Privacy Policy

Who We Are

Practly is operated by Tryfifty Canada inc. (legal name in French: Cinquante essais Canada inc.) ("Practly," "we," "us," or "our"), a company incorporated under the laws of Quebec, Canada.

Contact information

• Mailing address: 200-6666 Saint-Urbain Street, Montreal, Quebec H2S 3H1, Canada
• Email for privacy inquiries: privacy@practly.io
• General contact: hello@practly.io
• Website: https://practly.io

Person in charge of the protection of personal information (Privacy Officer)

In accordance with Quebec's Act respecting the protection of personal information in the private sector (Law 25) and Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), we have designated a Privacy Officer responsible for our compliance with applicable privacy laws.

You may contact our Privacy Officer at privacy@practly.io to:

• Exercise your rights under this Privacy Policy
• Submit questions about how we handle your personal information
• File a complaint about our privacy practices

Conformément à la Loi 25, nous avons désigné un responsable de la protection des renseignements personnels.

Information We Collect

We collect personal information in the following categories. We have organized this section by how we collect the information so you can clearly understand what we receive from you and what we observe automatically.

2.1 Information you provide directly

Account information (required when you sign up)

• Email address
• Password (stored in cryptographically hashed form; we never see or store your actual password)

Profile information (collected during onboarding)

• Display name (required)
• The English proficiency test you are preparing for (e.g., CELPIP, IELTS) — required
• Target score (optional)
• Target test date (optional)
• Past test scores (optional)
• Current English proficiency level (CLB level) (optional)

Subscription and payment information (when you subscribe to a paid plan)

• Billing name
• Billing address (country, postal code as required for tax calculation)
• Payment method information is collected and processed directly by Stripe, our payment processor. We do not store your full credit card number on our servers. We receive only the last four digits, card type, and expiration date for your records.

Communications

• Messages you send to our support team
• Feedback you submit through our product

2.2 Information you create while using Practly

This is the core of what makes Practly work. When you use our tutoring service, we collect:

Writing samples

• Essays you submit for evaluation
• Short responses you write during exercises (e.g., fill-in-the-blank answers, error identification responses, sentence rewrites)
• Any text you type during interactive dialogue with our AI tutor

Learning interactions

• Your responses to exercises and the AI tutor
• Conversation logs between you and the AI tutor
• Time spent on each session, exercise, and paragraph
• Errors identified in your writing
• Your progress and learning history across sessions

2.3 Information collected automatically

When you use Practly, we and our service providers automatically collect limited technical information necessary to operate the service:

Technical information

• IP address (used to detect approximate location for fraud prevention and tax determination; not used to track you across the web)
• Browser type and version
• Device type and operating system
• Time zone

Usage information (limited to what is necessary to operate the service)

• Pages and features you access
• Session duration
• Authentication events (login, logout)
• Errors encountered while using the product (collected through our error monitoring tool, with personal information automatically scrubbed before transmission)

Analytics

We do not currently use third-party web analytics tools. If we add analytics tools in the future, we will update this Privacy Policy and, where required, request appropriate consent.

Cookies and similar technologies

We use a minimal set of cookies and similar technologies necessary to operate the service (such as keeping you logged in and remembering your preferences). For details, see §11 Cookies and Similar Technologies.

2.4 Information from third parties

We receive limited information from:

• Stripe (our payment processor): payment confirmation, subscription status, last four digits of payment method, card type, expiration date
• Google (if you sign in via Google SSO): your email address and basic profile information that you authorize Google to share

We do not purchase personal information from data brokers. We do not receive personal information from social media platforms beyond what you explicitly authorize when using SSO.

Purposes of Processing

We process your personal information for the purposes described below. The table also shows the legal basis for each processing activity and whether you can decline that processing.

