Privacy policy

This policy explains what personal information SayAway collects when you visit sayawaylessons.com, create an account, take lessons or write to us; why we collect it; who else sees it; how long we keep it; and what you can ask of us.

It is short and specific on purpose. We collect what the service needs and nothing more, we do not sell personal information, and we do not use advertising trackers.

1. Who is responsible

SayAway, ABN 49 179 423 151, Australia. Email sayawaylessons@gmail.com, phone +61 413 444 208. For readers in the European Union or the United Kingdom, SayAway is the data controller.

We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth) and, for students in the European Economic Area, the United Kingdom or Switzerland, the General Data Protection Regulation (GDPR).

2. What we collect

When you create an account: your name, email address, password (stored only as a hash, never readable by us), time zone, preferred language for the site and for emails and, if you give them, your phone number and native language.

When you tell us about yourself (the first questionnaire): the language you want to learn, your current level, your goal, your motivation, a target date, how many lessons a week you have in mind, topics that interest you, and how you heard about us.

When you take lessons: bookings, cancellations and moves, with their dates; whether a lesson took place; the teacher's notes and feedback on each lesson, the vocabulary from it, level assessments and your learning plan; homework set, what you submit for it (text and any file you upload) and the teacher's review. Lessons are not recorded.

When you pay: the package bought, amount, currency and date; the card brand and last four digits, the receipt link and the identifiers Stripe assigns to you and to the payment; any refund. We never receive or store your full card number.

When you write to us: the name, email address and message you send through the contact form, and the emails we exchange.

When we email you: a log of the messages the platform sent you (recipient, subject, content, date and delivery status) and your notification preferences.

Automatically, for security: the IP address and browser of requests to sign in, register, send a form or download your data, counted for a short time to block abuse; and, for actions taken by staff on your account, an audit record with the date, the action and the staff member. Our hosting providers keep standard server logs.

We do not collect information about your ethnicity, religion, health or other sensitive matters, and ask you not to put it in the free-text fields.

3. Why we use it

• To provide the lessons you buy (performance of our contract with you): your account, bookings, credits, lesson notes, homework, the video room, receipts.
• To communicate about the service: booking confirmations, receipts, reminders before a lesson, the note after it, warnings when credits are about to expire or run out, and replies to your messages. Reminders, lesson notes and credit warnings can be switched off from your profile. Confirmations and receipts cannot, because they are the record of what you did.
• To send news and offers now and then to students who have bought from us (our legitimate interest in keeping in touch with customers). Every such email has an unsubscribe link, and you can opt out from your profile at any time.
• To keep the service safe (legitimate interest): rate limiting, the audit trail, fraud and abuse prevention.
• To meet legal obligations: tax and accounting records of sales and refunds.
• To understand how the business is doing: we count lessons, bookings and sales in our own database. We use no third-party analytics or advertising services.

4. Who else sees it

We share personal information only with the providers that run parts of the service, and only what each needs:

• Supabase hosts our database, sign-in system and file storage, in Sydney, Australia. It holds everything listed above.
• Vercel hosts the website and runs the application code, in Sydney, Australia, with a global network for delivering pages. It sees the requests you make to the site.
• Stripe processes payments. It receives your name, email address, the amount and what you are buying, and your card details, which it collects directly. Stripe is a global company and may process data outside Australia under its own safeguards.
• Resend delivers our emails. It receives your address and the content of each message.
• Google: when a lesson is held on Google Meet, the lesson is an event on the teacher's Google Calendar with its time and the Meet link. If calendar invitations are switched on, your email address is added to the event as a guest so that it appears in your own calendar too.
• Daily.co: when a lesson uses our built-in video room, Daily receives the name shown in the room and the connection data needed to run the call.

None of them may use your information for their own purposes. We do not sell personal information, and we do not share it with advertisers.

We may also disclose information where the law requires it, or to protect our rights or someone's safety.

5. Where it is stored and international transfers

Your data is stored in Australia. If you use the service from outside Australia, for example from Italy or elsewhere in the European Union, your information is transferred to Australia to provide the service you asked for. This transfer is necessary to perform our contract with you (Article 49(1)(b) GDPR). The providers listed above apply their own safeguards for any onward transfer, such as the European Commission's standard contractual clauses.

6. How long we keep it

• Your account and everything in it: for as long as the account is open.
• When your account is closed: your name, email address, phone number, photo, your answers to the first questionnaire, the notes you left on bookings and the messages you sent through the contact form are removed or replaced with anonymous values. The record of lessons taught, credits and payments is kept without your identity, because it is our business and tax record. Australian law requires us to keep records of sales for at least five years.
• Contact messages: until they have been answered and are no longer needed.
• Email log: the record of what was sent to you belongs to your account and is anonymised with it.
• Security counters: IP-based rate-limit records last hours, not days.
• Audit trail of staff actions: kept as a permanent record, with your account identifier but without your name after closure.

7. Security

Connections use TLS. Every table in our database has row-level security, so a student can only ever read their own rows and a teacher only their students'. Uploaded files sit in private storage and are served through short-lived links after an authorisation check. Passwords are hashed by our sign-in provider and never visible to us. Staff actions on accounts are logged. No card numbers are stored on our systems.

No system is perfectly secure. If we learn of a breach affecting your information, we will tell you and the relevant authority as the law requires.

8. Your rights

• Access. Download everything we hold about you at any time from your profile page ("Download my data"), as a file. It leaves out only the private notes the teacher writes for themselves.
• Correction. Edit your name, time zone, language and notification preferences from your profile. Write to us for anything else.
• Deletion. Ask for your account to be closed from your profile page. Section 6 explains what is removed and what is kept.
• Objection and restriction. You can stop reminders, lesson notes, balance warnings and the newsletter from your profile or from the link at the foot of each email.
• Portability. The download above is a machine-readable file (JSON).
• Complaint. If you think we have handled your information wrongly, write to us first. You may also complain to the Office of the Australian Information Commissioner (oaic.gov.au) or, if you are in the European Union, to your national data protection authority (in Italy, the Garante per la protezione dei dati personali).

We answer requests within 30 days.

9. Cookies

We use only the cookies the site needs to work:

• locale remembers your language for the site. Kept for one year.
• Sign-in cookies (names starting with sb-) keep you signed in to your account. Set by our sign-in provider, Supabase, and removed when you sign out or when they expire.
• theme records whether you chose light or dark mode. Stored in your browser's local storage, not sent to us.

Stripe sets its own cookies on its checkout page, for fraud prevention. We set no advertising or analytics cookies, and no cookie banner is needed because none of these is optional for the site to work.

10. Children

The service is for adults. An account for a student under 18 is held by a parent or guardian, who is our customer. In that case we collect the student's name and the details needed to teach them, and no more.

11. Changes

We may update this policy. Every version is numbered and dated on this page, and earlier versions stay on record. If a change matters to you, we email account holders before it takes effect.

12. Contact

For anything about your personal information: sayawaylessons@gmail.com.