Privacy Policy

1. Who we are

The website and courses are operated by Sara Toumi TCF INC trading as “Sara Toumi TCF Canada” (“we”, “us”, “our”), 2816 Sandalwood Drive, Ottawa, Ontario K1V 2T6, Canada. We are the controller of the personal information described in this policy.

Person responsible for personal information (privacy officer): our Privacy Officer, reachable at info@saratoumi.com.

2. Data we collect

Information you give us

• Account data: name, email address, username, password (stored encrypted), profile details you choose to add.
• Purchase data: billing name, email, phone, country, the courses you buy, order history. Card or wallet details are handled directly by our payment providers; we do not store full card numbers.
• Learning data: course enrolments, progress, quiz and assignment answers, level test answers and results, messages and questions you post in the learning platform.
• Communications: messages you send us by email, WhatsApp, contact forms or the AI assistant, and newsletter sign-ups.
• Live classes: your name and, if you turn them on, your camera, microphone and chat messages in Zoom sessions.
• Class recordings: we record our live Zoom classes in full. A recording can therefore include your voice, your image if your camera is on, your name and anything you write in the chat. Recordings are shared with the students of your group inside the learning platform so that everyone can review the lesson, and they stay available for the length of the course. If you do not want to appear, keep your camera off and use the chat; tell us before the class if you would like us to leave your questions out of the recording.

Information collected automatically

• Technical data: IP address, browser and device type, pages visited, date and time, collected in server logs by our hosting and security providers.
• Cookies and similar technologies: see section 10 and our Cookie Policy.
• Preferences: your language, dark mode and cookie choices, stored in your browser.

Information from others

• If you sign in with Google, we receive your name, email address and profile picture from Google.
• Payment providers tell us whether a payment succeeded.

3. How and why we use it

We do not use your personal information for automated decisions that have legal or similarly significant effects on you. The level test gives an indicative level only.

4. Who we share it with

We do not sell your personal information. We share it only with service providers who process it on our behalf under contract, or when the law requires it:

• Hosting, security and backups: Hostinger (hosting and content delivery), BlogVault/AirLift (backups, security and performance).
• Learning platform and shop: WordPress, Tutor LMS and WooCommerce (software running on our own server).
• Payments: Stripe, our payment provider, and the banks and card networks that process your payment. We never see or store your full card number.
• Live classes: Zoom Video Communications.
• Messaging: WhatsApp (Meta) when you choose to contact us there; our email provider.
• AI services: Groq, which processes the messages you type into the website chat to generate replies, and the AI provider used to evaluate free level test answers and generate feedback.
• Sign-in: Google, if you choose “Sign in with Google”.
• Embedded media: YouTube (Google), only after you accept media cookies or click to play a video.
• Fonts: Bunny Fonts (BunnyWay d.o.o., EU), which serves the website fonts without cookies.
• Authorities and advisers: tax authorities, courts, law enforcement, lawyers and accountants where required by law or to protect our rights.
• Business transfers: a buyer or successor if our business is sold or restructured, subject to this policy.

5. International transfers

Our providers may process data outside your country, including in the United States, the European Union and other countries. When personal data from the EU, EEA, UK or Switzerland is transferred to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses, the EU–US Data Privacy Framework where the provider is certified, or other lawful transfer mechanisms. You can ask us for more information.

6. How long we keep it

• Account and learning data: while your account is active. If you ask us to delete your account, we delete or anonymise it within 30 days, unless we must keep some of it.
• Orders and invoices: as long as tax and accounting laws require (usually 6 to 10 years, depending on the country).
• Support messages: up to 24 months after the conversation ends.
• Level test answers: up to 12 months.
• Class recordings: available to your group for the length of the course, then deleted within 90 days of the course ending.
• Newsletter: until you unsubscribe.
• Backups and security logs: up to 90 days.

7. Your rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you and get a copy (portability).
• Correct inaccurate or incomplete information.
• Delete your information and your account.
• Restrict or object to certain processing, including processing based on legitimate interests and direct marketing.
• Withdraw consent at any time, for example through Cookie settings or the unsubscribe link in emails. This does not affect processing that already took place.
• Complain to a data protection authority. In the EU, contact the authority in your country; in the UK, the ICO; in Canada, the Office of the Privacy Commissioner of Canada or your provincial commissioner.

To use your rights, including deleting your account, go to our Privacy requests page or email info@saratoumi.com. We will confirm your identity (usually by email) and reply within one month (GDPR) or 45 days (US state laws). We may extend this period where the law allows and will tell you why. We will not charge you or treat you differently for using your rights.

8. US state privacy rights

If you live in California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon or another US state with a consumer privacy law, you have the rights described in section 7, including to know, access, correct and delete your personal information, and to appeal our decision on your request by replying to our response.

• No sale or sharing: we do not sell personal information, and we do not share it for cross-context behavioural advertising or targeted advertising. We have not done so in the past 12 months.
• Global Privacy Control: our website treats a Global Privacy Control signal from your browser as a request to opt out, and turns off optional cookies automatically.
• Sensitive information: we do not use sensitive personal information to infer characteristics about you.
• Categories collected in the last 12 months: identifiers (name, email, IP address), commercial information (purchases), internet activity (pages visited), education information (course progress and results) and audio/visual information (only if you use your camera or microphone in live classes). Sources and purposes are described in sections 2 and 3; recipients in section 4.
• Authorised agents: you can use an authorised agent to make a request. We may ask for proof of authorisation and verify your identity.

9. Canada and Latin America

If you are in Canada, we handle personal information in line with the Personal Information Protection and Electronic Documents Act (PIPEDA) and, for Quebec residents, the Act respecting the protection of personal information in the private sector (Law 25). Our privacy officer is named in section 1. If you are in Brazil, you have the rights provided by the LGPD, including confirmation of processing, access, correction, anonymisation, portability, deletion and information about sharing. Residents of other Latin American countries can use the rights available under their local laws by contacting us.

10. Cookies

We use strictly necessary cookies to run the website, your account and your cart. Optional cookies, such as those set by embedded YouTube videos, are only used if you agree. You can change your choice at any time through Cookie settings. Details are in our Cookie Policy.

11. AI assistant

The chat assistant on our website uses an AI model provided by Groq to answer general questions about our courses. Messages you type are sent to Groq to generate a reply. We do not store chat conversations on our servers; they are kept only in your browser tab until you close it. Please do not share passwords, payment details, health information or other sensitive data in the chat. The assistant can make mistakes; for personal advice, contact us directly.

12. Children

You must be at least 16 years old to register. Our services are not directed to children under 16. We do not knowingly collect personal information from children under 13 (or under 16 in the EU/UK) without verified parental consent. If you believe a child has given us personal information, contact us and we will delete it.

13. Security

We use HTTPS encryption, access controls, security monitoring, regular backups and reputable providers to protect your information. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a data breach is likely to put your rights at risk, we will notify you and the authorities as required by law.

14. Changes to this policy

We may update this policy from time to time. We will change the “Last updated” date above and, for important changes, tell you by email or a notice on the website.

15. Contact us

Email: info@saratoumi.com or support@saratoumi.com
Post: Privacy Officer, Sara Toumi TCF INC, 2816 Sandalwood Drive, Ottawa, Ontario K1V 2T6, Canada