Effective 12 April 2026 · Version 1
Privacy Policy
This policy describes how IELTS Mate ("we", "us") collects, uses, and manages personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). It also describes our practices relevant to visitors from the European Union and United Kingdom.
1. Who we are
IELTS Mate is operated from Queensland, Australia.
Privacy and general enquiries: [email protected]
2. What personal information we collect
When you use IELTS Mate we collect and hold the following categories of personal information:
- Google account data — your email address, Google account ID, display name, and profile image, provided via Google OAuth when you sign in.
- Essay content — the full text of IELTS Writing Task 2 essays you submit for evaluation.
- AI evaluation results — band-style scores, structured feedback, and inline comments generated by the AI in response to your essays.
- Payment and billing data — Stripe customer ID, purchase records, and credit ledger entries. We do not store your card details; these are held by Stripe.
- IP addresses — logged at account creation and essay submission for anti-abuse purposes.
- Device identifier — a randomly generated device ID stored in the
_didbrowser cookie (see section 8). - Token usage logs — per-account records of AI model input/output token usage, linked to your account for operational monitoring, service administration, and abuse prevention.
We collect this information directly from you (via sign-in and essay submission) and automatically (IP address, device cookie).
3. Why we collect it
- Google account data — to authenticate you and identify your account across sessions.
- Essay content and evaluation results — to provide the core essay evaluation service and display results to you.
- Payment data — to process credit purchases, issue refunds, and maintain an audit trail required for financial and legal compliance.
- IP addresses and device ID — to detect and prevent abuse of the free evaluation credit and submission limits, and to protect other users.
- Token usage logs — to monitor AI model costs and service health.
4. How we use automated decision-making
Essay evaluation is performed entirely by an AI model (see section 5). The scores and feedback you receive are generated automatically without human review. These are practice estimates only and do not constitute official IELTS results. See our Terms of use for more detail.
Rate-limiting decisions (temporary blocks on creating or submitting essays) are also made automatically based on IP address and device ID signals. If you believe you have been incorrectly blocked, contact us at [email protected].
5. Third-party service providers
We share personal information with the following service providers only to the extent necessary to operate the service:
- Google LLC (United States) — authentication via Google OAuth.
- Amazon Web Services (Australia) — essay content and task descriptions are sent to the AWS Bedrock service in the
ap-southeast-2(Sydney) region for AI evaluation. The AI model is supplied by Anthropic. - Stripe Inc (United States) — payment processing. Stripe stores card details under its own PCI-DSS certified infrastructure.
- Cloudflare Inc (United States)— network and CDN infrastructure. When Cloudflare proxying is active, your IP address passes through Cloudflare's network.
We do not sell your personal information to any third party.
6. International data transfers
Google, Stripe, and Cloudflare are US-based companies and process data in the United States and other countries. AWS Bedrock processes AI requests in the ap-southeast-2 Sydney region. Where data is transferred overseas, we use providers that maintain appropriate safeguards (including standard contractual clauses and certifications where applicable).
7. Data retention
We retain your personal information for as long as your account is active or as required to provide the service and comply with our legal obligations (including financial record-keeping requirements). If you request deletion of your data (see section 9), we will delete or de-identify your personal information where reasonably practicable, subject to any information we are required or permitted to retain for legal, accounting, fraud-prevention, or security purposes, including payment records.
8. Cookies
We set one first-party cookie:
_did(device identifier) — a randomly generated UUID stored for up to 1 year. It is used solely for anti-abuse rate-limiting (for example, to prevent a single device from consuming multiple free evaluation credits). It is not used for advertising or cross-site tracking.
We also use authentication cookies set by NextAuth. These are persistent cookies that remain valid for up to 30 days unless cleared earlier.
9. Your rights — access, correction, and deletion
Under the Australian Privacy Principles you have the right to:
- Access the personal information we hold about you.
- Correct information that is inaccurate, out of date, or incomplete.
- Request deletion of your account and personal data by emailing us at [email protected]. We will action deletion requests within 30 days.
If you are located in the European Union or United Kingdom, you also have rights under the GDPR / UK GDPR, including the right to data portability and the right to object to automated processing.
To exercise any of these rights, contact us at [email protected].
10. Security
We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, including encrypted data transmission (HTTPS), access controls, and security-hardened infrastructure. In the event of a data breach likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches scheme.
11. Complaints
If you have a concern about how we have handled your personal information, please contact us first at [email protected]. If you are not satisfied with our response, you may lodge a complaint with the OAIC at oaic.gov.au.
12. Changes to this policy
We may update this policy from time to time. The effective date at the top of this page will reflect when the latest version was published. Material changes will be communicated via the app where practicable.
IELTS is a registered trademark of the British Council, IDP: IELTS Australia, and Cambridge Assessment English. IELTS Mate is not affiliated with, endorsed by, or connected to these organisations.