Privacy Policy of www.vokabl.com

Last updated 10 September 2026

This Privacy Notice for VOKABL LTD ("we", "us", or "our"), describes how and why we access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you:

  • Visit our website at https://vokabl.com or any website of ours that links to this Privacy Notice
  • Create an account and use vokabl standard, our flagship language learning course delivered through live, tutor-led video sessions
  • Engage with us in other related ways, including marketing, support, or events

We are the data controller responsible for decisions about how your personal information is processed. If you do not agree with this notice, please do not use our Services. Questions or concerns: privacy@vokabl.com.

1. What information do we collect, and how do we use it

We collect personal information that you voluntarily provide when you register, use the Services, or contact us. Depending on how you interact with us, this may include:

  • name
  • phone number - collected at checkout, used to send you class reminders and notifications (never for marketing), and shared with Stripe for payment verification and fraud detection
  • email address
  • username and password
  • contact preferences
  • billing address
  • payment card details (processed by Stripe - we do not store full card numbers ourselves)

Sensitive information. We do not intentionally collect or systematically process special category data (racial or ethnic origin, religious beliefs, health data, sexual orientation, etc.). If you mention such information to a tutor during ordinary lesson conversation, we do not analyse, tag, or specifically process it - see the "Live video lessons" section below for how lesson content is (or isn't) retained.

Payment data. Handled and stored by Stripe. See Stripe's privacy notice at stripe.com/privacy.

Social media login data. If you register using a third-party account (e.g. Google), we receive certain profile information from that provider, such as your name, email, and profile picture. We use this only for the purposes described in this notice. We do not control, and are not responsible for, the third-party provider's own use of your data - review their privacy notice separately.

Information automatically collected. When you visit or use the Services, we automatically collect technical and usage data, including IP address, browser and device characteristics, operating system, referring URLs, and general usage patterns. This is used to secure and operate the Services and for internal analytics, and includes log/usage data, device data, and - where enabled and consented to - approximate location data. See the "Cookies" section below for detail on cookies and similar technologies.

Google API. Our use of information received via Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

How we use your information. We process your information to:

  • create and administer your account
  • deliver the Services, including scheduling and running live tutoring sessions
  • respond to support requests
  • send administrative and service-related communications
  • process payments and manage orders
  • request feedback
  • send marketing communications, where you have opted in - you can opt out at any time (see "Your privacy rights" below)
  • develop and improve the Services, including identifying usage trends
  • prevent fraud and maintain security
  • comply with legal obligations
  • protect vital interests where necessary (e.g. safety concerns)

2. Live video lessons: recording and retention

Because vokabl's core service is live, tutor-led video tutoring, this section sets out specifically how your voice and video are handled - separately from general usage data.

Platform. Live sessions run on Zoom. When it's time for your lesson, we send you a Zoom meeting link, and joining takes you to Zoom's own website or app to enter the call - this isn't embedded inside the vokabl site itself. Two things follow from that:

  • Scheduling, hosting, and recording the session happens under vokabl's own Zoom account, and Zoom acts as our processor for that part - your name, email, and video/audio stream are shared with Zoom to run and record the session, subject to a data processing agreement between vokabl and Zoom.
  • Separately, when you actually click the link and land on Zoom's own join page or app, you're interacting directly with Zoom's platform, not just with vokabl through Zoom in the background. That interaction (e.g. Zoom's own device/browser data collection at the join screen) is governed by Zoom's own privacy statement, which we don't control - you don't need a Zoom account to join as a participant, but the join experience itself is Zoom's, not ours. We'd encourage you to have a look at Zoom's privacy statement if you want the full picture of what happens on their side of that handoff.

Recording. Sessions are recorded by default, as a standard feature of how we deliver and safeguard the service - for quality assurance, tutor performance review, and resolving disputes or complaints about a specific session. This is not an optional add-on you can decline while still taking the lesson.

