Privacy Policy

1. General provisions

This Policy explains which personal data of visitors and users of english-rooms.com (the “Site”) is processed, why, how long it is kept and how you can control it. The Policy is drawn up in accordance with Russian Federal Law No. 152-FZ of 27 July 2006 “On Personal Data”.

2. Operator

Contact for personal data requests: alexvkokin@gmail.com.

3. What data we process

• When you log in: your email address.
• In your profile, if you provide them: first name, last name, native language, photo.
• My vocabulary: the words and phrases you select in the subtitles of listening tracks and their place in the track, the notes you write for them (free text that you type yourself), the dates you save them and the “learned” marks, linked to your account.
• Technical login data: the session identifier in the er_session cookie, browser details (user agent), and the version and time of your consent. Your IP address is used to limit the request rate and is stored only as an irreversible hash.
• Bot check data (Google reCAPTCHA) on the login page: IP address, cookies, browser details and actions on the page.
• Traffic statistics (Google Analytics): the _ga and _gid cookies, IP address, pages viewed, device and browser details.

4. Purposes of processing

• creating an account and logging in with a one-time code sent to your email;
• maintaining your profile (name, photo, native language);
• keeping your personal vocabulary — the phrases you select and your notes — so you can return to them and practise listening;
• protecting the Site from spam, automated requests and abuse;
• traffic statistics to improve the Site (Google Analytics).

5. Legal basis

Login and profile data is processed on the basis of your consent (Article 6(1)(1) of Law No. 152-FZ). The consent is a separate document — “Consent to the processing of personal data” — and is given by ticking the box in the login form. Without consent, no login code is sent.

6. Processing operations

Collection, recording, systematisation, accumulation, storage, clarification (updating, changing), retrieval, use, transfer (provision, access) to the processors listed in section 7, blocking, deletion and destruction. Processing is automated.

7. Storage and transfer to third parties

Account and profile data is stored on the Site’s server in the Russian Federation.

To run the Site, data is transferred to the following recipients, including outside the Russian Federation (cross-border transfer):

• Resend Inc. (USA) — delivery of login code emails. Your email address and the text of the email are transferred. Resend Privacy Policy.
• Google LLC (USA), Google reCAPTCHA — checking that the login form is submitted by a human. IP address, cookies, browser details and actions on the page are transferred. The Google Privacy Policy and Terms of Service apply.
• Google LLC (USA), Google Analytics — traffic statistics. The _ga/_gid cookies, IP address, page, device and browser details are transferred. You can opt out by blocking cookies in your browser settings, with a content blocker or with the official Google browser add-on.

8. Retention periods

• one-time login codes — up to 1 day;
• login session — up to 30 days after your last activity; logging out ends the session;
• IP address hashes in rate-limit counters — up to 1 day;
• account and profile — until you withdraw consent or ask us to delete them;
• saved phrases, their notes, saving dates and “learned” marks — until you remove the phrase from My vocabulary or your account is deleted; a removed phrase and its note stay in the database for 24 hours and are then erased at the next clean-up, which runs at least once a day;
• Google reCAPTCHA and Google Analytics data — under Google’s rules.

9. Cookies

• er_session — keeps you logged in for 30 days; login does not work without it;
• PHPSESSID — technical session of the Site;
• _ga, _gid — Google Analytics;
• Google reCAPTCHA cookies — on the login page.

You can delete or block cookies in your browser settings; without er_session you will not be able to log in.

10. Your rights

You may request information about the processing of your data, ask for it to be clarified, blocked or deleted, withdraw your consent, and appeal against the operator’s actions to Roskomnadzor (the Russian data protection authority) or in court. You can change or remove your first name, last name, native language and photo yourself on the Account settings page.

11. Withdrawing consent and deleting your account

To withdraw your consent or delete your account, write to alexvkokin@gmail.com from the address linked to the account. Your account, profile, photo, saved vocabulary, sessions and login codes are deleted within 30 days of your request. Withdrawal does not affect the lawfulness of processing carried out before it.

12. Security measures

• connections to the Site are protected with HTTPS;
• login codes and session identifiers are stored only as hashes;
• the number of code attempts and email requests is limited;
• photos are re-saved without metadata (EXIF, location);
• only the operator has access to the server and the database.

13. Changes to this Policy

A new version is published on this page with its date and takes effect upon publication.