Notes on this table

• "Anonymized" means we remove identifying information before using your writing samples for purpose #7. However, please be aware that writing content itself may sometimes contain personal references; we make commercially reasonable efforts to remove or obscure such references but cannot guarantee complete anonymization in all cases.
• Aggregated data used for purpose #6 means data combined across many users in a way that does not identify any individual user.
• "Performance of contract" and "Legal obligation" purposes cannot be declined while you continue using Practly.
• "Legitimate interest" purposes (#5 and #6) involve our assessment that the processing is necessary for legitimate business reasons and does not unreasonably affect your rights. You may object to processing under purpose #6 by contacting privacy@practly.io.
• "Consent" purposes (#7 and #9) are entirely optional. Declining or withdrawing consent does not affect your access to Practly's features.

Legal Basis for Processing

For users in the European Economic Area (EEA), the United Kingdom, and Quebec, applicable privacy laws require us to identify a legal basis for each processing activity. We rely on the following legal bases:

(a) Performance of a contract (GDPR Art. 6(1)(b)) — when processing is necessary to provide the Practly service you signed up for. This applies to purposes #1, #2, #3, and #4 in §3.

(b) Legitimate interests (GDPR Art. 6(1)(f)) — when we have a legitimate business interest that is not overridden by your rights and freedoms. We use this basis only for purposes #5 (security and fraud prevention) and #6 (aggregate product analytics). For each such purpose, we have assessed that our interest is proportionate and that the processing does not unreasonably affect your rights. You can request information about these assessments by contacting privacy@practly.io.

(c) Consent (GDPR Art. 6(1)(a)) — when you give us specific, informed, and freely given consent. This applies to purposes #7 (using anonymized data to improve Practly) and #9 (marketing communications). You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

(d) Legal obligation (GDPR Art. 6(1)(c)) — when processing is necessary to comply with applicable law. This applies to purpose #8.

For users outside the regions above, equivalent legal bases under your local law apply.

Subprocessors

Practly uses the following third-party service providers ("subprocessors") to deliver our service. We have entered into data processing agreements with each of them that contractually require them to protect your personal information.

Updates to this list

We may update our list of subprocessors as our service evolves. We will provide notice of material changes by updating this Privacy Policy. For users who have requested notification of subprocessor changes (typically business customers under a data processing agreement), we will provide advance notice as agreed.

If you are an EEA, UK, or Quebec resident and would like more information about the specific data processing agreements we have with each subprocessor, please contact privacy@practly.io.

International Data Transfers

Practly is a Canadian company headquartered in Quebec, but our service infrastructure and our subprocessors are located in the United States. This means that when you use Practly, your personal information is transferred to and processed in the United States.

Why we transfer your data internationally

We transfer data to the United States because:

• Our hosting infrastructure (AWS) operates from data centers in the United States
• The AI providers we rely on (Anthropic, OpenAI) operate from the United States
• Several of our other operational service providers are based in the United States (see §5)

What this means for your rights

The United States has different privacy laws than Canada, the European Economic Area, the United Kingdom, or South Korea. U.S. authorities may, in certain circumstances, request access to data held by U.S. companies under U.S. legal processes. While we contractually require our subprocessors to protect your data, we cannot guarantee that U.S. legal processes will not apply to data held in the U.S.

Safeguards we have in place

To protect your information when it is transferred internationally:

• We enter into data processing agreements with each subprocessor that contractually require them to protect your personal information.
• We use encryption in transit (TLS 1.2 or higher) and at rest (AES-256).
• We limit access to your data to authorized personnel and systems with a legitimate need.
• Where applicable, we rely on subprocessors' certification under the EU-U.S. Data Privacy Framework or equivalent transfer mechanisms.

Your consent to international transfer

By signing up for Practly and using our service, you acknowledge and consent to the transfer of your personal information to the United States, as described in this Privacy Policy.

If you do not consent to your data being transferred to and processed in the United States, you should not use Practly. Our infrastructure is U.S.-based and we cannot offer the service from any other region at this time.

Retention Periods

We keep your personal information only for as long as necessary for the purposes described in this Privacy Policy, or for a longer period if required by law. The retention period depends on the type of information.

Backups

We maintain encrypted backups of our systems for disaster recovery purposes. Backups are automatically rotated by our infrastructure provider on a rolling basis (typically within 30 days). When you request deletion of your data, the data is removed from our active systems immediately, and is removed from backups during the next rotation cycle.

