Privacy Policy

Last updated: August 5, 2026

1. Who we are

IELTS 9 (“we”, “our”, or “us”) operates the ielts9.io website and the IELTS 9 mobile application (together, the “Services”). IELTS 9 is operated by Okay Kacar, an individual sole proprietor based in the Republic of Türkiye, and is the data controller responsible for your personal data.

For any privacy question or to exercise your rights, contact us at support@ielts9.io. Our postal contact is: 34768 Istanbul, Türkiye.

2. Information we collect

  • Account data. Your email address, and (optionally) a display name, when you sign up. We use passwordless sign-in (one-time codes / magic links) or third-party sign-in (e.g. Google or Apple), so we do not store passwords.
  • User content. Essays, speaking recordings, transcripts, answers, and other content you submit for AI feedback or practice.
  • Usage & device data. Pages and tools used, clicks, session activity, device and browser type, operating system, and approximate location (country/region) derived from your IP address.
  • Subscription data. If you buy a subscription on the web, our payment processor (LemonSqueezy) handles the transaction and shares limited data with us (e.g. plan, status, billing country, and the last four digits / card brand). If you buy a subscription inside our iOS app, the purchase is processed by Apple through in-app purchase, and we use RevenueCat to manage and verify your subscription status. In both cases we never receive or store full card numbers.
  • Cookies & similar technologies. See our Cookie Policy for the full list and how to control them.

3. How we use your information

  • Provide, operate, and maintain the Services and your account.
  • Generate AI-powered feedback on your practice submissions.
  • Process subscriptions, billing, and customer support.
  • Measure and improve performance, features, and user experience.
  • Detect, prevent, and address fraud, abuse, and security issues.
  • Send you service-related and, where permitted, marketing communications (you can opt out at any time).
  • Comply with legal obligations.

4. Legal bases (EEA / UK users)

Where the GDPR (or UK GDPR) applies, we rely on: contract (to provide the Services you request), legitimate interests (to secure, analyze, and improve the Services), consent (for non-essential cookies and marketing, which you can withdraw at any time), and legal obligation (to meet tax, accounting, and other legal requirements).

5. AI processing

When you submit an essay or recording for feedback, the content is sent to our AI provider (OpenAI) to generate a response. This content is processed to provide the feature you requested and is not used by us to train public AI models. AI feedback is provided for practice and does not guarantee any specific exam result.

6. Service providers & sharing

We do not sell your personal data. We share it only with providers that process it on our behalf, under contract, to run the Services:

  • Supabase — authentication and database storage.
  • Cloudflare — hosting, delivery, and security.
  • OpenAI — AI feedback generation.
  • LemonSqueezy — payment processing and merchant-of-record for web subscriptions.
  • Apple and RevenueCat — in-app purchase processing and subscription management for iOS subscriptions.
  • PostHog (EU region) and our first-party analytics — product analytics.
  • Google — advertising and conversion measurement (only when you accept non-essential cookies).

We may also disclose data where required by law, to protect our rights, or in connection with a business transfer.

7. International transfers

We and our providers may process your data in countries outside your own, including the United States. Where required, such transfers are protected by appropriate safeguards such as the EU Standard Contractual Clauses.

8. Data retention

We keep personal data for as long as your account is active or as needed to provide the Services, then delete or anonymize it, except where a longer period is required for legal, tax, or fraud-prevention purposes. You can request deletion at any time (see below).

9. Your rights

Depending on where you live (including under the GDPR/UK GDPR and the CCPA/CPRA), you may have the right to:

  • Access the personal data we hold about you.
  • Correct inaccurate or incomplete data.
  • Delete your data (“right to be forgotten”).
  • Restrict or object to certain processing.
  • Receive a portable copy of your data.
  • Withdraw consent (e.g. for analytics or marketing) at any time.
  • Opt out of the “sale” or “sharing” of personal data — we do not sell your data.

To exercise any of these rights, email support@ielts9.io. You also have the right to lodge a complaint with your local data protection authority.

10. Security

We use encryption in transit, access controls, and reputable infrastructure providers to protect your data. No method of transmission or storage is completely secure, but we take reasonable measures to protect it.

11. Children's privacy

The Services are not directed to children under 13 (or the minimum age required in your country). We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version here and revise the “Last updated” date. Significant changes will be communicated where appropriate.

13. Contact us

Questions about this Privacy Policy? Email support@ielts9.io.