PRIVACY NOTICE · LAST UPDATED 27 SEPTEMBER 2026

Your information,
looked after properly.

How My Language Brain collects, uses and protects information about pupils, teachers and the schools we work with.

In short, for pupils

Your school uses My Language Brain to help you practise French and Spanish. Here is what that means for your information:

We save your answers, scores and progress so you can pick up where you left off and your teacher can see how you are getting on.
We only know you by the name your school gives us. We never ask for your email address, home address, date of birth or a photo of you.
Your teacher can see your work. In some class games, classmates can see your name and score on a leaderboard.
Some writing and speaking activities are marked by an AI tool. It only sees your answer, never your name. AI can get things wrong, so ask your teacher if a mark looks odd.
We never sell your information, never show you adverts and never use your work to train AI.
Keep your PIN to yourself and sign out when you finish, especially on a shared iPad.
If something worries you, or you see someone else's work by mistake, tell your teacher.

Who we are

My Language Brain (Noah Price and Nick Miller, trading in partnership) (“MLB”, “we”, “us”) is an online language-practice service for secondary schools. You can contact us about anything in this notice at noah.price@mylanguagebrain.com. Noah Price is our privacy lead.

This notice explains how we handle personal information under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Schools and MLB: who decides

For pupil and classroom information, your school is in charge. The school decides which pupils and classes use MLB and what for. It is the “controller” of that information, and we act as its “processor”: we handle it only on the school's instructions, under a written Data Processing Agreement. If you have a question about your school's use of MLB, please contact the school first; we will help it answer you.

For our own business records, we are in charge. We are the controller of information about school staff who contact us or hold an account with us, of enquiries and correspondence, of contracts and invoices, and of the technical records we need to keep the service secure.

What we collect

Who	Information	Where it comes from
Pupils	Display name as set by the school, class membership, class code and PIN, answers, attempts, scores, timings, corrections, progress, saved work and avatar choice.	The school and the pupil's use of MLB.
Teachers	Name, school Google account email and account identifier, classes, homework and settings created, and records of support requests.	The teacher and the school.
School contacts	Names, job titles, work email addresses and telephone numbers, and contract and invoice details.	The school.
Everyone	Technical information needed to run the service: account identifiers, browser and device type, IP address, error records and security logs.	Your device, automatically, when you use MLB.

We do not ask for, and ask schools not to supply, pupils' email addresses, home addresses, dates of birth, photographs or any special category information (such as health, ethnicity or religion). Because pupils write freely in their answers, they are encouraged to use made-up details rather than private ones.

How we use it

Purpose	Lawful basis
Providing language practice, homework, marking and progress records to pupils and their teachers.	We act on the school's instructions. The school sets the lawful basis for its pupils' information, usually its public task or legitimate interests in educating pupils.
Setting up and supporting teacher and school accounts, and answering enquiries.	Our legitimate interests in administering school access, supporting teachers and responding to enquiries. We use the professional contact and account information needed for those purposes, which staff would reasonably expect in their work with us. We balance these interests against their privacy and rights, limit access and use, and provide a right to object.
Keeping MLB secure, preventing misuse and fixing faults.	Our legitimate interest in running a safe and reliable service.
Invoicing and keeping business and tax records.	Our legitimate interests in administering school billing and payments, using the necessary business contact details that school staff would reasonably expect us to use, balanced against their privacy and rights. Our legal obligations apply to keeping tax and accounting records.
Occasional news about MLB to school staff.	Our legitimate interest in keeping customers informed. You can unsubscribe at any time. We never send marketing to pupils.

Scores and suggestions in MLB help teachers plan practice. They are never used on their own to make significant decisions about a pupil: that remains a matter for the teacher's professional judgement. We do not sell personal information, show advertising or build marketing profiles of anyone.

AI marking and speech

Some writing and speaking activities use artificial intelligence to check grammar and spelling, suggest corrections or compare a pupil's answer with a model answer. For these activities:

Only the text needed for the check is sent: the pupil's answer, the exercise and the language. Pupils' names, PINs and account details are not sent.
The AI service is Claude, provided by Anthropic, processed in the United States under Anthropic's data processing terms, which include the UK International Data Transfer Addendum issued by the Information Commissioner. Anthropic's terms do not allow it to use this information to train AI models. Anthropic deletes it within 30 days, unless its safety systems flag a text as breaking its usage policy, in which case it may keep that text for up to two years.
AI feedback is labelled as coming from AI. It is a suggestion for learning, which teachers can review and override, and it is never used on its own to make decisions about a pupil. A school can ask us to switch AI marking off for its pupils at any time.
Most MLB activities, including vocabulary games, verb practice, Timed Test and translation practice, are marked on the pupil's own device against answers written by our teachers, with no AI involved.

