Privacy Notice

1. Who this notice is about

Norlecta is a digital English-learning platform (structured speaking programmes, a levelled Reading Library and Literature Corner, classroom activities, and a personal portfolio and progress layer). This notice explains what personal data Norlecta processes today, where it is kept, who can receive it, and the choices you have. It describes the service as it is actually built now; features that are planned but not yet live are identified as such and are not described as if they were operating.

For questions about this notice, contact contact@norlecta.com.

2. Our approach

Your work is private to you by default. Your account details, progress, results, saved writing and recordings are kept in the browser on the device you use, and none of this is sent to Norlecta. Your work reaches an instructor only as a checkpoint submission (section 6); in the current version a submission stays in the browser where you make it and is not transmitted to Norlecta, to an instructor or to another device. Norlecta does not run advertising trackers or third-party analytics. No AI feature is active in the current version: there is no AI conversation, no transcription of your speech and no AI evaluation. Two uses of AI are approved for later versions: a spoken practice conversation (the Coach Podcast) and provisional evaluations prepared for instructors. Where AI is used, it supports learning and supports your instructor: it never produces an official result, and it never decides your grade or your level. An AI-prepared evaluation is a provisional draft written for your instructor, who may accept, adjust, override or ignore it; final academic authority rests with the instructor, and provisional AI values are not shown to you. Before either use starts, this notice will be updated to describe the data involved, the provider and any transfer abroad.

3. The data we process

Your account. To create an account you enter your full name and your email address, and you declare that you are 18 or over. Norlecta keeps your email address, the time you created the account and your declaration in the browser on that device, and keeps your name and email address in that browser's sign-in session. If you had signed in on that device before the declaration was introduced, the email address and name of that earlier sign-in are also kept there. Your browser also creates an internal identifier for your account, so that your progress and saved work stay separate from those of any other account used on the same device. Norlecta does not ask for a password, and the account has none. There is no Norlecta account server yet: your account exists only in the browser where you created it, and none of these details is sent to Norlecta.

Your acceptance of the Terms and your confirmation that you read the notices. To create an account you also accept the Terms of Use and confirm that you have read this Privacy Notice and the KVKK Clarification Text. Neither is consent, and creating an account does not depend on consent. Your browser records both with your account: the wording you confirmed, the version of the legal texts and the time. The record is kept only with your account in that browser and is not sent to Norlecta, so Norlecta does not hold a copy of it. An account created before this record was introduced has none, and none is added to it later.

Your declaration that you are 18 or over. When you create an account, Norlecta records that you declared "I'm 18 or over": the wording you confirmed, its version, when you made the declaration, and whether you made it when registering or later, after signing in. Today this record is kept with your account on your device. If accounts are later kept on Norlecta's systems, which is planned and not yet in operation, the record will be kept with the account there. Norlecta does not ask for your date of birth or an identity document, and does not verify the declaration.

Learning and progress. Which activities you have opened or completed, reading progress, and saved or bookmarked materials. These are kept on your device.

Assessment results. Objective practice results (for example first, current and best attempts, and category practice results), and the checkpoint results of each checkpoint you submit. These are practice results only; they are not a proficiency certificate, a CEFR score, or a guaranteed grade.

Portfolio content. Writing you save, and speaking recordings you choose to make (see section 4), together with the version history of that work. These are kept on your device. If you submit a checkpoint (section 6), your browser also keeps the submission: the checkpoint, its results, the recordings and writing it includes, the name and class you entered, the instructor it is addressed to and the time. A record of a share made before checkpoint submissions is kept in the same way. These records are kept on your device too.

If you contact us. If you email Norlecta, we process what you send in order to reply.

4. Instructional audio is not the same as your recordings

Norlecta serves instructional audio: pre-recorded audio that Norlecta produced for the learning content. This is Norlecta's own product content and is delivered to you from a content-delivery network. It does not contain your personal data.

Separately, in certain speaking tasks you may choose to make your own recording of your voice. Your recordings are personal data. They are stored only on your own device (in your browser's local database) and are not uploaded to Norlecta. You can play them back, download them, or delete them at any time, except a recording included in a checkpoint submission, which stays with that submission (section 6). Recording is optional and is never required to make progress.

