Privacy Policy

1. Who I am ?

This service is operated by Xavier Leroy, an independent French teacher operating under the name learnfrench.co. Contact for privacy questions: [email protected]
Address: Language Intensive Program, Satit Piboonbumben, Bangsaen, Thailand
If you have any questions about this Privacy Policy, your data, or how to exercise your privacy rights, you can contact me at the email above. I'll respond within 30 days, usually faster.

2. Information We Collect

I collect different types of information depending on how you interact with my services.

Information you give me directly:

• Name and email address (when you book a free trial or register an account)

• Payment information (handled by my payment processor — see Section 5)

• Information you share during lessons or homework (your French level, your goals, your professional context if relevant, your real work materials if you choose to share them with me for professional French lessons)

• Messages you send me through the website contact form or by email

• Optional profile information you choose to add to your student dashboard

Information collected automatically when you visit the website:

• IP address and approximate location

• Browser type and operating system

• Pages you visit on the site and how long you stay

• Referring website (how you got to my site)

• Date and time of your visits

This information is collected through cookies and similar technologies. See Section 7 for more on cookies.

Information from third parties:

If you book or contact me through external platforms (italki, Fiverr), I may receive information about you from those platforms in accordance with their own privacy policies. I receive the information necessary to deliver the service you've booked — usually your name, email, and your message.

3. Why I collect this information

I collect and use your information for specific purposes:

• To deliver the lessons and services you book.

I need basic information (name, contact, level, goals) to actually teach you.

• To process payments.

I need basic information (name, contact, level, goals) to actually teach you.

• To communicate with you.

Booking confirmations, lesson reminders, homework, and direct responses to your questions.

• To improve the service.

Understanding which pages students visit and which features they use helps me improve the website and lessons.

• To meet legal obligations.

Tax records, invoicing, and other legal requirements may require me to retain certain information.

• To send marketing communications

(only if you've explicitly opted in). You can unsubscribe at any time.

I will never sell your information to third parties for marketing purposes.

4. How I handle lesson content and recordings

Because my service involves one-on-one online lessons, I want to be specific about how lesson-related data is handled:

Lesson recordings are only made if you opt in. They are stored in your private student dashboard and not accessible to anyone else (not even other students). You can request deletion at any time. If you do not opt in, no recordings are made.

Whiteboards and lesson notes are saved to your private dashboard automatically. Only you and I have access to these.

Homework and manuals I send you are stored in your dashboard. Only you and I have access.

Real work materials shared by professional students (emails, documents, etc.) — these are used solely for the lessons you're paying for. I treat them as confidential. I do not share them with third parties. I will delete them upon request. For genuinely sensitive material, I recommend anonymizing it before sending — or alternatively, we can work with generic examples that mirror your situation.

5. Third parties I work with

I use carefully chosen third-party services to operate my business. Each one has its own privacy policy that you should be aware of:

BrainCert — Provides the online classroom technology where lessons take place. Lesson sessions are encrypted in transit. https://www.braincert.com/privacy-policy

LatePoint — Manages booking and scheduling on my site.

SureCart / Stripe — Process payments. I never see or store your full credit card details — these are handled directly by the payment processor.

Google Analytics (or equivalent) — Helps me understand website traffic. [Anonymized where possible / configured for IP anonymization, as appropriate.]

WordPress website build with Etch Builder and ACSS + Cloudways hosting and Cloudflare CDN — Hosts the website itself.

italki, Fiverr — Independent platforms through which some students reach me. Each platform handles its own data per its own policies.

I have data processing arrangements in place with these providers as required.

6. International data transfers

Because I'm based in Thailand serving global students, your data may be transferred between Thailand, the European Union, and other countries where my service providers operate.

For students in the European Economic Area, I rely on appropriate legal mechanisms (Standard Contractual Clauses, or equivalent safeguards) to protect your data during these transfers.

7. Cookies

My website uses cookies for basic site functionality, login sessions, and analytics. Specifically:

Essential cookies — required for the website and student dashboard to work. These cannot be disabled.

Analytics cookies — help me understand how visitors use the site. You can opt out of these.

Booking session cookies — used by LatePoint to remember your booking in progress.

When you first visit the site, you'll see a cookie consent notice. You can change your preferences at any time through [link to cookie settings].

I don't use advertising cookies, retargeting cookies, or cookies that track you across other websites.

8. How long I keep your data

Different types of data are kept for different periods:

Account and contact information — for as long as your account is active, plus [2 years] after closure for legal and accounting purposes

Lesson recordings (if opted in) — until you request deletion, or until your account is closed

Payment records — for as long as legally required for tax and accounting purposes (typically 5–10 years depending on jurisdiction)

Marketing email subscribers — until you unsubscribe

Website analytics data — anonymized after 3 months

If you'd like your data deleted earlier than these standard periods, get in touch — I'll honor reasonable requests as long as no legal obligation requires me to retain the information.

9. Your rights

If you're an EU resident (or otherwise covered by GDPR), you have specific rights regarding your personal data:

Right to access — request a copy of the personal data I hold about you

Right to rectification — request corrections to inaccurate data

Right to erasure ("right to be forgotten") — request deletion of your data

Right to restrict processing — limit how I use your data

Right to data portability — receive your data in a portable format

Right to object — to certain types of processing

Right to withdraw consent — for processing based on consent

Right to lodge a complaint with your local data protection authority

Similar rights apply for Thai residents under PDPA and for residents of other jurisdictions with comparable laws.

To exercise any of these rights, email me at [your email]. I'll respond within 30 days.

10. Children's privacy

My services are intended for adults (age 18+). I do not knowingly collect personal information from children under 18. If you believe a child has provided me with personal information, please contact me immediately and I'll delete it.

If you're under 18 and would like to book lessons, this should be arranged by a parent or legal guardian who provides consent and pays for the lessons.

11. Security

I take reasonable technical and organizational measures to protect your personal information from unauthorized access, alteration, disclosure, or destruction. These include:

Encrypted connections (HTTPS) across the entire website

Encrypted lesson sessions through BrainCert

Password-protected administrative access

Limited access to your data (only me, and only when needed)

Regular software updates and security patches

Choice of reputable third-party services with strong security practices

No system is completely secure, however. If I become aware of a data breach affecting your personal information, I'll notify you within the timeframes required by applicable law.

12. Changes to this Privacy Policy

I may update this Privacy Policy from time to time — for example, when I add a new service or when laws change. The "Last updated" date at the top of the policy will reflect the most recent change.

Significant changes will be communicated to existing students by email. Minor changes will be posted on this page without separate notice.

13. How to contact me about privacy

If you have any questions, concerns, or requests related to your personal data please send me an email:

I aim to respond within a week. For more formal data rights requests, I'll respond within 30 days as required by law.