Engible – Privacy Policy
Last updated: 1 November 2026
Engible ("Engible", "we", "us") is an online tool that turns YouTube videos into interactive English lessons. This policy explains what personal data we process, why, and what rights you have.
In this policy, "tutor" means a person who creates an account and uses Engible; "student" means a person to whom a tutor sends an assignment through a link – students do not need an account; "visitor" means a person who browses our website, or opens the public sample lesson, without creating an account. "You" means the tutor, except where a section is addressed to students or visitors.
1. The short version
- We collect the minimum we need to run the service – there is no ad tracking, no data selling, and no cookie banner because we use no tracking cookies.
- Students do not need accounts. We do not ask students for their name, email, or any personal details – a student opens a lesson via an anonymous link and we store only their exercise answers.
- All personal data is stored in the European Union. Only video transcript content (not your personal details) is sent to AI providers in the United States to create lessons. The one exception is a call you choose to book with us: the booking goes through Calendly and the call takes place on Zoom or Google Meet, so what the booking and the call require may leave the EU (see §5).
- Payments are handled by Paddle, which sells subscriptions to you as merchant of record. We never receive your card details.
2. What we collect and why
If you are a tutor (registered user)
| Data | Why | Legal basis (GDPR art. 6) |
|---|---|---|
| Email address and password | Your account: sign-in, password reset, service messages | Contract – 6(1)(b) |
| The name or nickname you give at sign-up | Addressing you in the app | Contract – 6(1)(b) |
| Lessons you create, including their contents (e.g. the link to the video, the lesson content, vocabulary), and the folders you keep them in | The core service – building and storing your lessons | Contract – 6(1)(b) |
| Assignment labels and other free text you type (see §4) | Helping you organise lessons and assignments | Contract – 6(1)(b) |
| Subscription data received from Paddle (e.g. the plan, its status, the dates of the billing period you have paid for, and Paddle's reference numbers for your subscription and customer record) | Administering your subscription | Contract – 6(1)(b) |
| The country your connection comes from, as worked out by Cloudflare – used while the page is prepared, not stored | Showing the price for your country, in its currency | Legitimate interest – 6(1)(f) |
| Lesson-creation records (e.g. which model was used, token counts) | Enforcing plan limits, cost accounting | Legitimate interest – 6(1)(f) |
| Feedback and requests you send us (e.g. ratings, survey answers, or your reply when we email you to ask how Engible is working for you) | Improving the product and responding to your requests | Legitimate interest – 6(1)(f) |
| How you first heard about Engible – one choice from a short list, plus your own words if you choose "Something else". We ask once, right after you confirm your email | Understanding how tutors find Engible, so we know where to tell others about it | Legitimate interest – 6(1)(f) |
| Product analytics (e.g. pages visited, features used) | Understanding how the product is used. Cookieless; IP addresses are discarded, sessions are not recorded | Legitimate interest – 6(1)(f) |
| Error reports (what went wrong in the app) | Fixing bugs | Legitimate interest – 6(1)(f) |
| Anti-bot checks on the account forms (Cloudflare Turnstile – see §5) | Keeping automated requests out | Legitimate interest – 6(1)(f) |
If you are a visitor (no account)
You can browse the site and open the public sample lesson without an account. In that case we process:
| Data | Why | Legal basis (GDPR art. 6) |
|---|---|---|
| Which pages you open, and what you do on the sample lesson – for example switching between the tutor and student views, or answering an exercise. Recorded without cookies, and with your IP address discarded | Seeing how the site and the sample are actually used | Legitimate interest – 6(1)(f) |
| The country your connection comes from, as worked out by Cloudflare – used while the page is prepared, not stored | Showing the price for your country, in its currency | Legitimate interest – 6(1)(f) |
| The rating and any note you leave on the sample lesson | Improving lesson quality | Legitimate interest – 6(1)(f) |
| Error reports | Fixing bugs | Legitimate interest – 6(1)(f) |
If you book a call with us
Anyone – a tutor or a visitor – can book a call with us, for example to tell us what brought you to Engible and what would make it better for you. Booking is optional, and nothing in Engible depends on it. If you book one, we process:
| Data | Why | Legal basis (GDPR art. 6) |
|---|---|---|
| Your name and email address, the time you choose, and anything you write in the booking form | Arranging the call and reminding you of it | Legitimate interest – 6(1)(f) |
| What you tell us during the call | Improving the product and answering your questions | Legitimate interest – 6(1)(f) |
| What the call service – Zoom or Google Meet – needs to run the call – connection data, the name you join with, and your voice and image while the call is on | Holding the call | Legitimate interest – 6(1)(f) |
| A recording of the call – only if you agree to it when we ask at the start | Going back to what you told us when we work on Engible | Consent – 6(1)(a) |
We record a call only if you say yes when we ask at the start of it. You can say no and the call goes on just the same, and you can withdraw your consent at any time – we then delete the recording.