5. Where your data is stored

Your account details, progress, results, writing and recordings are kept on the device you use, in your browser's local storage and local database. Nothing leaves your device because you practised. When you save a piece to My Speaking or My Writing it becomes portfolio evidence that remains yours, on that device. In the current version your work is not sent to anyone: a checkpoint submission you make (section 6) is recorded in the same browser, on the same device, and nothing is transmitted. Storing submitted work on Norlecta's systems, so that an instructor can review it from elsewhere, is planned and not yet in operation. Before it starts, this notice will name the service providers that store or deliver submitted content and the retention periods that apply to them.

6. Submitting your work to an instructor

Your work reaches an instructor only when you submit a checkpoint. Your programme has four checkpoints, each with a deadline set by your institution, and each can be submitted once. A checkpoint submission contains that checkpoint's objective results, the Prepared Recording of each of its sessions and any Coach Podcast you saved for them, your writing for its connected Reading passages, and the name and class you enter. It goes to one instructor: the one your Instructor Code identifies, whose name you see before you confirm. An Instructor Code is not a login and does not grant an instructor access to your account. An instructor receives only the submissions addressed to them, not the rest of your work, not your other data, and not other learners' data. A submission is final: it cannot be changed, withdrawn or submitted again, and later work does not change it. A recording or writing version included in a submission stays with it and cannot be deleted from your portfolio; you can still delete your other work. An earlier submission is not transferred, reshared or shown to an instructor you choose for a later checkpoint. If the instructor who received a submission leaves or loses their authorisation before finishing the review, your institution may authorise, in writing, another of its instructors to complete only the outstanding review; Norlecta records that authorisation, the successor acts under their own identity and sees only that submission, and a review already finalised keeps its author. There is no late submission; the one exception is an incident recovery declared by Norlecta, at your institution's request, for a documented failure on Norlecta's side that prevented your first submission, within at most 14 calendar days after the original deadline; the submission then records the recovery and the work it covers.

Your Learning Summary is an aggregate view of your objective results, for you: it contains no speaking or writing content, and it is not sent to an instructor on its own.

Sending single items to an instructor, Return for Resubmission and resubmission are no longer offered. A share you made before checkpoint submissions replaced them is kept as a record, and you can still revoke an instructor's access to it; revoking ends the instructor's further access but cannot recall copies already delivered. If you delete work that you had shared that way, the recording or the text is removed and instructor access ends, while the record that the share and any review took place is retained as part of the assessment history.

Checkpoint submissions in the current version. The Checkpoints page is part of the current version, but Norlecta instructor accounts are not yet available and no institution has set checkpoint deadlines on this site: no Instructor Code is recognised here, so no checkpoint can be submitted and no instructor receives your work. A submission is only ever recorded in the browser where it is made, on the same device, together with your work; nothing is transmitted to Norlecta or to another device. Secure storage of submitted work on Norlecta's systems, and instructor access through them, are planned and not yet in operation. Before they start, this notice will be updated to describe them, including the service providers involved and the retention periods that apply.

7. Classroom activities

Speak Around and SpeakVenture are classroom activities included in every Real Interaction programme licence. Speak Around and SpeakVenture require a signed-in learner or instructor account. They keep only local game state on your device.

8. Cookies and local storage

Norlecta uses browser storage that is strictly necessary or supports your preferences (for example your language and audio-speed choices). It does not use advertising or analytics storage. Because there is no non-essential tracking, no cookie-consent banner is required for the current storage. Details are in the Cookie and Local Storage Notice.

9. Service providers

The running service relies on a small number of providers: source hosting and delivery (GitHub); delivery of Norlecta's instructional audio from Google Cloud Storage through a content-delivery network; and email routing (Cloudflare) if you write to us. Norlecta does not currently use analytics or advertising vendors. The exact hosting and delivery providers and their log-retention terms are being confirmed and will be named here as they are verified.

10. International transfers

Because your learning data and recordings stay on your device today, personal-data transfer abroad is minimal. Delivering instructional audio and serving the website involves standard request information handled by the delivery providers above. If remote storage or accounts are introduced, the transfer position will be reassessed and this notice updated first.