Legal holds

If we are required to preserve specific information for legal or regulatory reasons (for example, an active investigation or a legal dispute), we may retain that information for the duration of the legal hold, even if the retention period above has passed.

Account deletion

You can delete your account at any time using the account deletion feature in your account settings. After you delete your account:

• Your account information and writing samples are removed from our active systems within 30 days
• Subscription and payment records are retained for the legal retention period above
• Backups are rotated as described in the Backups section above

If you encounter any issue using the account deletion feature, you can also contact us at privacy@practly.io.

Your Rights

You have rights regarding your personal information. The specific rights available to you depend on your location, but we extend the rights described below to all users where reasonably possible, regardless of where you live.

Your rights

(a) Right to access — You can request a copy of the personal information we hold about you, along with information about how we process it.

(b) Right to correct — You can request that we correct inaccurate or incomplete information. You can also update most profile information directly in your account settings.

(c) Right to delete — You can request that we delete your account and the personal information we hold about you. Some information may be retained for legal reasons (see §7).

(d) Right to data portability — You can request a copy of your personal information in a structured, commonly used, machine-readable format (such as JSON), and request that we transfer it to another service provider where technically feasible.

(e) Right to withdraw consent — Where we process your data based on your consent (purposes #7 and #9 in §3), you can withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

(f) Right to object — You can object to processing based on our legitimate interests (purposes #5 and #6 in §3) by contacting us. We will assess your objection and respond accordingly.

(g) Right to restrict processing — You can request that we restrict the processing of your personal information in certain circumstances, such as while we verify the accuracy of your data after you contest it.

(h) Right to lodge a complaint — You can file a complaint with your local privacy authority (see §13).

(i) Right to designate a person to receive your information after death (Quebec residents only, under Law 25) — You can designate a person to receive a copy of your personal information after your death by contacting us.

How to exercise your rights

To exercise any of the rights above, contact us at privacy@practly.io. Please include:

• The right you wish to exercise
• Enough information for us to identify your account (typically the email address you signed up with)
• Any specific details relevant to your request

Our response

We will respond to your request within 30 days. If your request is complex or we receive a high volume of requests, we may extend this period by an additional 30 days and notify you of the extension.

We may need to verify your identity before processing certain requests, particularly requests for access or deletion. We will not charge a fee for handling your request unless your request is manifestly unfounded or excessive (for example, repeated identical requests).

If we refuse your request, we will explain the reason and inform you of your right to lodge a complaint with a privacy authority.

Limitations

In some cases, we may not be able to fulfill your request fully, for example:

• We may need to retain certain information to comply with legal obligations (such as tax records)
• We may not be able to delete information from completed AI processing operations performed by our subprocessors before the request was made
• We may decline to disclose information that would reveal personal information about another person

Automated Decision-Making

Practly is an AI-powered tutoring service. We use automated systems to deliver personalized learning, including:

• Identifying errors in your writing (grammar, vocabulary, structure, and other categories)
• Estimating your performance level for practice purposes (such as approximate CLB or test-style score estimates)
• Selecting and adapting exercises based on your error patterns and proficiency level
• Generating tutoring dialogue through Socratic questions, explanations, and feedback
• Tracking your progress across sessions and adapting future learning paths accordingly

These automated processes are performed by Practly's systems and by the AI providers listed in §5 (Anthropic and OpenAI).

What this means

The automated outputs Practly provides are for educational and practice purposes only. Specifically:

• Practly's score estimates are not official test scores. They are intended to help you understand your current level and track your improvement during practice. They are not produced or endorsed by any official testing organization, and they may differ from the scores you receive on an actual test.
• Practly's outputs do not produce legal effects and do not significantly affect you in ways that would trigger heightened protections under applicable laws (such as Quebec's Law 25 §12.1 or GDPR Article 22). Our outputs do not affect your eligibility to take any test, your immigration status, your employment, or any legal right.
• Your test outcomes depend on many factors beyond Practly. Real test performance is influenced by test-day conditions, the specific test version, individual variability, and other factors that no preparation tool can fully predict.

