Last updated: June 11, 2026
At Bandami, we take your privacy seriously. Bandami is an independent IELTS preparation and practice platform. We are not an official IELTS testing centre, nor are we affiliated with Cambridge, IDP, or the British Council. This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and your rights regarding your data when you use our IELTS preparation service.
Bandami ("we", "us", "our") is the data controller for the personal data processed through this Service. You can reach us at contacto@bandami.com.
| Category | Examples | Purpose |
|---|---|---|
| Account data | Email address, full name, password (hashed with bcrypt) | Account creation, authentication, communication |
| Profile data | Subscription tier, avatar URL (if provided) | Service personalization, plan management |
| Submitted content | Writing essays (text), speaking audio recordings, transcriptions | AI evaluation and feedback generation |
| Payment data | Polar.sh customer/transaction ID (we do not store payment card numbers) | Subscription management and billing |
| Google OAuth data | Name, email, Google ID (if you sign in with Google) | Authentication |
| Communications | Emails and messages sent to our support | Customer support |
| Category | Examples | Purpose |
|---|---|---|
| Usage data | Number of evaluations, exam types, scores, time spent | Service analytics, usage tracking, dashboard stats |
| Technical data | IP address (used for rate limiting only, not stored long-term), browser type, device info, timestamps | Security, rate limiting, debugging |
| AI processing metadata | AI model used, tokens consumed, processing duration | Service optimization, cost tracking |
We use your personal data exclusively for:
If you are in the European Economic Area (EEA) or UK, our legal bases for processing your data are:
We share your data only as necessary to provide the Service:
| Provider | Data Shared | Purpose | Privacy Policy |
|---|---|---|---|
| Google (Gemini) | Writing essays, speaking transcriptions | AI evaluation and feedback generation | Google Privacy Policy |
| OpenAI (GPT) | Writing essays, speaking transcriptions | AI evaluation and feedback generation | OpenAI Privacy Policy |
| Groq (LLaMA) | Writing essays, speaking transcriptions | AI evaluation and feedback generation (fallback) | Groq Privacy Policy |
Important: Per Google's, OpenAI's, and Groq's data usage policies, data submitted through their APIs is not used to train or improve their models. Your essays and recordings are processed ephemerally and are not retained by these providers beyond the processing period.
We may disclose your data if required by law, court order, or governmental regulation. We may also disclose data to protect the rights, property, or safety of Bandami, our users, or the public.
We do not sell, rent, or trade your personal data to third parties for their marketing purposes.
We implement appropriate technical and organizational measures to protect your data:
No method of electronic transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.
Depending on your jurisdiction, you have the following rights:
To exercise any of these rights, email us at contacto@bandami.com. We will respond within 30 days. We may need to verify your identity before processing your request.
Bandami does not use cookies for the core Service functionality. Authentication is handled via JWT tokens stored in the client application (e.g., localStorage or secure cookies managed by your frontend application).
We do not use third-party analytics, advertising cookies, or tracking pixels. If this changes in the future, we will update this policy and provide notice.
Bandami is not directed to children under 13. We do not knowingly collect personal data from children under 13. If we become aware that a child under 13 has provided us with personal data, we will delete it immediately.
Your data may be processed in countries other than your country of residence, including the United States (where OpenAI, Google, Google Cloud, Groq, and Polar.sh servers are located), Chile (where Bandami is based), and the European Union (where Brevo servers are located).
When we transfer data internationally, we rely on appropriate safeguards such as Standard Contractual Clauses or rely on the service provider's certification under applicable data protection frameworks (e.g., EU-US Data Privacy Framework, where applicable).
In the event of a data breach involving your personal data, we will notify affected users via email and appropriate authorities within 72 hours of becoming aware of the breach, as required by applicable law.
We may update this Privacy Policy from time to time. Material changes will be communicated via email or through the Service. The "Last updated" date at the top will reflect the most recent changes.
For questions, concerns, or to exercise your data rights:
If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local data protection authority.