11. Retention

Data kept on your device stays there until you delete it or clear your browser's site data. You are in control: you can delete individual recordings or saved items (except a version included in a checkpoint submission, which stays with the submission), or clear all local data through your browser. Norlecta does not set a separate server retention period for this data because it is not stored on a Norlecta server.

Your account and your declaration that you are 18 or over. The record of the declaration described in section 3 is kept for as long as your account exists and is deleted together with the account. The same applies to your other account details, including the record of your acceptance of the Terms and of your confirmation that you read the notices. Norlecta does not yet offer a way to delete an account inside the app: you delete it, together with everything else Norlecta keeps in that browser, by clearing this site's data in your browser. Signing out ends the sign-in session but does not delete the account.

Institutional records. Norlecta has decided how long it will keep learning evidence for Institutional accounts, and publishes that rule here before the service which would create such records begins. For Institutional accounts, learning evidence that is submitted for academic review may be kept in its full form until 24 months after the applicable institutional access period ends, or until the different period that institution's own documented agreement sets for it. This may include the checkpoint submissions of an institutional learner: their speaking recordings, written work and objective results. It is kept so that an academic result can still be reviewed or challenged after the teaching period has finished.

After that point the full content is removed and the record identifying the learner is anonymised in the same step. A structural record that a submission and its assessment took place (what was reviewed, when, and the result) is kept as anonymised provenance. It is not a further period of stored recordings, written work or identifying detail.

Work you keep privately and never submit for academic review is not covered by that rule, and a shorter rule applies to it instead: private work is removed 90 days after the applicable institutional access period ends. You can also delete it yourself at any time before then, using the deletion options described in this notice. Submitting work for institutional evaluation is what changes how long it is kept. Where work has been submitted for academic review, it is kept until its retention date even if you remove it from your own portfolio view in the meantime.

Objective practice attempts and institutional accounts. Once attempts are recorded on Norlecta's systems, an attempt that a checkpoint submission includes is kept with that submission under the 24-month rule above, and an attempt that no submission includes is removed 90 days after the applicable institutional access period ends. While an institutional licence and a retention period apply, an institutional account and the official evidence it submitted are preserved and cannot be deleted by an ordinary account action; a departed or suspended person keeps no access to them. An erasure request is recorded, assessed and decided by Norlecta under the applicable data-protection rules, respecting legal holds and mandatory retention; where it is granted, your private never-submitted work and your unincluded attempts are removed at once, and submitted evidence follows the 24-month rule.

Records subject to an active academic dispute, a legal hold or an applicable legal obligation may be kept longer where that is necessary, and only for as long as it is necessary. Any such extension is decided by Norlecta and recorded; it is not something an institution can switch on for itself. An institution-specific retention period exists only where Norlecta has recorded it against an authorising agreement; institutions cannot change these periods themselves.

Scope. The periods above describe an approved Norlecta policy for its Institutional service. That service is not in operation: no institutional learning evidence exists, no institutional record has been created, and no retention period is currently running. Data already on your device is not affected by these periods and has not been moved into this arrangement. Retention for any other future remote storage will be defined before that storage goes live.

12. Your rights and choices

You can review your own progress and results in the app, print or save your aggregate Learning Summary, download your own recordings, and delete your recordings, saved work (except a version included in a checkpoint submission) or all local data at any time. Where data-protection law applies to you (for example under the Turkish KVKK, the EU/UK GDPR, or comparable laws), you may have additional rights over personal data, and you may contact a competent supervisory authority. To make a request or ask a question, email contact@norlecta.com. Because there is no live account backend today, most of your data is deleted directly by you on your device.

13. Consent and its withdrawal

Where Norlecta relies on your consent, that consent is specific, is not pre-selected for you, and can be withdrawn; withdrawing it does not affect processing that already took place. Today the only such point is recording: before you make a recording, you are shown how recording works and asked to confirm that you want to start. Norlecta does not store this confirmation; it is asked again each time you open a page with a recording task. You withdraw it by not recording, and you can delete a recording at any time. Registering asks for no consent: accepting the Terms of Use and confirming that you have read this Privacy Notice and the KVKK Clarification Text are not consent, and their record is described in section 3.

