Engible — Privacy Policy
Last updated: 21 July 2026
Engible ("Engible", "we", "us") is an online tool that turns YouTube videos into interactive English lessons. This policy explains what personal data we process, why, and what rights you have.
In this policy, "tutor" means a person who creates an account and uses Engible; "student" means a person to whom a tutor sends an assignment through a link — students do not need an account. "You" means the tutor, except where a section is addressed to students.
Contact (data controller): privacy@engible.com Engible is operated from Hungary (European Union). The identity of the person responsible for data processing is available on legitimate request via the email above.
1. The short version
- We collect the minimum we need to run the service — there is no ad tracking, no data selling, and no cookie banner because we use no tracking cookies.
- Students do not need accounts. We do not ask students for their name, email, or any personal details — a student opens a lesson via an anonymous link and we store only their exercise answers.
- All personal data is stored in the European Union. Only video transcript content (not your personal details) is sent to AI providers in the United States to generate lessons.
2. What we collect and why
If you are a tutor (registered user)
| Data | Why | Legal basis (GDPR art. 6) |
|---|---|---|
| Email address and password | Your account: sign-in, password reset, service messages | Contract — 6(1)(b) |
| The name or nickname you give at sign-up | Addressing you in the app | Contract — 6(1)(b) |
| Lessons you create, including their contents (e.g. the link to the video, generated content, vocabulary), and the folders you keep them in | The core service — building and storing your lessons | Contract — 6(1)(b) |
| Assignment labels and other free text you type (see §4) | Helping you organise lessons and assignments | Contract — 6(1)(b) |
| Generation records (e.g. which model was used, token counts) | Enforcing free-plan limits, cost accounting | Legitimate interest — 6(1)(f) |
| Feedback and requests you send us (e.g. ratings, survey answers, or asking to hear when paid plans launch) | Improving the product and responding to your requests | Legitimate interest — 6(1)(f) |
| Product analytics (e.g. pages visited, features used) | Understanding how the product is used. Cookieless; IP addresses are discarded, sessions are not recorded | Legitimate interest — 6(1)(f) |
| Error reports (what went wrong in the app) | Fixing bugs | Legitimate interest — 6(1)(f) |
If you are a student (no account)
Students open assignments through an anonymous link. We do not ask students for a name, email address, or any other personal details. We store only:
| Data | Why |
|---|---|
| Your answers to the exercises | So your tutor can review them |
| When the assignment was opened and completed | So your tutor can see progress |
Your tutor decides to use Engible and shares the link with you. For the data above, the tutor is the data controller and Engible processes it on the tutor's behalf (GDPR art. 28). Requests about this data — for example to see or delete your answers — should therefore be addressed to your tutor; we assist the tutor in fulfilling them.
3. What we do NOT collect
- No advertising or cross-site tracking, no sale of personal data.
- No tracking cookies. Your browser stores only what the app needs to work: the session that keeps a tutor signed in and small settings such as your theme. Consent banners are required for tracking cookies — we have none, so there is no banner.
- Analytics runs in cookieless mode with client IP addresses discarded; session recording is off.
- Students are never asked to register or provide personal details.
- No profiling and no automated decisions about you: AI generates lesson content, it is not used to evaluate people or make decisions about them.
4. A note on free-text fields
In some places a tutor can type free text — for example an assignment label or a lesson title. If that text identifies a student, that is the tutor's choice and responsibility as the controller of their students' data. Assignment labels are visible only to the tutor who created them.
5. Who processes data for us (sub-processors)
Your personal data — your account, lessons, and student answers — is processed only in the EU, by these providers:
| Provider | What for | Where |
|---|---|---|
| Supabase | Database and authentication | EU |
| Railway | Application hosting and encrypted backups | EU |
| PostHog | Product analytics and error tracking | EU |
| Cloudflare R2 | Encrypted daily backups | EU |
AI lesson generation (United States). To generate a lesson, we send OpenAI and Anthropic only the video's transcript text and the lesson parameters — never your name, email, account details, or student answers. The transcript of a public video may incidentally mention the people who appear in it; because such text can count as personal data under the GDPR, we list these providers here and protect the transfer as described in §6.
6. Transfers outside the EU
Lesson generation uses AI providers located in the United States (OpenAI and Anthropic). What we send them is the video transcript and lesson parameters — not your name, email, or account details, and not student answers. Where such processing involves personal data, we rely on two safeguards: the EU Standard Contractual Clauses and the provider's certification under the EU-U.S. Data Privacy Framework.
The providers listed in §5 are international companies: your data stays in their EU data centres, but if their staff outside the EU ever need incidental access to keep the service running (for example, technical support), that access is protected by the same safeguards under our data processing agreements with them.
7. How long we keep data
- Account, lessons, assignments, answers: until you delete them or delete your account. Account deletion (available in the app) removes your account, lessons, assignments and student answers immediately.
- Backups: encrypted daily backups are kept for up to 30 days and then deleted automatically. Data removed from the live system disappears from backups within 30 days at the latest.
- Generation records, feedback, and requests you sent us: deleted together with your account. We keep only aggregated statistics that contain no personal data (for example, total generation costs).
8. Security
Data is encrypted in transit (TLS). Passwords are never stored in readable form. The database itself enforces per-account access rules, so a tutor can only ever access their own data; a student can access only their single assignment through its secret link. Backups are encrypted (AES-256) before storage. Personal data lives in EU data centres.
9. Your rights
Under the GDPR you can ask us to: access the data we hold about you, correct it, delete it, restrict or object to its processing, and receive a copy in a portable format. Write to privacy@engible.com — we respond within one month. To protect your data, we may first check that a request really comes from the account owner (for example, by asking you to write from your account email). You can also delete your account yourself in the app at any time.
If you believe we handle your data unlawfully, you may lodge a complaint with an EU data protection supervisory authority — in the EU country where you live or work, or where the alleged infringement occurred. This right applies to everyone whose data we process — tutors and students — wherever they are based.
10. Children
Engible is a tool for tutors and requires them to be at least 18. We do not knowingly collect personal data directly from children: students do not register and are not asked for personal details. Tutors who assign lessons to minors are responsible for having the necessary permissions, including parental consent where required.
11. Changes to this policy
We may update this policy as the product evolves. For material changes (new data, new purposes, new recipients) we will notify tutors by email or in the app before the change takes effect. The "Last updated" date always reflects the current version.