What Makes LinguaFlow GDPR Compliant and Data Safe for Tutors

When you use a tool to plan lessons, you put student information into it: names, goals, levels, notes on what they find difficult. Tutors teaching students in the EU or UK need to know that this data is handled in line with GDPR.

This article explains what LinguaFlow does to protect that data. For a general guide to what GDPR asks of a solo tutor, whichever tools you use, see What Tutors Need to Know About GDPR and Data Security. Nothing here is legal advice.

Encryption

Data sent between your browser and LinguaFlow travels over HTTPS, so it is encrypted in transit. Stored data is encrypted at rest in LinguaFlow's database. Passwords are never stored in readable form; they are kept as secure hashes.

Cookies and Analytics

LinguaFlow uses strictly necessary cookies and local browser storage to keep you signed in and your session secure. It does not use advertising cookies.

Analytics are optional. Google Analytics loads only after a visitor agrees to analytics cookies, and if consent is withdrawn during a session, analytics stop. You can change your choice at any time through the cookie preferences.

Deleting Your Account

You can schedule deletion of your account from Settings. Deletion is deliberate and recoverable for a short time:

• Your account is scheduled for permanent deletion in 30 days.
• You receive a recovery email with instructions for restoring it.
• You can cancel the deletion at any point within those 30 days.
• After 30 days, your data is permanently and irreversibly deleted.

The recovery window protects against accidental or impulsive deletion while still honoring the right to erasure.

You can also delete individual students at any time, for example when a former student asks you to remove their information.

Accessing Your Data

You have the right to ask what data LinguaFlow holds about you. To request a copy, contact support@linguaflow.online.

Retention

LinguaFlow applies automatic retention limits to operational data such as logs, rather than keeping it indefinitely. Holding data only as long as it is needed is one of GDPR's core principles.

International Transfers and Breaches

Where data is transferred internationally, LinguaFlow uses mechanisms such as standard contractual clauses to keep it protected to the required standard. In the event of a data breach, affected users will be notified and appropriate measures taken, as the law requires.

How Student Data Is Used to Generate Lessons

To generate a personalized lesson, the relevant parts of a student's profile (goals, level, weak points, interests, learning style) are sent to the AI model that writes the lesson. That is what makes lessons personal, and it is also why the profile should contain only what lessons need.

A few practical guidelines:

• Record learning information, not personal details. Goals, level and interests are useful. A student's home address, ID numbers or health details are not needed to plan a lesson.
• Use first names where possible. A lesson works just as well for "Ana" as for a full legal name.
• Delete students who have left and asked to be removed. Don't let old profiles accumulate.

Your Responsibilities as a Tutor

A tool can make compliance realistic, but it can't cover everything. You remain responsible for having a lawful reason to hold each student's data, for keeping it minimal, and for responding when a student asks to see or delete their information. Keeping student records inside LinguaFlow, rather than scattered across email and spreadsheets, makes each of those easier.

Frequently Asked Questions

Is LinguaFlow GDPR compliant? LinguaFlow is built around GDPR principles: encryption in transit and at rest, consent-based analytics, deletion with a recovery window, retention limits and protected international transfers. Using it doesn't remove your own responsibilities as a tutor holding student data.

Can I get a copy of my data? Yes. Email support@linguaflow.online to request a copy of the data held about you.

What happens to my students' data if I delete my account? It is deleted along with your account after the 30-day recovery window ends.