Engible — Privacy Policy
Last updated: 28 August 2026
Engible ("Engible", "we", "us") is an online tool that turns YouTube videos into interactive English lessons. This policy explains what personal data we process, why, and what rights you have.
In this policy, "tutor" means a person who creates an account and uses Engible; "student" means a person to whom a tutor sends an assignment through a link — students do not need an account; "visitor" means a person who browses our website, or opens the public sample lesson, without creating an account. "You" means the tutor, except where a section is addressed to students or visitors.
Contact (data controller): [email protected] Engible is operated from Hungary (European Union). The identity of the person responsible for data processing is available on legitimate request via the email above.
1. The short version
- We collect the minimum we need to run the service — there is no ad tracking, no data selling, and no cookie banner because we use no tracking cookies.
- Students do not need accounts. We do not ask students for their name, email, or any personal details — a student opens a lesson via an anonymous link and we store only their exercise answers.
- All personal data is stored in the European Union. Only video transcript content (not your personal details) is sent to AI providers in the United States to create lessons.
2. What we collect and why
If you are a tutor (registered user)
| Data | Why | Legal basis (GDPR art. 6) |
|---|---|---|
| Email address and password | Your account: sign-in, password reset, service messages | Contract — 6(1)(b) |
| The name or nickname you give at sign-up | Addressing you in the app | Contract — 6(1)(b) |
| Lessons you create, including their contents (e.g. the link to the video, the lesson content, vocabulary), and the folders you keep them in | The core service — building and storing your lessons | Contract — 6(1)(b) |
| Assignment labels and other free text you type (see §4) | Helping you organise lessons and assignments | Contract — 6(1)(b) |
| Lesson-creation records (e.g. which model was used, token counts) | Enforcing free-plan limits, cost accounting | Legitimate interest — 6(1)(f) |
| Feedback and requests you send us (e.g. ratings, survey answers, or asking to hear when paid plans launch) | Improving the product and responding to your requests | Legitimate interest — 6(1)(f) |
| Product analytics (e.g. pages visited, features used) | Understanding how the product is used. Cookieless; IP addresses are discarded, sessions are not recorded | Legitimate interest — 6(1)(f) |
| Error reports (what went wrong in the app) | Fixing bugs | Legitimate interest — 6(1)(f) |
| Anti-bot checks on the account forms (Cloudflare Turnstile — see §5) | Keeping automated requests out | Legitimate interest — 6(1)(f) |
If you are a visitor (no account)
You can browse the site and open the public sample lesson without an account. In that case we process:
| Data | Why | Legal basis (GDPR art. 6) |
|---|---|---|
| Which pages you open, and what you do on the sample lesson — for example switching between the tutor and student views, or answering an exercise. Recorded without cookies, and with your IP address discarded | Seeing how the site and the sample are actually used | Legitimate interest — 6(1)(f) |
| The rating and any note you leave on the sample lesson | Improving lesson quality | Legitimate interest — 6(1)(f) |
| Error reports | Fixing bugs | Legitimate interest — 6(1)(f) |
If you are a student (no account)
Students open assignments through an anonymous link. We do not ask students for a name, email address, or any other personal details. We store only:
| Data | Why |
|---|---|
| Your answers to the exercises | So your tutor can review them |
| When the assignment was opened and completed | So your tutor can see progress |
Your tutor decides to use Engible and shares the link with you. For the data above, the tutor is the data controller and Engible processes it on the tutor's behalf (GDPR art. 28). Requests about this data — for example to see or delete your answers — should therefore be addressed to your tutor; we assist the tutor in fulfilling them.
3. What we do NOT collect
- No advertising or cross-site tracking, no sale of personal data.
- No tracking cookies. Your browser stores only what the app needs to work: the session that keeps a tutor signed in and small settings such as your theme. Consent banners are required for tracking cookies — we have none, so there is no banner.
- Analytics runs in cookieless mode with client IP addresses discarded; session recording is off.
- Students are never asked to register or provide personal details.
- No profiling and no automated decisions about you: AI creates lesson content, it is not used to evaluate people or make decisions about them.
4. A note on free-text fields
In some places a tutor can type free text — for example an assignment label or a lesson title. If that text identifies a student, that is the tutor's choice and responsibility as the controller of their students' data. Assignment labels are visible only to the tutor who created them.
5. Who processes data for us (sub-processors)
We remain the controller of your personal data at all times. To operate the Service we engage the sub-processors listed below. Each processes personal data only on our documented instructions and under a data processing agreement that meets the requirements of Article 28 GDPR.
