Privacy Policy

Effective date: April 25, 2026 Last updated: April 26, 2026

1. Who we are

TeachLex is an ESL/EFL test management platform operated by James Saunders-Wyndham as an individual proprietor based in Osaka, Japan ("TeachLex", "we", "us", "our").

You can contact us about this policy at privacy@teachlex.com.

TeachLex is, during its beta phase, a small operation. We tell you that upfront because it shapes how this policy reads — it is written to be honest and specific, not to perform compliance.

2. What this policy covers

This policy explains:

• What data we collect from teachers, students, and visitors to teachlex.com
• Why we collect it
• Who we share it with
• Where it is stored
• How long we keep it
• What rights you have

It applies to the TeachLex web application, the TeachLex marketing site, and any email we send you. It does not apply to third-party services linked from TeachLex (for example, a school's own login page, or Google Classroom), which have their own policies.

3. Who is in charge of what

TeachLex is used by teachers to create tests and by students to take them. That creates two kinds of data relationships:

Teacher accounts. You create an account and give us your details directly. TeachLex is the controller of that data — we decide how it is used, within what you agree to in this policy.

Student accounts and student work. Students join a class that their teacher set up. The teacher decides what assignments are given, what integrity capture is enabled, and who can see submissions. For student data, TeachLex acts as a processor on behalf of the teacher or institution — we process it according to the teacher's instructions and the limits of this policy. If you are a student and you have a question about how your data is being used in a specific class, the first person to ask is your teacher.

This distinction matters legally. It also matters practically: your teacher controls what happens in the classroom, and we control what happens in the platform.

4. Data we collect

4.1 Account information

When you sign up as a teacher:

• Name, email address, and profile photo (from Google OAuth, if you sign in that way)
• The institution you teach at, if you choose to share it
• Account settings and preferences

When a student joins a class:

• Name, email address, and profile photo (from Google OAuth, if they sign in that way)
• The class they joined (via enrollment code, QR code, or Google Classroom import)

4.2 Educational content

Teachers create, and we store:

• Tests, test questions, reading passages, grading rubrics, and teacher feedback
• Class names, terms, target CEFR levels, and enrollment codes
• Writing assignments and their instructions

Students create, and we store:

• Answers to multiple-choice, true/false, short-answer, and essay questions
• Writing submissions and drafts
• Time spent on each test or assignment
• Grades and feedback received

4.3 Academic integrity data

For writing assignments and essays, TeachLex captures behavioral data during composition to help teachers evaluate work authentically. This is one of the most sensitive things we store, so we are explicit about it:

• Keystroke timing — the intervals between keypresses (not the identity of the keys themselves)
• Paste events — the fact that a paste was attempted (paste is blocked in the student text area)
• Tab-switch events — when the student moved away from the writing window and for how long
• Composition snapshots — word count at intervals, to reconstruct how the piece was written over time
• Mouse interaction patterns — aggregated, used to generate a heatmap of where attention was during the session

This data is visible to the student's teacher. It is not sold, shared with other teachers, or used to build profiles outside the class. It exists to give teachers evidence to trust their students' work, not to build a surveillance record. Students are told in the platform that this capture is happening before they begin a writing session.

4.4 Technical data

Like most web applications, we collect:

• Log data (IP address, browser type, operating system, pages visited, error reports)
• Cookies required for authentication and to keep you logged in
• Email delivery metadata (whether transactional emails were opened or bounced)

We do not use advertising cookies or third-party tracking pixels on the application.

4.5 Data we don't collect

For the avoidance of doubt, TeachLex does not collect:

• Payment card details (if and when paid plans launch, payments will be processed by a third party such as Stripe, not stored by us)
• Government identifiers (student ID numbers, national IDs, social security numbers)
• Location data beyond what IP addresses reveal

5. Why we collect it, and how we use it

We use your data to:

1. Provide the service — create accounts, store tests, grade responses, send results
2. Operate AI features — generate test questions, grade short answers and essays, produce teacher comments (see section 6)
3. Improve the platform — identify bugs, understand which features are used
4. Communicate with you — service announcements, grade publication notifications, support responses
5. Keep the platform secure — prevent abuse, enforce our Terms of Service
6. Meet our legal obligations

We do not:

• Sell your data to anyone
• Share it with advertisers
• Use student data to build student profiles outside the classes they are in
• Use your data to train AI models (see section 6 for detail on how this works)

6. AI processing and Anthropic

TeachLex uses the Anthropic Claude API for its AI features: test generation, short-answer and essay grading, writing profile analysis, and teacher comment generation.

When you use an AI feature:

• The content necessary for the task (for example, a student's essay and the grading rubric) is sent to Anthropic's API
• Anthropic processes the request and returns the result
• TeachLex stores the result with the corresponding response record in our database

We use Anthropic under its Commercial API terms. Under those terms:

• Anthropic does not use API inputs or outputs to train its models
• API logs are retained by Anthropic for a limited period (currently seven days) for abuse monitoring, then deleted
• Anthropic's own privacy practices are described at https://www.anthropic.com/legal/privacy

This means student work is processed by an AI system to produce a grade or analysis, but it does not become part of any AI model's training data.