14. Adults only

The Norlecta Platform is intended exclusively for persons aged 18 or over, and Norlecta offers no account and no functionality for persons under 18. When you register, you declare "I'm 18 or over"; if your account was created before this declaration was introduced, you are asked to make it before you can continue to use your account. Norlecta records the declaration as described in section 3 and does not ask for a date of birth or an identity document to verify it. Norlecta does not knowingly process the personal data of persons under 18. If Norlecta learns that an account belongs to a person under 18, it will take reasonable steps to restrict access to that account and to delete the related personal data, unless a legal obligation or a legal hold described in section 11 requires a record to be kept for longer.

15. Security

Norlecta aims to apply reasonable technical and organisational measures appropriate to a service of this kind. No online service can be guaranteed fully secure, and Norlecta does not claim otherwise. If you notice something suspicious, contact contact@norlecta.com.

16. Changes to this notice

Norlecta may update this notice when the platform, its data handling, its providers or applicable requirements change. The version and effective date above indicate the current text. This version 2.8 states, in section 6, how an outstanding review is completed when an instructor leaves (your institution authorises another of its instructors, who acts under their own identity) and the one exception to "no late submission", an incident recovery declared by Norlecta within at most 14 calendar days after the original deadline; and, in section 11, how long objective practice attempts are kept, that institutional accounts and submitted evidence are preserved while the licence and retention apply, and how an erasure request is handled. Section 1 and section 7 were made consistent (programmes; Speak Around and SpeakVenture named). Version 2.7, dated 23 October 2026, described checkpoint submissions, which replace sharing individual items with an instructor: sections 2, 3, 5 and 6 describe what a checkpoint submission contains, that it goes to the one instructor you confirm, that it is final and that a version it includes cannot be deleted from your portfolio, and that in the current version it is recorded only in the browser where it is made; sections 4, 11 and 12 state that exception to deleting your work; section 7 states that Speak Around and SpeakVenture are included in every Real Interaction programme licence, where they were described as free; and section 11 names checkpoint submissions among the institutional learning evidence it describes. It no longer describes three kinds of sharing or a Learning Summary sent to an instructor, which the service no longer offers. Version 2.6, dated 16 October 2026, made the Platform adults-only: section 14 states that the Platform is for persons aged 18 or over and that Norlecta offers no account or functionality for persons under 18, section 3 describes the record of your declaration that you are 18 or over, and section 11 states how long that record is kept. It also described the service as it was built then: section 3 lists the account details kept in your browser, in place of a guest identifier that the Platform no longer creates; sections 2, 3, 5 and 6 stated that no work leaves your browser, that a share with an instructor was recorded only in the browser where it was made, that Norlecta instructor accounts were not yet available and that secure remote sharing was planned and not in operation, and that no AI feature is active; section 11 states how an account is deleted; section 13 describes the confirmation asked before recording and states that no record of it is kept; and sections 3 and 13 state that registering asks for no password and no consent, and describe the record of your acceptance of the Terms and of your confirmation that you read the notices, which is kept only in your browser. Version 2.5, dated 14 October 2026, changed punctuation only: dashes were replaced by colons, commas, semicolons, parentheses or full stops, and no right, obligation, period or meaning changed. Version 2.4, dated 29 September 2026, named the data controller, Ayyüce Serttaş, and added the binding-language statement above: the Turkish text is legally binding. Version 2.3, dated 25 September 2026, updated section 7: Speak Around and SpeakVenture require a signed-in learner or instructor account. Previous versions (version 2.7, dated 23 October 2026; version 2.6, dated 16 October 2026; version 2.5, dated 14 October 2026; version 2.4, dated 29 September 2026; version 2.3, dated 25 September 2026; version 2.2, dated 14 September 2026; version 2.1, dated 6 September 2026; version 2.0, dated 22 July 2026; and an earlier text dated 6 June 2026) are retained as a historical record.

17. Contact

General and privacy enquiries: contact@norlecta.com. Account or access support: support@norlecta.com.