Your account, your lessons and your students' answers are stored only in the EU. The only content we disclose to a provider outside the EU is the transcript of the video you choose. Requests to the Service also travel through Cloudflare's network, which may route them outside the EU in transit — see the note below the table.
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase | Database and authentication | EU |
| Railway | Application hosting; encrypted daily backups | EU |
| PostHog | Product analytics and error monitoring | EU |
| Scaleway | Delivery of account emails | EU |
| Cloudflare R2 | Storage of the encrypted backups | EU |
| Cloudflare | DNS and reverse proxy in front of the Service; bot check on the account forms | Global network |
| OpenAI, Anthropic | Creating lesson content from a video transcript | United States |
Cloudflare as reverse proxy. All requests to engible.com are routed through Cloudflare's network before they reach our servers; this is the measure by which the Service is protected against denial-of-service and other attacks. Cloudflare processes connection data and returns the response from the data centre nearest to you, which may be located outside the EU. Pages that contain personal data are served with no-store cache directives and are therefore not retained in Cloudflare's cache. Confining this routing to the EU requires Cloudflare's Data Localization Suite, a paid feature to which we do not currently subscribe.
Bot protection. Cloudflare Turnstile protects the account forms — the ones that sign you in, create an account, or send an account email. It tells a person from an automated request and runs on the form itself, so it applies to any visitor who uses one. Turnstile processes connection and browser data, sets no cookie, and returns to us only the result of the check.
AI providers. The data disclosed to OpenAI and Anthropic is limited to the transcript of the video you select and the parameters of the lesson. It does not include your name, email address, account details, or your students' answers. A transcript may incidentally identify individuals who appear in the video, which is why these providers are listed as sub-processors and their transfers are addressed in §6.
6. Transfers outside the EU
This section states the safeguards for each transfer; what is disclosed to whom is set out in §5 and is not repeated here. Where a sub-processor processes personal data outside the EU, we rely on the safeguards required by Chapter V of the GDPR:
- OpenAI and Anthropic (United States). Governed by the EU Standard Contractual Clauses in our data processing agreement with each provider, and supported by their certification under the EU-U.S. Data Privacy Framework.
- Cloudflare (global network). Connection and bot-check data may be processed at the Cloudflare data centre nearest to the visitor, including outside the EU. Governed by the Standard Contractual Clauses incorporated into the Cloudflare data processing agreement that applies to our subscription.
- Sub-processors hosting data in the EU. Supabase, Railway, PostHog, Scaleway and Cloudflare R2 keep your data in EU data centres. Where their personnel outside the EU require incidental access for support or maintenance, that access is covered by the Standard Contractual Clauses in our agreements with them.
7. How long we keep data
Account, lessons, assignments, answers: until you delete them or delete your account. Account deletion (available in the app) removes your account, lessons, assignments and student answers immediately.
Backups: encrypted daily backups are kept for up to 30 days and then deleted automatically. Data removed from the live system disappears from backups within 30 days at the latest.
Lesson-creation records, feedback, and requests you sent us: deleted together with your account. We keep only aggregated statistics that contain no personal data (for example, the total cost of creating lessons).
Ratings and notes left on the public sample lesson: kept for as long as they are useful for improving lesson quality. They carry no account identifier and are not affected by the deletion of an account.
8. Security
Data is encrypted in transit (TLS). Passwords are never stored in readable form. The database itself enforces per-account access rules, so a tutor can only ever access their own data; a student can access only their single assignment through its secret link. Backups are encrypted (AES-256) before storage. Personal data lives in EU data centres.
9. Your rights
Under the GDPR you can ask us to: access the data we hold about you, correct it, delete it, restrict or object to its processing, and receive a copy in a portable format. Write to [email protected] — we respond within one month. To protect your data, we may first check that a request really comes from the account owner (for example, by asking you to write from your account email). You can also delete your account yourself in the app at any time.
If you believe we handle your data unlawfully, you may lodge a complaint with an EU data protection supervisory authority — in the EU country where you live or work, or where the alleged infringement occurred. This right applies to everyone whose data we process — tutors, visitors and students — wherever they are based.
10. Children
Engible is a tool for tutors and requires them to be at least 18. We do not knowingly collect personal data directly from children: students do not register and are not asked for personal details. Tutors who assign lessons to minors are responsible for having the necessary permissions, including parental consent where required.
11. Changes to this policy
We may update this policy as the product evolves. For material changes (new data, new purposes, new recipients) we will notify tutors by email or in the app before the change takes effect. The "Last updated" date always reflects the current version.