7. Research use of aggregate data

TeachLex may use anonymized, aggregate data from teacher accounts that have explicitly consented to research participation, for the purpose of building public ESL/EFL research outputs (academic publications, benchmarks, and pedagogical tools).

Research participation is opt-in only. The default for every new account is no participation. Teachers can grant or revoke consent at any time from their account settings.

What is never included in research data, regardless of consent:

• Student names
• Teacher names or institution names
• Specific class grades or individual student scores
• Identifiable writing samples or essays
• Any data that could re-identify a specific student, class, or institution
• Training data for AI models (no TeachLex data is ever used to train AI systems, by us or by Anthropic)

What may be included only when a teacher consents:

• Population-level keystroke timing distributions
• Aggregate vocabulary usage patterns across CEFR levels
• Composition timeline shape patterns across thousands of submissions
• Error type frequency distributions

Research outputs are aggregate statistics, never individual records. Detailed terms are described on our Research Participation page.

8. Who we share data with

We share data only with the service providers we need to operate the platform. These are our sub-processors:

We may also share data if:

• You direct us to (for example, when you choose to import a Google Classroom roster)
• We are required to by law (court order, valid subpoena, regulatory request)
• We need to protect the safety of a user or the integrity of the platform

We will never share student data for marketing, advertising, or profiling purposes.

9. Where your data is stored, and international transfers

Your data is primarily stored in Supabase's Tokyo region (ap-northeast-1). This means that for most of its life, your data remains in Japan.

Some processing necessarily involves transferring data outside Japan:

• AI features send data to Anthropic in the United States
• The application is served through Vercel, whose infrastructure is global
• Email is delivered via Resend in the United States
• If you use Google sign-in or Google Classroom import, you authorize a transfer to Google's infrastructure

For users in Japan: by creating an account and using TeachLex, you consent to the cross-border transfer of your personal information to the service providers listed above, whose protections we consider substantially equivalent to APPI standards under contractual safeguards. You can withdraw this consent at any time by closing your account (see section 12).

For users in the European Economic Area, United Kingdom, or Switzerland: GDPR and equivalent laws apply to the processing of your data. Our legal basis for processing is (a) performance of our contract with you (the Terms of Service), (b) our legitimate interest in operating the platform, and (c) your consent where required.

10. How long we keep data

If a teacher deletes their account, all associated classes, tests, and student responses in those classes are deleted with it.

11. How we protect your data

We take security seriously because the consequences of not doing so are serious:

• All connections to TeachLex are encrypted using TLS
• Data at rest is encrypted by Supabase using AES-256
• Access to the database is restricted by row-level security policies so that teachers can only see their own classes, and students can only see their own work
• Administrative access is limited to the operator (James) and requires two-factor authentication
• We log significant account actions so unusual activity can be investigated

No system is perfectly secure. If we learn of a data incident that affects you, we will notify you and the relevant authorities within the timeframes required by law (in Japan, generally three to five days).

12. Your rights

You have the following rights regarding your data. These apply to everyone; some of them are explicitly required by laws such as APPI (Japan), GDPR (EU/UK), the Australian Privacy Principles, and PIPEDA (Canada):

• Access — get a copy of the data we hold about you
• Correction — ask us to correct anything that is wrong or out of date
• Deletion — ask us to delete your data, subject to our legal obligations
• Portability — receive your data in a structured, machine-readable format (CSV export is built into the platform for your test data)
• Restriction or objection — ask us to stop certain processing, or limit it
• Withdraw consent — where processing is based on your consent
• Complain — to your local data protection authority. In Japan that is the Personal Information Protection Commission (https://www.ppc.go.jp).

To exercise any of these, email privacy@teachlex.com from the email address on your account. We will respond within 30 days.

For students under 18. Many of the teachers using TeachLex work with adult learners, but some teach minors. If you are a minor, or the parent or guardian of a minor using TeachLex, you can contact us at the address above to ask about or request changes to the student's data. The teacher who assigned the class is also an appropriate first point of contact.

13. Children

TeachLex is designed for use by teachers and their students in formal educational settings. We do not target the service at children under 13, and we do not knowingly collect personal information from children under 13 without the involvement of the teacher or school that has granted them access.

If you believe a child under 13 has created an account on TeachLex without the knowledge of their teacher or school, please contact us and we will investigate and, if appropriate, delete the account.

14. Cookies and similar technologies

We use a small number of cookies, all of them necessary for the service to function:

• An authentication cookie to keep you logged in
• A session cookie used by Supabase to maintain your login state
• Preference cookies that remember interface settings (for example, sidebar state)

We do not use advertising, analytics-profiling, or third-party tracking cookies in the application.

15. Changes to this policy

We will update this policy from time to time. When we make a material change, we will:

• Post the updated policy with a new "Last updated" date
• Notify you by email to the address on your account at least 14 days before the change takes effect
• Summarize what changed at the top of the policy

Continued use of TeachLex after the effective date of an update means you accept the revised policy. If you do not, you can close your account before the effective date.

16. Contact

For anything in this policy, including to exercise your rights, email:

privacy@teachlex.com

James Saunders-Wyndham Operator, TeachLex Osaka, Japan