If you are a student (no account)
Students open assignments through an anonymous link. We do not ask students for a name, email address, or any other personal details. We store only:
| Data | Why |
|---|---|
| Your answers to the exercises | So your tutor can review them |
| When the assignment was created, submitted and reviewed | So your tutor can see progress |
Your tutor decides to use Engible and shares the link with you. For the data above, the tutor is the data controller and Engible processes it on the tutor's behalf (GDPR art. 28). Requests about this data – for example to see or delete your answers – should therefore be addressed to your tutor; we assist the tutor in fulfilling them.
3. What we do NOT collect
- No advertising or cross-site tracking, no sale of personal data.
- We never receive or store your card details.
- No tracking cookies. Your browser stores only what the app needs to work: the session that keeps a tutor signed in and small settings such as your theme. Consent banners are required for tracking cookies – we have none, so there is no banner.
- Analytics runs in cookieless mode with client IP addresses discarded; session recording is off.
- Students are never asked to register or provide personal details.
- No profiling and no automated decisions about you: AI creates lesson content, it is not used to evaluate people or make decisions about them.
4. A note on free-text fields
In some places a tutor can type free text – for example an assignment label or a lesson title. If that text identifies a student, that is the tutor's choice and responsibility as the controller of their students' data. Assignment labels are visible only to the tutor who created them.
5. Who processes data for us (sub-processors)
We remain the controller of your personal data at all times. To operate the Service we engage the sub-processors listed below. Each processes personal data only on our documented instructions and under a data processing agreement that meets the requirements of Article 28 GDPR.
Your account, your lessons and your students' answers are stored only in the EU. The only content we disclose to a provider outside the EU is the transcript of the video you choose – and, only if you book a call with us, what the booking and the call require (see "Calls" below). Requests to the Service also travel through Cloudflare's network, which may route them outside the EU in transit – see the note below the table.
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase | Database and authentication | EU |
| Railway | Application hosting; encrypted daily backups | EU |
| PostHog | Product analytics and error monitoring | EU |
| Scaleway | Delivery of account emails and of the emails we write to you ourselves | EU |
| Cloudflare R2 | Storage of the encrypted backups | EU |
| Cloudflare | DNS and reverse proxy in front of the Service; bot check on the account forms | Global network |
| OpenAI, Anthropic | Creating lesson content from a video transcript | United States |
| Calendly | Booking a call with us, if you choose to | United States |
| Zoom | The call itself, if you book one | United States |
Cloudflare as reverse proxy. All requests to engible.com are routed through Cloudflare's network before they reach our servers; this is the measure by which the Service is protected against denial-of-service and other attacks. Cloudflare processes connection data and returns the response from the data centre nearest to you, which may be located outside the EU. Pages that contain personal data are served with no-store cache directives and are therefore not retained in Cloudflare's cache. Confining this routing to the EU requires Cloudflare's Data Localization Suite, a paid feature to which we do not currently subscribe.
Bot protection. Cloudflare Turnstile protects the account forms – the ones that sign you in, create an account, or send an account email. It tells a person from an automated request and runs on the form itself, so it applies to any visitor who uses one. Turnstile processes connection and browser data, sets no cookie, and returns to us only the result of the check.
AI providers. The data disclosed to OpenAI and Anthropic is limited to the transcript of the video you select and the parameters of the lesson. It does not include your name, email address, account details, or your students' answers. A transcript may incidentally identify individuals who appear in the video, which is why these providers are listed as sub-processors and their transfers are addressed in §6.
Payments. Paid subscriptions are sold and processed by Paddle, which acts as the merchant of record and is therefore the seller towards you. Paddle collects your card details directly from you, determines, charges and remits any applicable taxes, and issues the invoice for the transaction. In respect of that transaction Paddle acts as an independent controller and not as our processor; Paddle's own privacy notice and buyer terms govern it. We never receive your card details. From Paddle we receive only the subscription data described in §2, which we process as controller for the sole purpose of administering your subscription. In the other direction, when you start a purchase we pass Paddle your account email address, the country your connection comes from – where we know it – and an internal reference to your account, so that the checkout opens for the right country and the purchase is linked to your account.
Calls. If you book a call, you do so on Calendly's own website (calendly.com), where Calendly's cookie notice applies; our site embeds nothing from Calendly and only links to it. Calendly receives what you enter in the booking form – your name, email address, the time you pick and any note – and sends you the confirmation and reminders. The call takes place on Zoom or on Google Meet. Zoom processes connection data and, while the call is on, your voice and image. Calendly and Zoom process this data for us as our processors. Google provides Meet under its own privacy policy, as it does YouTube (see below), and we receive none of the data it collects. A recording, if you agree to one, is kept by us and used only for the purpose set out in §2.
