Service: FluenTea, a language learning platform
for schools, companies and individual learners. It provides live online
classes and conversation practice, an AI language coach, lessons, and
progress records for learners and their teachers.
FluenTea is a cloud-based service hosted on Google Cloud in the
us-central1 region (Iowa, United States). The web application is
delivered through Cloudflare.
Google Cloud infrastructure is independently audited against
ISO/IEC 27001 and SOC 2.
Transfers of personal data from the EU, the EEA and the UK are made
under Standard Contractual Clauses.
All service providers that process personal data for FluenTea are
listed, with their purpose and location, on the
sub-processor page. Institutions
receive advance notice of a new provider and may object under their
agreement.
Personal data processed
Profile information: name, profile image, native
and target languages. Used to personalise the service.
Contact information: email address. Used to
communicate with learners, teachers and school staff.
Class and practice information: scheduled and past
classes, attendance, call transcripts, call recordings where enabled,
messages, lesson progress and teacher feedback. Used to
deliver classes, report attendance and progress, and improve the
learning experience.
Technical information: IP address, browser type
and time zone. Used for scheduling, security and diagnosing technical
issues.
Payment information: handled by Stripe, Google
Play or the Apple App Store. FluenTea never sees or stores a card
number.
Data protection and access controls
Encryption in transit: all connections to FluenTea
use HTTPS (TLS). There is no unencrypted access.
Encryption at rest: the database and all stored
files, including recordings, are encrypted at rest.
Passwords: stored only as salted hashes using
bcrypt. FluenTea staff cannot read a password. Sign-in with Google,
Apple or Microsoft is also supported.
Role-based access: students, teachers and school
coordinators each have access only to the information their role
requires. These permissions are verified by automated tests before
every release.
Backups: the database is backed up automatically
every day, with point-in-time recovery.
Secure development: every change is covered by
automated tests, including tests for authentication, permissions and
the AI coach, before it is released.
Students and minors
Individual sign-up is available from age 16. Younger students join
only through their school.
Where a school requires parental consent, a student under 18 cannot
use FluenTea until a parent or guardian has signed and the school has
verified it. This is enforced server-side.
Student data is never used for advertising. FluenTea shows no ads
and uses no advertising services.
Artificial intelligence
ChaCha, the FluenTea language coach, is an AI and identifies itself
as one. AI-generated content is labelled.
Session transcripts from a school or company account are not used
to train AI models unless that institution agrees in writing. Personal
accounts are covered by the
Privacy Policy.
FluenTea does not detect or infer emotions.
A score entered by a teacher always takes precedence over a
suggested score. The Terms of Service do not permit AI session insights
to be used as the basis for a personnel decision.
Placement results are an estimated level on the CEFR scale and are
not a language certificate.
FluenTea is designed to meet the GDPR, the UK GDPR, the CCPA, FERPA
and Mexico's personal data law. For schools in the United States,
FluenTea acts as a "school official" under FERPA.
A Data Processing Agreement is available to schools and companies
on request.
FluenTea does not yet hold an independent security certification.
Certification under UK Cyber Essentials, followed by ISO/IEC 27001, is
in preparation.
In preparation: an independent penetration test, an EU hosting
option, SAML single sign-on, an accessibility conformance report, and
self-certification under the EU-US Data Privacy Framework.
