PRIVACY

Privacy notice

Last updated: October 29, 2026

This notice explains what personal data The Concept Method collects, why we collect it, who receives it, and how long we keep it. It covers three products:

the website theconceptmethod.com, with the books;
Concept Lessons, at lessons.theconceptmethod.com;
the Concept Coach app, at coach.theconceptmethod.com.

It follows the General Data Protection Regulation (GDPR).

1. Who we are

The data controller is Gigollotti Netto Pedro, a sole trader registered in Italy, trading as The Concept Method. VAT number (partita IVA): 10175100964.

Address: Vicolo del Cedro 6, 00153 Roma, Italy.

Email: contact@theconceptmethod.com. Write to this address with any question about this notice or about your data.

2. What we collect

2.1 On the website

The website has one form, Talk to us. It sends your name, your email address, your company if you give it, and your message to contact@theconceptmethod.com through Resend, our email service, and to limit misuse it counts messages per IP address for one hour. The website keeps nothing. It has no analytics and no advertising code.
GitHub Pages hosts the website, and the fonts come from Google Fonts. Your browser connects to both, so they receive your IP address and information about your browser.
A locked book page asks Concept Lessons whether your browser is already signed in. If you choose "Enter with my email," you go to the Concept Lessons sign-in page, and you type your email address there, not on the website.
Your answers in the book exercises are not sent anywhere and are not saved.
If you write to contact@theconceptmethod.com, your message is kept in our email account.

2.2 In Concept Lessons

Your registration

Your name, email address, level, teacher, and class. If a company pays for your lessons, the name of that company.
What you told us when you joined: your role, your field, what you need English for, where it goes wrong, who you write to, and a short text about you of up to 800 characters.
Your teacher's notes about you and about your lessons, and the class diary.

Your work

Every answer you give in a lesson, with your attempts, your scores, and the time you spent.
What you type in an answer box. It is sent to the server a few seconds after you stop typing, before you press Check, so that your teacher can follow your work in class.
Your recordings for spoken tasks, up to 8 MB each.
The personal task written for you ("In your words").
Your lines on the class whiteboard. A wrong answer of yours can be used for a "Correct it" line.
Your reviews, the answers your teacher accepted, and how many written checks you used each day.

Your lessons and billing

Your lesson times, read from our lesson calendar: your name as written in the calendar, your email address as a guest, the start time, the length, and whether the lesson was held, moved, or canceled, with the notice given.
Reports of your hours, with diary entries your teacher chose, when a report is sent to you or to the company that pays.
For a company client: the company name, the address for reports, the contracts, and the hours bought.

Signing in

A key for each browser you sign in with.
Invitation links, and email sign-in links and codes, with your email address.
The IP address of each sign-in attempt, to limit the number of attempts.

If you were invited to try the Coach: your name, your email address, the dates of your trial, and what you told us when you joined.

2.3 In the Concept Coach app

The app does not store your name or your email address. It knows you by the key that Concept Lessons gives you. When the app shows your name, it asks Concept Lessons for it and does not keep it.

Every exchange with a coach: your question as you typed it, the answer, the screen, book, and unit you were on, and what the answer cost.
Your result in each practice exercise.
"Write it now": the original sentence, your earlier answer, your new attempt, and the coach's feedback.
Your Find my level result: one book to start with and two or three lines that explain it. There is no score.
Which units you opened, and when.
Problems you report, in your words, with the screen and the app version.
Your Notebook: the words you saved, their review dates, and the words you looked up.
Your reminder settings, and the address your phone gives the app for notifications.
Your birthday, if you give it: the day and the month only. The app never asks for the year.
Which expressions of the day you were shown.
Your permission to send your words to the services in section 4, and which version of the text you agreed to.
Sign-in attempts: the email address typed and your IP address.

Your voice. When you hold the microphone button, your recording is sent to ElevenLabs to be turned into text. The app does not keep the recording.