About AI errors

AI systems can make mistakes. Practly's outputs may sometimes contain errors, including:

• Incorrect identification of errors in your writing (false positives or false negatives)
• Inaccurate explanations of grammar or vocabulary rules
• Misinterpretation of what you intended to write
• Inconsistent feedback across sessions

We work continuously to improve the accuracy of our system. If you notice an error in our feedback, you can let us know at hello@practly.io.

CELPIP and other test names

Practly is not affiliated with, endorsed by, or sponsored by Paragon Testing Enterprises (the operator of CELPIP), the British Council, IDP, Cambridge Assessment, or any other testing organization. References to specific tests are for descriptive purposes only and do not imply any partnership or endorsement.

Questions about automated outputs

If you have questions or concerns about an automated output you received from Practly, you can contact us at hello@practly.io.

Security

We take reasonable measures to protect your personal information from unauthorized access, disclosure, alteration, and destruction.

Technical safeguards

• Encryption in transit: All data exchanged between your device and Practly is encrypted using TLS 1.2 or higher.
• Encryption at rest: Data stored in our infrastructure is encrypted using industry-standard encryption (AES-256 or equivalent).
• Password protection: Your password is stored only as a cryptographic hash, never in readable form.
• Access controls: We limit access to personal information to authorized personnel and systems with a legitimate need.
• Subprocessor security: We work with subprocessors (see §5) that maintain industry-standard security practices.

Organizational safeguards

• We follow the principle of data minimization, collecting only the information we need.
• We review our security practices periodically and update them as our service evolves.

Limitations

No method of transmission over the internet or electronic storage is completely secure. While we use commercially reasonable measures to protect your personal information, we cannot guarantee its absolute security. You are responsible for keeping your account credentials confidential and for notifying us promptly if you suspect unauthorized access to your account.

Data breaches

If we become aware of a security incident that affects your personal information, we will notify you and the relevant authorities as required by applicable law (typically within 72 hours of becoming aware of the incident, where such notification is required).

Cookies and Similar Technologies

We use a minimal set of cookies and similar technologies that are necessary to operate our service.

What we use

Strictly necessary cookies — These are required for our service to function and cannot be disabled in our system. They are typically set in response to actions you take, such as logging in or filling out forms.

Local storage — We use browser local storage to remember your preferences (such as language and display settings) on your device. This information stays on your device and is not transmitted to our servers.

What we don't use

We do not currently use:

• Analytics cookies (such as Google Analytics)
• Advertising cookies or tracking pixels
• Third-party cookies for cross-site tracking

If we add any of these in the future, we will update this Privacy Policy and request appropriate consent before activating them.

Managing cookies

You can control cookies through your browser settings. Most browsers allow you to:

• View what cookies are stored
• Delete some or all cookies
• Block cookies from specific websites
• Block all cookies

Note that disabling strictly necessary cookies may prevent you from using parts of Practly (for example, you may not be able to log in).

Children's Privacy

Practly is not intended for use by individuals under the age of 16. We do not knowingly collect personal information from anyone under 16.

Age requirement

By signing up for Practly, you confirm that you are at least 16 years old. We require this minimum age regardless of your jurisdiction, even where local law would permit a younger age of digital consent.

If we discover an underage user

If we become aware that we have collected personal information from a person under 16, we will:

• Suspend the account
• Delete the personal information collected
• Notify the user that the account has been closed

Reporting concerns

If you are a parent, guardian, or other person who believes that a person under 16 has provided personal information to Practly, please contact us at privacy@practly.io. We will investigate and take appropriate action.

Contact and Complaints

How to contact us

For questions about this Privacy Policy or how we handle your personal information, contact us:

We will respond to inquiries within 30 days.

How to file a complaint with a privacy authority

If you have concerns about how we handle your personal information that we have not addressed to your satisfaction, you have the right to file a complaint with a privacy regulator.

We encourage you to contact us first so we have an opportunity to address your concerns directly. However, you have the right to file a complaint at any time.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by:

• Updating the "Last Updated" date at the top of this Privacy Policy
• For significant changes, sending an email to your registered email address at least 30 days before the changes take effect
• For changes that require your consent, requesting renewed consent before the changes apply to you

The current version of this Privacy Policy is always available at https://practly.io/privacy.