Privacy Policy

The data controller for personal data processed through Artful English Studio is Eleni Konstantelou, trading as Teaching Rascals, Λάδωνος 5, Βριλήσσια 152 35, Greece (ΑΦΜ: 135358098). Contact: hello@teachingrascals.com.

This Privacy Policy explains what personal data we collect, why we collect it, how we use it, who we share it with, and what rights you have under the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and applicable Greek law.

Account data

When you register, we collect your email address and, where provided, your full name. This data is necessary to create and manage your account, authenticate you, and communicate with you about the Service. Legal basis: performance of a contract (Article 6(1)(b) GDPR).

Payment and billing data

When you make a purchase, you provide your full name, billing address, and, optionally, a VAT or tax identification number. This information is processed by Stripe on our behalf. We receive a transaction record from Stripe but never see or store your card number. Billing details are retained for 7 years to meet Greek and EU tax obligations. Legal basis: legal obligation (Article 6(1)(c) GDPR) and performance of a contract (Article 6(1)(b) GDPR).

Usage data

We record the number of lessons you have generated and whether your account is within the free or paid tier. We do not track individual keystrokes, browsing behaviour outside the Service, or usage patterns beyond what is necessary to operate the lesson counter and enforce license limits. Legal basis: legitimate interests (Article 6(1)(f) GDPR).

Saved lessons

If you save lessons, they are stored in your account. This data is held on your behalf and used solely to provide the save-and-reopen functionality. Legal basis: performance of a contract (Article 6(1)(b) GDPR).

Problem reports

If you submit a problem report, we collect the content of the report and your email address to follow up if necessary. Legal basis: legitimate interests (Article 6(1)(f) GDPR).

Checkout consent records

When you purchase, we record your consent to immediate supply and the timestamp of your first lesson download, to administer the right of withdrawal. Legal basis: legal obligation (Article 6(1)(c)) and performance of a contract (Article 6(1)(b)). Retained with billing records for 7 years.

Waitlist

If you join the waitlist, we store your email address and chosen plan until places open or you ask to be removed. Legal basis: consent (Article 6(1)(a)).

Marketing communications (optional)

If you opted in at registration, we send the monthly Artful English drop: a newsletter with free resources, new artworks, and teaching ideas. This is strictly opt-in. You can unsubscribe at any time by clicking the unsubscribe link in any email we send. Legal basis: consent (Article 6(1)(a) GDPR).

• To create and manage your account and authenticate you when you sign in.
• To generate lessons and apply the correct usage limits for your tier.
• To process payments and issue receipts and invoices as required by law.
• To respond to support requests and problem reports.
• To send transactional emails about your account (password resets, account confirmations).
• To send the monthly Artful English drop, where you have given consent.
• To comply with our legal and tax obligations under Greek and EU law.

We do not use your data for advertising, profiling, or automated individual decision-making that produces legal or similarly significant effects.

We share your data only with the following processors, each operating under a Data Processing Agreement:

• Stripe, Inc.: payment processing. Data is processed in the US under Stripe's EU Standard Contractual Clauses.
• Supabase, Inc.: secure cloud database for account and lesson data. Data is stored in EU-region servers.
• MailerLite: email marketing platform, used only for the opt-in monthly newsletter.
• Google (Gemini API): lesson content generation. Prompts and generated outputs are transmitted to Google's API. We do not send personally identifiable information within lesson generation requests.

We do not sell, rent, or trade your personal data to any third party. We do not share your data with advertisers.

Some of our processors (Stripe, MailerLite, Google) may process data outside the European Economic Area. Where this occurs, we rely on Standard Contractual Clauses approved by the European Commission, or other appropriate safeguards, to ensure that your data receives an equivalent level of protection.

• Account data: retained while your account is active and for 2 years after account deletion, unless a longer retention period is required by law.
• Payment and billing records: retained for 7 years from the date of the transaction, as required by Greek tax law (Law 4308/2014).
• Saved lessons: retained until you delete them or close your account.
• Problem reports: retained for up to 2 years for quality and safety purposes.
• Marketing data: retained until you withdraw consent.

You have the following rights in relation to your personal data:

• Right of access: to obtain a copy of the personal data we hold about you.
• Right to rectification: to have inaccurate data corrected.
• Right to erasure: to request deletion of your data, subject to legal retention obligations.
• Right to restriction: to ask us to restrict processing in certain circumstances.
• Right to data portability: to receive your data in a structured, machine-readable format.
• Right to object: to object to processing based on legitimate interests.
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, email hello@teachingrascals.com. We will respond within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA) at www.dpa.gr, or with the data protection authority in your country of residence.

We use session cookies that are strictly necessary for login and authentication. We do not use advertising cookies, tracking pixels, or third-party analytics that monitor your behaviour across the web. No consent banner is required for functional cookies under the ePrivacy Directive.

The Service is not directed at persons under 18. We do not knowingly collect personal data from children. If you believe a child has registered an account, please contact hello@teachingrascals.com and we will delete the account promptly.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These include encrypted data transmission (HTTPS), access controls, and secure cloud storage. No transmission over the internet is completely secure; we cannot guarantee absolute security.

We may update this Privacy Policy from time to time. We will notify registered users of material changes by email and by updating the effective date at the top of this page. Continued use of the Service after notice of changes constitutes acceptance of the revised policy.

Data Controller: Eleni Konstantelou, trading as Teaching Rascals, Λάδωνος 5, Βριλήσσια 152 35, Greece. Email: hello@teachingrascals.com.