The app collects no advertising identifier, no location, no contacts, and no photos. It has no analytics.

Since October 16, 2026, the app sends none of your words and none of your recordings to the services in section 4 until you give permission in the app.

3. Why we use it, and the legal basis

Purpose

Basis

Giving you the course: lessons, your record, your teacher's feedback, reviews, and the Coach app

Contract, GDPR Article 6(1)(b).

Feedback from a language model on your lesson answers

Contract, Article 6(1)(b).

Lesson times, the cancellation notice rule, and billing

Contract, Article 6(1)(b).

The coaches' answers from a language model in the Coach, which asks your permission first

Consent, Article 6(1)(a).

Turning your recorded voice into text in the Coach

Consent, Article 6(1)(a).

Reminders and the birthday greeting, which you turn on yourself

Consent, Article 6(1)(a).

Signing you in, and limiting sign-in attempts

Legitimate interest in keeping accounts safe, Article 6(1)(f).

Nightly backups, so the service can be restored

Legitimate interest, Article 6(1)(f).

Answering a message you send with Talk to us

Steps you ask for before a contract, Article 6(1)(b).

Hosting the website and loading its fonts

Legitimate interest, Article 6(1)(f).

One email about the Coach, the day after you are invited to the app

Legitimate interest, Article 6(1)(f). You can unsubscribe with one click.

Reports of your hours to the company that pays for your lessons

Legitimate interest of that company in the training it pays for, Article 6(1)(f). This notice is how we tell you about these reports.

Keeping billing records

Legal obligation, Article 6(1)(c).

Concept does not sell your data. We do not use it for advertising.

No decision with a legal or similarly significant effect on you is made automatically. Find my level suggests a book to start with, and nothing more.

Please do not write health, money, or identity details in your answers. The exercises do not need them.

4. Who receives it

These companies process data for us. Two act under their own terms instead: GitHub, which hosts the website, and Google Fonts. Each company receives only what its job needs.

Company

What it receives, and why

Where

Cloudflare

Hosts Concept Lessons and the Coach. It stores their databases, your lesson recordings, and the app's files.

Cloudflare, Inc., United States. The two databases run in Western Europe. The storage location of your recordings is not guaranteed to be in the EU. Transfers rely on the EU-U.S. Data Privacy Framework and the standard contractual clauses.

Anthropic

Provides the language model (Claude) that writes the coaches' answers and checks written answers.

Coach: your question as you typed it, what you told us when you joined, your level, the screen you are on, the text of the unit you have open, and your recent messages in that conversation.

Lessons: your written answer with the question and the model answer, for a written check. For your personal task, what you told us when you joined, some of your teacher's class notes, and the answers you got wrong. For a whiteboard note, the line on the board. Your name is not sent.

Anthropic deletes this within 30 days and does not use it to train its models. It keeps data longer only if its safety systems flag it or the law requires it.

Anthropic Ireland, Limited. Data may be processed in the United States, under the EU standard contractual clauses.

ElevenLabs

Gives the coaches their voices. For this, it receives text written for the lesson or the app. A word on the whiteboard can be a word you used, but ElevenLabs never receives your sentences for this.

In the Coach, it also turns your recording into text while you hold the microphone button.

ElevenLabs may keep your recording and the text under its own policy. It has not published how long it keeps them.

On October 16, 2026, we switched off the account setting that lets ElevenLabs use our data to improve its models. ElevenLabs has not yet confirmed to us that this setting covers recordings sent by the app.

United States. Covered by the standard contractual clauses in the ElevenLabs data processing agreement.

Microsoft Azure

Pronunciation analysis with Murillo is in a test phase.

When you use it, your recording of a practice sentence goes to Microsoft's speech service. The service analyzes it in memory and does not store it. Our code never turns on Microsoft's audio logging. Microsoft does not use customer data to improve its Speech models.

North Europe region (Ireland, EU).