  • You are notified, before the session, that it will be recorded.
  • Because recording is a routine condition of using the live-session feature rather than a genuinely free choice, we do not rely on your consent as the legal basis (consent that isn't freely given doesn't meet the GDPR/UK GDPR standard). Instead, we rely on our legitimate interests (Art. 6(1)(f)) in maintaining lesson quality, training tutors, and having an evidential record to resolve disputes fairly - an interest we consider is not overridden by your rights, given the strict access limits below and the fact you're told in advance. We keep an internal record of this balancing assessment.
  • Access to recordings is restricted to a small number of authorised contractors and vokabl personnel involved in quality assurance or dispute handling - not visible to other students, other tutors, or the tutor who isn't the subject of that specific recording. Where an authorised contractor is based outside the UK, appropriate safeguards are in place for that access, as described in the "International transfers" section below.
  • You can object to this processing or ask questions about it by contacting privacy@vokabl.com; we'll consider any objection on its merits, though a valid objection specific to your own recordings may mean we're unable to offer you the live-session feature, since recording is integral to how the service is currently delivered.

Retention of recordings. Recordings are deleted as part of our regular deletion process, typically within around 90 days of the session, unless a longer period is needed to resolve an active dispute or complaint involving that specific session - in which case we retain it only until that matter is closed.

Not recorded by default. Outside of any session you're notified is being recorded, we do not otherwise store your voice or video content. Real-time transmission of your call is processed only for the duration of the session.

3. Tutor, staff, and contractor data

This section covers anyone who works with vokabl rather than uses it as a student: tutors, employees, other contractors (e.g. support and technical staff), and job candidates for any of these roles.

Job candidates (any role). When you apply for a role at vokabl - as a tutor, employee, or other contractor, through our website, LinkedIn, or other channels - we process the information in your application, CV, and any linked profile, and our correspondence with you during the hiring process. Legal basis: legitimate interests (assessing candidates), and once we're close to engaging you, steps taken at your request prior to entering into a contract (Art. 6(1)(b)). If your application is unsuccessful, we retain your application data in case a suitable future role arises, deleting it as part of our regular deletion process, typically within around 6 months, unless you ask us to delete it sooner.

Employees and other contractors. Once engaged, we process the information needed to run that working relationship: name, email, phone number, role, and (for contractors) payout information. Legal basis: performance of a contract and, for UK employment/tax matters, legal obligation. Support and technical staff based outside the UK are covered by the international transfer safeguards described in the "International transfers" section below.

Tutor applicants. Covered above under "Job candidates" - the process is the same for tutor roles as any other.

Active tutors. Once engaged, we collect and process: name, email, phone number, self-reported teaching qualifications and experience (as provided in your profile - not independently verified by vokabl), profile photo, availability, class assignments, and payout information.

Payouts and verification. Tutors are independent contractors, not employees of vokabl. Payouts are processed through Stripe. As part of enabling payouts, Stripe independently collects identity information from you to meet its own regulatory (KYC/AML) obligations - vokabl does not receive or store the identity documents Stripe collects for this purpose, only confirmation that your payout account is active. vokabl does not currently perform its own separate identity or qualification verification of tutors.

Acceptance of terms. At signup, tutors are required to explicitly accept this Privacy Notice and vokabl's Terms of Service, and separately sign a Contractor Agreement containing confidentiality and data-handling obligations covering student personal data encountered during lessons (including restrictions on independent recording and on reusing student contact details outside the platform).

4. Legal bases, and who we share your information with

Under the GDPR and UK GDPR, we rely on:

  • Consent - e.g. marketing communications, and non-essential cookies such as analytics (see "Cookies" below). Withdrawable at any time.
  • Performance of a contract - creating your account, running lessons, processing payments, tutor payouts.
  • Legitimate interests - session recording for quality and dispute-handling purposes, fraud prevention, service improvement, security monitoring, understanding platform usage - balanced against your rights and freedoms.
  • Legal obligations - e.g. UK tax and accounting record-keeping, responding to lawful requests from regulators or law enforcement.
  • Vital interests - only in exceptional circumstances involving a threat to someone's safety.

We will tell you, before processing begins, which basis applies to a given activity where this isn't already clear from context (e.g. we notify you before a session that it will be recorded).