Speaking into the microphone is always optional, and typing is available instead. When a pupil uses speech-to-text, the transcription is done by the pupil's own web browser (for example Google Chrome or Apple Safari), which may send the audio to its maker to convert it into text under that company's own terms. MLB never receives or stores audio recordings of pupils; only the resulting text is saved, as part of the pupil's answer.

Who we share it with

We share personal information only with the suppliers we need to run MLB, all bound by contract to protect it and to use it only on our instructions:

Supplier	What for	Location
Google Cloud and Firebase (Google Cloud EMEA Limited and affiliates, including Google LLC)	Database, backend processing, hosting and teacher sign-in.	Database and backend processing in London (europe-west2); sign-in and web delivery use Google's global network.
Anthropic (Anthropic, PBC and its affiliates)	AI marking of written and spoken answers, as described above.	United States, covered by the UK International Data Transfer Addendum.
Google Workspace	Our email, for support and correspondence with schools.	Google's global network.

Inside a school, the pupil's teachers can see that pupil's work. We may also disclose information if the law requires it, or to protect someone's safety. If MLB's business is ever transferred, the information would pass to the new operator under the same protections and schools would be told first.

Where it is stored

Pupil learning records are stored in Google Cloud's London data centre region. AI marking is processed by Anthropic in the United States, protected by the UK International Data Transfer Addendum. Some supporting services, such as teacher sign-in and the delivery of web pages, run on Google's global network and may involve limited processing outside the UK. Where information leaves the UK, it is protected by Google's data processing terms, which include the UK International Data Transfer Addendum and certification under the UK Extension to the EU–US Data Privacy Framework. We can provide details on request.

How long we keep it

Information	How long
Pupil work, progress and class records	For as long as the school uses MLB. When a school's agreement ends we return or delete its records, as the school chooses, within 30 days.
Individual pupils who leave	Deleted within 30 days of the school asking us to remove them.
Security and error logs	Up to 30 days, unless needed to investigate a specific incident.
Backup copies	Where backups exist, they expire within 30 days, so deleted information leaves them within that time.
Support emails	Up to 12 months after the matter is resolved.
Contracts and invoices	Six years after the end of the financial year they relate to, as required for tax purposes.

Keeping it secure

All information is encrypted in transit (HTTPS) and at rest in Google's data centres.
Access rules are enforced on our servers, not just in the app: a pupil can reach only their own class, and a teacher only the classes they teach.
Teachers sign in with an individually approved Google account. Pupils sign in with their class code, name and a personal PIN.
Access to the systems behind MLB is limited to its two operators.
We never ask for passwords by email, and we never sell or rent information.

If a breach affects a school's information, we will tell the school without undue delay and within 48 hours of becoming aware of it, and help it take any action needed, including notifying the Information Commissioner's Office where required.

Protections for children

MLB is designed for pupils in school. Its safeguards include:

Pupils use MLB through their school, which manages their accounts and any consent that is needed.
Pupils cannot upload photos of themselves; they choose from our set of illustrated brain avatars.
Pupils cannot add contact details, link other accounts or message other users.
There is no advertising, no marketing to pupils and no selling of data.
Privacy-protective settings are the default. Names and scores are shown to classmates only in activities a teacher chooses to run, such as a live class challenge.
Pupils' work and voices are never used to train AI.

Cookies and device storage

MLB uses no advertising or analytics cookies and no tracking technology. The app stores a small amount of information in your browser that is strictly necessary to provide the service you asked for: keeping you signed in, remembering settings such as sound and theme, and saving progress so an interrupted activity can resume. Because this storage is essential, it does not need your consent, and nothing is used to track you across other websites.

Signing out ends your session. On shared devices, please always sign out. This public website sets no cookies at all.

Your rights

You have the right to ask for a copy of your information, to have it corrected or deleted, to restrict or object to its use, and to move it to another service. Some rights apply only in certain circumstances.

For pupil and classroom records, please contact the school, which is in charge of that information; we will help it respond promptly. For anything else, email noah.price@mylanguagebrain.com. We respond within one month and do not charge. Please do not send PINs or pupil work in your first message.

If you are unhappy with how your information has been handled, please tell us so we can put it right. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

Changes and contact

We will update this notice when our practices change and show the date at the top. Where a change is significant, we will tell the schools that use MLB in advance.

Contact: noah.price@mylanguagebrain.com. See also our School Terms of Service and Data Processing Agreement.

Your information,looked after properly.