Privacy Policy — Spoken English Toolkit / tim-malone.com

IMPORTANT — READ BEFORE PUBLISHING: This is a working draft, not a finished legal document. I’m not a lawyer, and this hasn’t been reviewed by one. Have your contabilista or a data-protection lawyer give it a final check before it goes live.

Last updated: 9th August 2026

1. Who we are

This website (tim-malone.com), including the Spoken English Toolkit, is operated by Tim Malone (“we”, “us”, “our”), based in Portugal.

For any privacy-related query or to exercise any of the rights below, contact: hello@tim-malone.com

2. What personal data we collect

Account and registration data. When you register for a free account, we collect your email address and any name you provide. This is required to create your account, track your subscription tier (Free or Pro), and let you log in.

Payment and billing data. If you purchase a Pro subscription, payment is processed by Stripe. We do not store your full card details ourselves; Stripe handles this as an independent data controller under its own privacy policy. We do retain records of the transaction itself (amount, date, subscription status) for accounting and legal purposes.

Usage data. We use WP Statistics to understand overall site traffic. This tool is configured to be cookie-free by default: it does not use tracking cookies, does not create persistent identifiers, and anonymises/hashes IP addresses. It does not identify you individually.

Saved phrases and progress. If you use the “Save” or “I know this” features in the toolkit, this data is stored in your browser only (via local storage), not on our servers, and is not linked to your account centrally.

Communications. If you email us or contact us through the site, we keep that correspondence to respond to you and for our records.

3. Cookies

This site uses only the cookies strictly necessary for it to function: keeping you logged in, and remembering the contents of your shopping cart. These are exempt from consent requirements under GDPR/ePrivacy rules because the site cannot work without them. We do not currently use advertising or cross-site tracking cookies.

If this changes in future (for example, if we add advertising), we will update this policy and add a consent mechanism before any such cookies are set.

4. Why we process your data (legal basis)

  • Providing the toolkit and your account: performance of a contract (you registering constitutes agreeing to our terms of use).
  • Processing payments: performance of a contract, and compliance with our legal obligations (tax and accounting records).
  • Site analytics: legitimate interest in understanding how the site is used, carried out in a way that doesn’t identify you personally.
  • Responding to your enquiries: legitimate interest in providing customer support.

5. Who we share data with

We share data with the following third parties, each acting as an independent data processor or controller for their part of the service:

  • Stripe (payment processing)
  • Xneelo (xneelo.co.za)
  • WooCommerce / WP Swings Subscriptions / LifterLMS (plugins running on our own server — these do not send your data to third parties themselves)

We do not sell your personal data to anyone, and we do not use it for third-party advertising.

Our hosting provider engages its own sub-processors (including payment, infrastructure, and analytics providers) to deliver its services. A current list is available from Xneelo directly.

6. International data transfers

Our website is hosted with Xneelo (Pty) Ltd, based in South Africa. South Africa does not currently have an EU adequacy decision, meaning transfers there need a specific legal safeguard under GDPR.

Xneelo has entered into a Client Data Processing Agreement with us that incorporates the European Commission’s Standard Contractual Clauses (SCCs) for transfers involving EU/EEA data subjects, providing an approved legal safeguard for this transfer under GDPR.

7. How long we keep your data

  • Account data: for as long as your account is active, plus a reasonable period after closure for legal/accounting purposes.
  • Payment/transaction records: as required by Portuguese tax law (typically several years).
  • Analytics data: aggregated only; WP Statistics does not retain data that could identify you.

8. Your rights

Under GDPR, you have the right to:

  • Access the personal data we hold about you
  • Correct inaccurate data
  • Erase your data (“right to be forgotten”)
  • Export your data in a portable format
  • Object to certain processing
  • Withdraw consent at any time, where processing is based on consent

You can request access to or deletion of your data by emailing your request to hello@tim-malone.com, or through your account settings if available. You also have the right to lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD), Portugal’s data protection authority, if you believe your data has been mishandled.

9. Children

This service is intended for working professionals and is not directed at children. We do not knowingly collect data from anyone under 16.

10. Changes to this policy

We may update this policy from time to time. The “last updated” date at the top will reflect the most recent revision. Material changes will be communicated to registered users where appropriate.