We share personal data with the following categories of processors, each bound by a data processing agreement that restricts them to processing only on our instructions:

  • Video conferencing - Zoom, running live lessons
  • Payment processing - Stripe, payments and tutor payouts
  • Cloud hosting / storage - hosting the platform and stored data
  • Analytics - understanding usage and improving the Services
  • Communication tools - Chatwoot, customer support chat/ticketing; transactional email
  • Website hosting - serving vokabl.com
  • Support and technical staff - responding to your support queries and resolving technical issues, including access to internal admin tools where needed to fulfil a request or fix a problem

We may also share information:

  • In a business transfer - e.g. a merger, acquisition, or sale of assets.
  • With review platforms (e.g. Trustpilot) - only if you choose to leave a review; the platform then acts as an independent controller of that information under its own privacy notice.
  • With other users - content you post in public areas of the Services (e.g. a public tutor profile) is visible to other users and may be publicly accessible.

We do not sell your personal information. Where a category above doesn't name a specific vendor, that reflects a deliberate choice to describe processors by function rather than list every one individually - you can request the current full list of our processors at any time by emailing privacy@vokabl.com.

5. Cookies and international transfers

We use cookies and similar technologies to operate and secure the Services, and for analytics. When you first visit, our cookie banner lets you choose which non-essential categories to allow; strictly necessary cookies are the only category set automatically. The categories we currently use are:

  • Strictly necessary cookies - required for core functionality, such as keeping you logged in and maintaining session security. These can't be switched off, as the Services won't work properly without them. No consent is required for this category.
  • Analytics cookies - set only if you consent. We use two analytics tools: Google Analytics (see Google's privacy policy at policies.google.com/privacy; you can also opt out via tools.google.com/dlpage/gaoptout) and PostHog (see PostHog's privacy policy at posthog.com/privacy; our PostHog data is stored in the EU, though PostHog may also process it in the United States through its own sub-processors, under the safeguards described below).

If we introduce additional categories in future, we will update this section and, where required, obtain your consent before they are set.

Some of our processors and personnel are located outside the UK and EEA. Where that's the case, we put a recognised legal safeguard in place before any transfer happens - which may include the processor's own certification under the UK Extension to the EU-U.S. Data Privacy Framework (a UK Government-approved "data bridge" for certified US companies), the European Commission's Standard Contractual Clauses, and/or the UK International Data Transfer Addendum, depending on what each individual processor offers and where they're located. A full list of the countries involved, which safeguard applies to which processor, and copies of those safeguards, are available on request by emailing privacy@vokabl.com.

vokabl is established in the United Kingdom. For privacy enquiries from users in the EEA, UK, or Switzerland, you can reach us using the contact details in the "Contact us" section below - our UK office handles enquiries from all these regions.

6. Retention, security, minors, and automated decisions

We keep different categories of data for different periods, reflecting what each is actually needed for - not a single blanket period. Where a period isn't fixed by law, we describe the trigger that starts deletion and the process that carries it out, rather than promising an exact number of days:

  • Account data (name, email, profile): retained while your account is active. Once you close your account, it is deleted or anonymised as part of our regular deletion process, typically within around 90 days.
  • Session recordings: deleted as part of our regular deletion process, typically within around 90 days of the session, unless an active dispute involving that specific recording is still open, in which case we keep it only until that matter is resolved.
  • Billing and payment records: retained for 6 years from the end of the relevant tax year, to meet UK tax and accounting record-keeping obligations (HMRC requirement) - this is a fixed legal minimum, not a target.
  • Prospective tutor applications: if unsuccessful, deleted as part of our regular deletion process, typically within around 6 months, unless you ask us to delete it sooner.
  • Active tutor data (profile, contact details, class assignments): retained while you are engaged as a vokabl tutor. Once that engagement ends, this data is deleted or anonymised as part of our regular deletion process - the exact timing depends on whether we need to retain any of it to resolve an open matter (e.g. an ongoing dispute) or to meet a separate legal obligation (payout-related financial records are retained under the billing/tax rule above, regardless of when the engagement ends).
  • Support and complaint correspondence: retained for as long as needed to resolve the matter and defend against related claims.
  • Marketing data: retained until you unsubscribe or 24 months of inactivity, whichever is sooner.