YouTube video player. The video of a lesson – on a tutor's lesson page, on a student's assignment page and in the public sample lesson – plays in YouTube's embedded player, in its privacy-enhanced mode (youtube-nocookie.com). When such a page opens, your browser loads the player directly from YouTube, so YouTube receives connection and browser data such as your IP address. Video thumbnails in a tutor's library, and on the screen shown while a lesson is being created, are loaded from YouTube in the same way. In this mode the player sets no cookies. It keeps a few technical entries in your browser – for example, whether captions are switched on – which contain no identifier and which your browser keeps separately for our site. YouTube is provided by Google (in the EU, Google Ireland Limited), which processes this data under its own privacy policy; we receive none of it. We show the video because it is the core of every lesson (legitimate interest – 6(1)(f)). If you open a video on YouTube itself, YouTube's own terms and cookies apply.
6. Transfers outside the EU
This section states the safeguards for each transfer; what is disclosed to whom is set out in §5 and is not repeated here. Where a sub-processor processes personal data outside the EU, we rely on the safeguards required by Chapter V of the GDPR:
- OpenAI and Anthropic (United States). Governed by the EU Standard Contractual Clauses in our data processing agreement with each provider, and supported by their certification under the EU-U.S. Data Privacy Framework.
- Cloudflare (global network). Connection and bot-check data may be processed at the Cloudflare data centre nearest to the visitor, including outside the EU. Governed by the Standard Contractual Clauses incorporated into the Cloudflare data processing agreement that applies to our subscription.
- Paddle. Paddle acts as an independent controller for the sale of a subscription, as set out in §5. Any international transfer it carries out in that capacity is determined by Paddle and governed by its own privacy notice and safeguards, not by ours.
- Calendly and Zoom (United States). Used only if you book a call with us. Governed by each provider's data processing agreement and supported by their certification under the EU-U.S. Data Privacy Framework.
- Google Meet. If a call takes place on Google Meet, what your browser or app sends to Meet goes to Google directly. Any transfer Google makes outside the EU is governed by its own privacy policy and safeguards, not by ours.
- YouTube (Google). What your browser sends to the YouTube player goes to Google directly, as set out in §5. Any transfer Google makes outside the EU is governed by its own privacy policy and safeguards, not by ours.
- Sub-processors hosting data in the EU. Supabase, Railway, PostHog, Scaleway and Cloudflare R2 keep your data in EU data centres. Where their personnel outside the EU require incidental access for support or maintenance, that access is covered by the Standard Contractual Clauses in our agreements with them.
7. How long we keep data
- Account, lessons, assignments, answers: until you delete them or delete your account, or until we close an account that has been inactive for a long time (see our Terms). Account deletion (available in the app) removes your account, lessons, assignments and student answers immediately.
- Subscription data received from Paddle: kept while your account exists and deleted together with it. Deleting your account also cancels your subscription with Paddle. Paddle keeps its own records of your purchases as the seller, under its own privacy notice (see §5).
- Backups: encrypted daily backups are kept for up to 30 days and then deleted automatically. Data removed from the live system disappears from backups within 30 days at the latest.
- Lesson-creation records, feedback, how you heard about Engible, and requests you sent us: deleted together with your account. We keep only aggregated statistics that contain no personal data (for example, the total cost of creating lessons).
- Calls: the booking stays in Calendly for as long as we may need it to get back to you about the call or about Engible; ask us and we delete it sooner. A recording, if you agreed to one, is kept for as long as it helps us improve Engible, and deleted as soon as you ask us to or withdraw your consent. Our notes from a call are kept for as long as they help us improve Engible; ask us and we remove anything in them that identifies you.
- Ratings and notes left on the public sample lesson: kept for as long as they are useful for improving lesson quality. They carry no account identifier and are not affected by the deletion of an account.
8. Security
Data is encrypted in transit (TLS). Passwords are never stored in readable form. The database itself enforces per-account access rules, so a tutor can only ever access their own data; a student can access only their single assignment through its secret link. Backups are encrypted (AES-256) before storage. Personal data lives in EU data centres.
9. Your rights
Under the GDPR you can ask us to: access the data we hold about you, correct it, delete it, restrict or object to its processing, and receive a copy in a portable format. Write to [email protected] – we respond within one month. To protect your data, we may first check that a request really comes from the account owner (for example, by asking you to write from your account email). You can also delete your account yourself in the app at any time – with a subscription there is one short exception, described in §5 of our Terms.
If you believe we handle your data unlawfully, you may lodge a complaint with an EU data protection supervisory authority – in the EU country where you live or work, or where the alleged infringement occurred. This right applies to everyone whose data we process – tutors, visitors and students – wherever they are based.
10. Children
Engible is a tool for tutors and requires them to be at least 18. We do not knowingly collect personal data directly from children: students do not register and are not asked for personal details. Tutors who assign lessons to minors are responsible for having the necessary permissions, including parental consent where required.
11. Changes to this policy
We may update this policy as the product evolves. For material changes (new data, new purposes, new recipients) we will notify tutors in advance before the change takes effect. The "Last updated" date always reflects the current version.
12. Controller and contact details
The controller of the personal data described in this policy is:
Dmitrii Matveenkov e.v. (sole trader)
1095 Budapest, Gát utca 21. fszt. 1/A, Hungary
Registration number 59865320 · Tax number 90599200-1-43
[email protected]