Resend

Sends the emails from Concept Lessons: invitations, sign-in links and codes, review notices, app invitations, and reports, and delivers the messages sent with Talk to us on the website. It receives your email address, your name, and the content of the email.

Plus Five Five, Inc. (Resend), United States. Transfers rely on the EU-U.S. Data Privacy Framework and the standard contractual clauses.

MailerLite

Sends one email about the Coach, the day after you are invited to the app. It receives your email address and your first name. It is not used for teachers or test accounts.

MailerLite, Inc., United States. It stores its data in the EU. Any access from the United States relies on the standard contractual clauses and the EU-U.S. Data Privacy Framework.

Google

Google Workspace holds our email (contact@theconceptmethod.com) and our lesson calendar, with your name, your email address as a guest, and your lesson times.

Google Drive holds our nightly backups, encrypted (see section 6).

Data may be processed in any country where Google has facilities. Transfers to the United States rely on the EU-U.S. Data Privacy Framework, with the standard contractual clauses as a fallback.

Google Fonts

Serves the fonts of the website and of some Concept Lessons pages, under Google's own terms. Each request sends Google your IP address, the address (URL) of the file requested, and your browser's user agent. Google Fonts sets no cookies.

Google LLC, United States, certified under the EU-U.S. Data Privacy Framework.

GitHub

Hosts the website as an independent provider, under its own privacy statement. It receives your IP address and information about your browser.

It also runs the private code that builds lessons. It receives the brief a teacher writes for a lesson.

GitHub, Inc., United States. Transfers rely on the EU-U.S. Data Privacy Framework and the standard contractual clauses.

Your phone's notification service

If you turn on reminders, the notification service of your phone or browser (for example, Apple or Google) delivers them. It receives the notification address of your phone and the expression of the day, encrypted so the service cannot read it. It receives nothing else about you.

The maker of your phone or browser.

When you look up the origin of a word in the Coach, our server checks the word on Wiktionary. Only the word is sent.

5. Who can see it at Concept

You see your own lesson pages, your record, your board, your notes, your personal task, and your reviews.
Your teacher sees your registration, your answers (including what you type before you press Check), your recordings, your board, the notes, the diary, and your reports.
From the Coach, your teacher receives two things. The first is a Register Check, which is sent only when you choose to share it. It holds the text you checked (up to 2,000 characters), the screen, and the reader you chose. The sentence beside the button says that your teacher sees it. The second is a written attempt from "Write it now," with the original sentence and the coach's feedback.
A question you ask in the Coach panel is never sent to your teacher.
If you change teacher, your history goes with you to the new teacher.
The director (Pedro Gigollotti, who runs The Concept Method) can see every learner's record. He also owns the accounts that hold the databases, and he can open them to keep the service working.
If you are an individual client, the director sees how often you use each part of the Coach, how long answers take, and what they cost. These counts never include your words. If you are trying the app, what you send with Send feedback reaches him with the name of the screen.
A company that pays for your lessons has no login and no page. Your teacher or the director can email a report to the company's contact: your name, your hours, and diary entries they chose. This is never done for individual clients.

6. How long we keep it

Data

How long

Website

We keep nothing. GitHub and Google keep connection data under their own policies.

Lessons: your registration and your work (section 2.2)

While you are a learner with us. If you have no lesson for 24 months, Concept deletes your record.

When your teacher or the director removes you, we delete your registration, your answers, your typed drafts, your recordings, your personal tasks, your teacher's notes, your diary, your board, your reviews, your sign-in keys and codes, and every event about you.

Lessons: Register Checks and "Write it now" attempts your teacher received, and Coach usage counts

24 months from the day they were written. A daily job deletes them. They are also deleted when you are removed.

Lessons: your lesson times, reports already sent, contracts, and company details

Kept for 10 years after you are removed, the period Italian law requires for accounting records.

Lessons: IP addresses of sign-in attempts, and email sign-in links and codes

Deleted after 30 days.

