Your data, plainly explained

01What we collect

• •Account data: your email address and authentication credentials (passwords are hashed by our authentication provider; we never see them).
• •Profile data you choose to provide: your target CLB level and planned exam date.
• •Practice content: the writing, speaking, reading and listening submissions you make, and the AI evaluations generated from them.
• •Billing data: if you subscribe, Stripe processes your payment details. We store only your Stripe customer reference and subscription status — never card numbers.
• •Support messages: what you send through the contact, bug report and feature request forms, with the email address you provide.
• •Technical basics: session cookies needed to keep you signed in, and your language preference stored in your browser.

02What we use it for

• •Delivering the service: scoring your submissions, tracking your progress, and showing your dashboard.
• •Processing subscriptions and payments through Stripe.
• •Answering your support messages.
• •Improving evaluation quality — using aggregated, anonymised patterns, never your identity.

03Who processes your data

We use a small number of processors, each bound by their own data-protection commitments:

• •Supabase — database, authentication and hosting of your account and practice data (encrypted at rest).
• •Anthropic (via a secured proxy) — your practice submissions are sent for AI evaluation solely to generate your feedback.
• •Stripe — payment processing and subscription management (PCI-DSS Level 1 certified).
• •Google Fonts — the IBM Plex typefaces are loaded from Google's servers when pages render.

04What we never do

• •We never sell your personal data.
• •We never share your submissions for advertising.
• •We never claim your practice results are official exam data.

05How long we keep it

Your account data and practice history are kept while your account is active, so your progress tracking works. If you ask us to delete your account, we remove your personal data; anonymised, aggregated statistics that cannot identify you may be retained.

06Your rights

You can ask for access to the personal data we hold about you, correction of inaccurate data, deletion of your account and data, or a copy of your data in a portable format. Contact us through the Help Center and we will respond, usually within two business days.

07Security

All traffic is encrypted in transit (TLS). Data is encrypted at rest in a managed PostgreSQL database, and row-level security rules ensure each account can only access its own records. Payment credentials never touch our servers.

08Children

ScoreRoute is intended for adults preparing for Canadian immigration language exams and is not directed at children under 16.

09Changes to this policy

If we make material changes, we will update the date at the top of this page and, for significant changes, notify you in the app or by email.