PRIVACY NOTICE · LAST UPDATED 12 OCTOBER 2026

Your information,
looked after properly.

How My Language Brain collects, uses and protects information about pupils, teachers and the schools we work with.

In short, for pupils

Your school uses My Language Brain to help you practise French and Spanish. Here is what that means for your information:

We save your answers, scores and progress so you can pick up where you left off and your teacher can see how you are getting on.
We only know you by the name your school gives us. We never ask for your email address, home address, date of birth or a photo of you.
Your teacher can see the work you do in class and for homework, and your speaking answers. Practice you choose to do on your own, your points and your avatar are kept for you. In some class games, classmates can see your name and score on a leaderboard.
Some writing and speaking activities are marked by an AI tool. It only sees your answer, never your name. AI can get things wrong, so ask your teacher if a mark looks odd.
We never sell your information, never show you adverts and never use your work to train AI.
Keep your PIN to yourself and sign out when you finish, especially on a shared iPad.
If something worries you, or you see someone else's work by mistake, tell your teacher.

Who we are

My Language Brain (Noah Price and Nick Miller, trading in partnership) (“MLB”, “we”, “us”) is an online language-practice service for secondary schools and for independent learners who use it without a school. You can contact us about anything in this notice at noah.price@mylanguagebrain.com. Noah Price is our privacy lead.

This notice explains how we handle personal information under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Schools and MLB: who decides

For pupil and classroom information, your school is in charge. The school decides which pupils and classes use MLB and what for. It is the “controller” of that information, and we act as its “processor”: we handle it only on the school's instructions, under a written Data Processing Agreement. If you have a question about your school's use of MLB, please contact the school first; we will help it answer you.

For our own business records, we are in charge. We are the controller of information about school staff who contact us or hold an account with us, of enquiries and correspondence, of contracts and invoices, and of the technical records we need to keep the service secure.

For independent learners, we are in charge. If you use MLB on your own, without a school, you sign in with a Google account that we have switched on for you, and we are the controller of your information. We hold what your Google account tells us (your name, email address and an account identifier) and the records your practice creates: answers, attempts, scores, progress, practice lists, saved speaking questions and answers, course progress, and your avatar and voice choices. We use it only to provide MLB to you and to keep the service secure; the rules on advertising, selling data and training AI below apply to you exactly as they do to pupils. Contact us directly about your information.

What we collect

Who	Information	Where it comes from
Pupils	Display name as set by the school, class membership, class code and PIN, answers, attempts, scores, timings, corrections, progress, saved work and avatar choice.	The school and the pupil's use of MLB.
Teachers	Name, school Google account email and account identifier, classes, homework and settings created, and records of support requests.	The teacher and the school.
Independent learners	Name, email address and account identifier from your Google account; answers, attempts, scores, timings, corrections, progress, practice lists, saved speaking questions and answers, course progress, and avatar and voice choices.	You, and your use of MLB.
School contacts	Names, job titles, work email addresses and telephone numbers, and contract and invoice details.	The school.
Everyone	Technical information needed to run the service: account identifiers, browser and device type, IP address, error records and security logs.	Your device, automatically, when you use MLB.

We do not ask for, and ask schools not to supply, pupils' email addresses, home addresses, dates of birth, photographs or any special category information (such as health, ethnicity or religion). Because pupils write freely in their answers, they are encouraged to use made-up details rather than private ones.

How we use it

Purpose	Lawful basis
Providing language practice, homework, marking and progress records to pupils and their teachers.	We act on the school's instructions. The school sets the lawful basis for its pupils' information, usually its public task or legitimate interests in educating pupils.
Providing language practice, progress records and AI marking to independent learners.	Performance of our agreement with you: the service you asked us to switch on.
Setting up and supporting teacher and school accounts, and answering enquiries.	Our legitimate interests in administering school access, supporting teachers and responding to enquiries. We use the professional contact and account information needed for those purposes, which staff would reasonably expect in their work with us. We balance these interests against their privacy and rights, limit access and use, and provide a right to object.
Keeping MLB secure, preventing misuse and fixing faults.	Our legitimate interest in running a safe and reliable service.
Invoicing and keeping business and tax records.	Our legitimate interests in administering school billing and payments, using the necessary business contact details that school staff would reasonably expect us to use, balanced against their privacy and rights. Our legal obligations apply to keeping tax and accounting records.
Occasional news about MLB to school staff.	Our legitimate interest in keeping customers informed. You can unsubscribe at any time. We never send marketing to pupils.