Lessons: a trial invitation (name, email address, dates)

Deleted 12 months after the invitation.

Coach: your exchanges with the coaches, practice results, "Write it now," Find my level, units opened, and reports

24 months (720 days) from the day each one was written, then deleted.

Coach: your Notebook, your birthday, and the expressions you were shown

24 months (720 days) from the last change, then deleted.

Coach: your reminder settings

Until you turn reminders off or delete your account. If you do not use the app for 24 months, Concept deletes them.

Coach: your permission record, and the record that you use the app

Until you delete your account. If you do not use the app for 24 months, Concept deletes them. If you come back after that, the app asks for your permission again.

Coach: sign-in attempts (email address and IP address)

24 hours.

Coach: the shared answer store

365 days. It holds questions and their answers so the same question does not have to be answered twice. Nothing in it says who asked, so it cannot be linked to you or deleted with your account.

Backups

Every night we export the lessons and Coach databases, encrypt the copy, and save it to the Concept Google Drive. Copies are deleted when they are 8 days old.

Data that we delete stays in the backups for up to 8 days.

Your lesson recordings are not in the backups.

The companies in section 4 keep data under their own rules, as described there.

7. Your rights

You have the right to:

get a copy of the data we hold about you;
have wrong data corrected;
have your data deleted;
have its use limited;
object to a use based on legitimate interest;
receive the data you gave us in a format a computer can read, and send it to someone else;
withdraw your consent at any time, where a use is based on consent. This does not change what was done before.

If the law where you live gives you more rights than the GDPR, for example Brazil's data protection law (LGPD), Concept gives you those rights too.

How to use them. Write to contact@theconceptmethod.com. We answer within one month. If a request is complex, we can take two more months, and we tell you within the first month.

A copy of your data. There is no download button yet. When you ask, we prepare the copy by hand from our databases and send it to you.

Deleting your Coach data. In the app, open the menu and choose Delete my account. The app lists what it holds about you, asks you to confirm twice, deletes it at once, and shows you what it deleted. It also clears the app's copy on your phone and your notification address.

This does not delete your Concept Lessons registration. To delete it, write to us. When we remove you, we delete what section 6 lists. We keep your lesson times, the reports already sent, and the contracts, because billing needs them.

In both cases, the backups keep the data for up to 8 days (section 6).

8. How to complain

If you are not happy with our answer, you can complain to a data protection authority. In Italy this is the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma, www.garanteprivacy.it.

You can also complain to the authority in the EU country where you live or work, or where you think the problem happened.

9. Cookies and storage on your device

We use cookies only to keep you signed in. We use no cookies for analytics or advertising.

concept_key

Keeps you signed in on Concept Lessons, the Coach, and the books. It lasts one year (one hour for a demo session).

concept_alt

A second sign-in key, for a teacher who is also a learner. It lasts one year.

concept_view

Concept Lessons, for the director only: remembers the "view all" setting for one year.

cc_unlocked

The Coach: remembers that you passed its door. It lasts one day.

cc_preview

The Coach: used only with a preview link. It ends when the link ends.

Your browser also keeps some data in its own storage:

Concept Lessons: a copy of your lesson record, the answers you have not checked yet, the answers waiting to be sent, and small marks such as a finished step or the whiteboard's position.
The Coach: a copy of your Notebook, your conversation with the coach, your choices (such as the reader and whether sound is on), your look-up history, and small marks of what you have seen. Delete my account clears all of it.
The website: the language you chose in the bar (concept_lang), a mark that the books are open on this device (cm_access, cm_pv_access), and a mark that you closed the privacy message (cm_privacy, cm_privacy_seen, cm_pv_privacy_seen).

You can delete these at any time in your browser settings. You will then need to sign in again.

10. Changes to this notice

When what we collect, who receives it, or how long we keep it changes, we update this notice and the date at the top.

Last updated: October 29, 2026.