If you ask us to delete your personal data directly (see "Your privacy rights" below), we will act on that request within one month regardless of the timelines above - these routine deletion cycles describe what happens by default, not a limit on your right to request earlier deletion. Where we have no ongoing lawful basis to keep data, we delete or anonymise it, or - where technically unable to (e.g. backup archives) - securely isolate it from further processing until deletion is possible.

Keeping your information safe. We use appropriate technical and organisational measures designed to protect the personal information we process, including encryption of data in transit, access controls, and contractual security obligations on our processors. No system is 100% secure, and we cannot guarantee against all unauthorised access - use the Services within a secure environment on your end.

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the ICO (and, where relevant, other affected supervisory authorities) without undue delay and, where feasible, not later than 72 hours after becoming aware of it, in line with Article 33 GDPR/UK GDPR. Where the breach is likely to result in a high risk to you specifically, we will also notify you directly without undue delay, as required by Article 34.

Minors. vokabl's Services are intended for users aged 18 and over only. This is enforced through an age declaration at account registration; we do not offer a parental-consent or supervised-access pathway for under-18s. We do not knowingly collect personal information from anyone under 18. If we become aware that we have done so, we will deactivate the account and delete the data as soon as reasonably possible. If you believe a minor has provided us with personal information, contact privacy@vokabl.com.

Because the Services are not designed, marketed to, or reasonably likely to be accessed by children, we do not consider the ICO's Age Appropriate Design Code to apply to vokabl at this time. We will keep this assessment under review as the Services evolve.

Automated decision-making. We use an automated system to match students with tutors. A human does not routinely review each individual match before it's presented to you, though our team does step in where the system malfunctions or produces an unexpected result. We don't consider this matching process to have a legal or similarly significant effect on you in the way GDPR's automated decision-making rules are aimed at (for example, it doesn't determine your access to the Services, only which tutor is suggested first, and you're free to choose a different tutor at any time) - but we're keeping this under review as the matching system develops. If you'd like a human to look at a specific match, or if you believe our matching has treated you unfairly, contact privacy@vokabl.com.

Outside of tutor matching, we do not currently use your personal information to make decisions about you using solely automated means, without human involvement, that produce legal or similarly significant effects. If this changes, we will update this notice and explain the logic involved and your right to request human review.

7. Your privacy rights

If you are in the UK, EEA, or Switzerland, you have the right to:

  • access a copy of your personal information
  • rectify inaccurate or incomplete data
  • erase your data ("right to be forgotten")
  • restrict processing in certain circumstances
  • port your data to another provider, where technically feasible
  • object to processing based on legitimate interests or direct marketing
  • not be subject to solely automated decision-making with legal or similarly significant effects
  • withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal

To exercise any of these rights, submit a data subject access request or email privacy@vokabl.com. We will respond within one month of receiving your request, extendable by a further two months for complex or numerous requests, in which case we'll tell you why within the first month.

Opting out of marketing. Unsubscribe via the link in any marketing email, or reply "STOP"/"UNSUBSCRIBE" to SMS, or contact us directly. Service-related messages necessary for account administration are not affected.

Complaints. If you're unhappy with how we've handled your data, contact us first. If you're not satisfied with our response:

  • UK: Information Commissioner's Office - ico.org.uk/make-a-complaint, or 0303 123 1113, or Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
  • EEA: your local supervisory authority.
  • Switzerland: the Federal Data Protection and Information Commissioner.

We will acknowledge any complaint made directly to us within 30 days and keep you informed of progress.

Do-Not-Track. We do not currently respond to Do-Not-Track (DNT) browser signals, as no uniform technical standard for DNT has been finalised. If one is adopted that we're required to follow, we'll update this notice.

Updates to this notice. We may update this notice from time to time; the "Last updated" date at the top will change accordingly. Material changes will be notified via a prominent notice or direct communication.

Contact us. VOKABL LTD, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, England. Email: privacy@vokabl.com.

To review, update, or delete the data we collect from you, submit a data subject access request, or log in to your account settings to review/update your information directly, or email privacy@vokabl.com.

Back to Home