Scores and suggestions in MLB help teachers plan practice. They are never used on their own to make significant decisions about a pupil: that remains a matter for the teacher's professional judgement. We do not sell personal information, show advertising or build marketing profiles of anyone.

AI marking and speech

Two kinds of activity use artificial intelligence: Free Writing, where the AI underlines mistakes in an open-ended piece of writing for the learner to correct, suggests corrections if the learner asks for them and, when a part is unclear, turns the learner's English explanation of what they meant into a suggestion in French or Spanish (Free Writing gives no grade or score), and My GCSE / A Level speaking questions, where the AI checks and improves the answers a learner writes for their own exam questions and, when the learner asks, translates an answer between English and French or Spanish. The Beginners’ Course's Make it yours step, which builds on the same speaking-answers checker, uses it too. For these activities:

Only the text needed for the check is sent: the pupil's answer, the exercise, the language and, in Free Writing, any English explanation the pupil types to say what they meant. Pupils' names, PINs and account details are not sent.
The AI service is Claude, provided by Anthropic, processed in the United States under Anthropic's data processing terms, which include the UK International Data Transfer Addendum issued by the Information Commissioner. Anthropic's terms do not allow it to use this information to train AI models. Anthropic deletes it within 30 days, unless its safety systems flag a text as breaking its usage policy, in which case it may keep that text for up to two years.
AI feedback is labelled as coming from AI. It is a suggestion for learning, which teachers can review and override, and it is never used on its own to make decisions about a pupil. A school can ask us to switch AI marking off for its pupils at any time.
Every other MLB activity, including the vocabulary games, verb practice, Timed Test, translation practice, Unjumble, Spot the Mistakes, Dictation and the Beginners’ Course steps, is marked on the pupil's own device against answers written by our language teachers, with no AI involved. Speaking practice against a model answer compares words on the device in the same way.

Speaking into the microphone is always optional, and typing is available instead. When a pupil uses speech-to-text, the transcription is done by the pupil's own web browser (for example Google Chrome or Apple Safari), which may send the audio to its maker to convert it into text under that company's own terms. MLB never receives or stores audio recordings of pupils; only the resulting text is saved, as part of the pupil's answer.

The voices you hear in MLB are made by our own speech server, not by an outside AI or speech company. Almost everything is recorded in advance from the content our language teachers write. When some words have no recording yet, for example a pupil's own speaking answer or a word list a teacher has uploaded, the text is sent to our speech server to be turned into audio. Only the words to be spoken, the language and the chosen voice are sent: never names, PINs or account details. The server is rented from netcup GmbH in its data centre in Nuremberg, Germany, and is run by MLB. It keeps nothing: each request is handled in a temporary folder that is deleted as soon as the audio is made, and its records hold no text. The finished audio is stored with the rest of MLB's records in Google Cloud's London region. Audio of a pupil's own speaking answer is kept only in that pupil's account; other audio, such as the words of a word list, is kept and reused whenever anyone needs the same words.

Who we share it with

We share personal information only with the suppliers we need to run MLB, all bound by contract to protect it and to use it only on our instructions:

Supplier	What for	Location
Google Cloud and Firebase (Google Cloud EMEA Limited and affiliates, including Google LLC)	Database, backend processing, hosting and teacher sign-in.	Database and backend processing in London (europe-west2); sign-in and web delivery use Google's global network.
Anthropic (Anthropic, PBC and its affiliates)	AI marking of written and spoken answers, as described above.	United States, covered by the UK International Data Transfer Addendum.
netcup GmbH	The server on which MLB runs its own speech service, turning text into spoken audio, as described above. netcup provides the machine; it does not run the service or receive the text for its own use.	Nuremberg, Germany, which the UK recognises as giving adequate protection (UK adequacy regulations).
Google Workspace	Our email, for support and correspondence with schools.	Google's global network.

