract with you | We download a working copy to analyse and delete it within 2 months of your cohort ending. The message itself stays in WhatsApp under WhatsApp’s own retention — see Section 3. |
| Your phone number, once you join a cohort | To add you to your cohort’s WhatsApp group and send you session links | Article 6(1)(b) | Removed from the group within 30 days after your cohort ends |
| Analytics data — pages viewed, approximate location (country/city level), device and browser, referring site | To understand which pages are useful and improve the site | Article 6(1)(a) — your consent, given through the cookie banner. No analytics cookies are set unless you accept. | 14 months |
| Your cookie choice itself | To remember what you agreed to, and to prove it if asked | Article 6(1)(c) — our legal obligation to demonstrate consent | 12 months |
| Payment records — amount, currency, date, transaction reference, the last four digits of your card, and the name and email you gave at checkout | To take payment for your lessons, run billing, issue refunds and keep our accounts | Article 6(1)(b) — performance of our contract with you — and Article 6(1)(c) for the accounting records | 3 years, per Ukrainian tax and accounting law |
| Server logs, including IP address | Security, abuse prevention, and keeping the site online | Article 6(1)(f) — legitimate interest in a secure service | Short-term, per our hosting provider’s defaults |
We do not ask for special category data (health, beliefs, and so on). Please do not send it to us in a form, an email, or a fluency-check recording.
3. About the fluency check voice messages specifically
If you join the Speaking Sprint, you’ll send short voice messages over WhatsApp so we can measure how you speak — not what you say. We (and, for scoring, tools we use to analyse speech) listen for things like your pace and how often you pause or restart — we’re not evaluating the content or opinions in what you say.
We download a copy of each voice message to analyse it, and delete our downloaded copy within 2 months of your cohort ending. The voice message you sent also remains in the WhatsApp chat itself — that copy is subject to WhatsApp’s own retention and isn’t something we control or can delete on your behalf. If you’d like it removed from WhatsApp too, you can delete it from the chat yourself, on your side and ours where WhatsApp allows it.
We do not record live sessions. If you miss a session, see our Refund and Cancellation Policy for what’s available to you instead.
4. Who we share it with
We do not sell your data and we do not share it for advertising. We use the following providers, who process data on our instructions:
- Google Ireland Ltd / Google LLC — Google Analytics 4, for website statistics. Only ever with your consent. We also use Google for scheduling and running free introductory calls.
- Usercentrics A/S (Cookiebot) — the consent banner and the record of your cookie choice.
- Cloudflare, Inc. — hosting and serving the site, and keeping short-term security logs. Our domain is registered through Vercel Inc., which handles the domain and its DNS.
- Google Workspace — carrying email between you and us.
- WayForPay — taking card payments and handling billing. They are the ones who receive your card details, as a payment processor in their own right, not on our instructions.
- WhatsApp (Meta) — if you join a Speaking Sprint or monthly-plan cohort, your phone number is used to add you to a WhatsApp group for that cohort, and it’s also where you send your fluency-check voice messages. WhatsApp processes messages under its own terms as an independent controller once you’re in the group — we don’t control how long WhatsApp itself keeps a copy.
We may also disclose data where we are legally required to, for example in response to a valid order from a public authority.
Payments for lessons are taken through WayForPay (LLC “WAYFORPAY”, Ukraine), our payment gateway. Your card details are entered on WayForPay’s own secure page and go straight to them — we never see, receive or store your card number. WayForPay passes back only what we need to recognise the payment: the amount, the currency, whether it succeeded, a transaction reference and the last four digits of the card. We keep our payment records for the period Ukrainian tax and accounting law requires, currently three years.
5. Transfers outside the EEA
Some of the providers above are based in, or store data in, the United States. Where data leaves the European Economic Area, it is protected by the European Commission’s Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework.
We keep this to a minimum: our fonts are self-hosted rather than loaded from Google Fonts, so simply reading this site does not send your IP address to a font CDN.
6. Cookies
Nothing but strictly necessary storage is placed on your device until you choose. Analytics runs in a consent-aware mode: before you accept, Google Analytics writes no cookies and no identifiers at all.
The full, automatically maintained list of cookies is on our Cookie Policy page, where you can also change or withdraw your choice at any time.
7. Your rights
Under the GDPR you have the right to:
- ask for a copy of the personal data we hold about you, including our downloaded copies of your fluency-check voice messages;
- have inaccurate data corrected;
- have your data deleted, where we have no overriding reason to keep it;
- ask us to restrict how we use it;
- receive it in a portable, machine-readable format;
- object to processing we base on legitimate interests;
- withdraw your consent at any time — this is as easy as giving it, via the link, and withdrawing does not affect anything done beforehand.
Email contact@stillbrewing.school and we will respond within one month.
If you are unhappy with how we have handled your data, you can complain to your national data protection authority. In Ukraine, where we are based, that is the Ukrainian Parliament Commissioner for Human Rights (the Ombudsman), who supervises personal data protection. If you are in the EEA, you may instead complain to the supervisory authority where you live or work.
8. Children
This site and our programs are aimed at adults. We do not knowingly collect data from children under 16. If you believe a child has sent us personal data, tell us and we will delete it.
9. Changes to this policy
If we change how we use your data, we will update this page and revise the date at the top. Where the change is significant, we will ask for your consent again.