Inside a school, the pupil's teachers can see that pupil's classwork, homework and speaking answers. Practice a pupil chooses to do on their own, their points and their avatar are kept for the pupil and are not shown to teachers. We may also disclose information if the law requires it, or to protect someone's safety. If MLB's business is ever transferred, the information would pass to the new operator under the same protections and schools would be told first.

Where it is stored

Pupil learning records are stored in Google Cloud's London data centre region. AI marking is processed by Anthropic in the United States, protected by the UK International Data Transfer Addendum. Text to be spoken aloud is turned into audio on our own speech server in Nuremberg, Germany, which the UK recognises as giving adequate protection; the server keeps none of it. Some supporting services, such as teacher sign-in and the delivery of web pages, run on Google's global network and may involve limited processing outside the UK. Where information leaves the UK, it is protected by Google's data processing terms, which include the UK International Data Transfer Addendum and certification under the UK Extension to the EU–US Data Privacy Framework. We can provide details on request.

How long we keep it

Information	How long
Pupil work, progress and class records	For as long as the school uses MLB. When a school's agreement ends we return or delete its records, as the school chooses, within 30 days.
Individual pupils who leave	Deleted within 30 days of the school asking us to remove them.
Independent learners	For as long as you use MLB. Deleted within 30 days of you asking us to close your account.
Security and error logs	Up to 30 days, unless needed to investigate a specific incident.
Backup copies	Where backups exist, they expire within 30 days, so deleted information leaves them within that time.
Support emails	Up to 12 months after the matter is resolved.
Contracts and invoices	Six years after the end of the financial year they relate to, as required for tax purposes.

Keeping it secure

All information is encrypted in transit (HTTPS) and at rest in Google's data centres.
Access rules are enforced on our servers, not just in the app: a pupil can reach only their own class, and a teacher only the classes they teach.
Teachers sign in with an individually approved Google account. Pupils sign in with their class code, name and a personal PIN.
Access to the systems behind MLB is limited to its two operators.
We never ask for passwords by email, and we never sell or rent information.

If a breach affects a school's information, we will tell the school without undue delay and within 48 hours of becoming aware of it, and help it take any action needed, including notifying the Information Commissioner's Office where required.

Protections for children

MLB is designed for pupils in school. Its safeguards include:

Pupils use MLB through their school, which manages their accounts and any consent that is needed.
Pupils cannot upload photos of themselves; they choose from our set of illustrated brain avatars.
Pupils cannot add contact details, link other accounts or message other users.
There is no advertising, no marketing to pupils and no selling of data.
Privacy-protective settings are the default. Names and scores are shown to classmates only in activities a teacher chooses to run, such as a live class challenge.
Pupils' work and voices are never used to train AI.

Cookies and device storage

MLB uses no advertising or analytics cookies and no tracking technology. The app stores a small amount of information in your browser that is strictly necessary to provide the service you asked for: keeping you signed in, remembering settings such as sound and theme, and saving progress so an interrupted activity can resume. Because this storage is essential, it does not need your consent, and nothing is used to track you across other websites.

Signing out ends your session. On shared devices, please always sign out. This public website sets no cookies at all.

Your rights

You have the right to ask for a copy of your information, to have it corrected or deleted, to restrict or object to its use, and to move it to another service. Some rights apply only in certain circumstances.

For pupil and classroom records, please contact the school, which is in charge of that information; we will help it respond promptly. If you are an independent learner, or for anything else, email noah.price@mylanguagebrain.com. We respond within one month and do not charge. Please do not send PINs or pupil work in your first message.

If you are unhappy with how your information has been handled, please tell us so we can put it right. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

Changes and contact

We will update this notice when our practices change and show the date at the top. Where a change is significant, we will tell the schools that use MLB in advance.

Contact: noah.price@mylanguagebrain.com. See also our School Terms of Service and Data Processing Agreement.

Your information,looked after properly.