Last updated: October 24, 2026
Who we are
ESL Pathway (eslpathway.com) is run by a sole trader in Türkiye, who is the data controller (“veri sorumlusu” under Turkish law) for the personal data described here:
Mehmet Akif Derebent
Selçuklu Mah. 41. Sk. No:10, Onikişubat / Kahramanmaraş
info@eslpathway.com
This policy covers the website and your ESL Pathway account. Customers in Türkiye can also read our KVKK Aydınlatma Metni (Turkish privacy notice). Our full legal details are on the Contact & legal notice page.
What we collect and why
Your account
What: email address; password (stored only as a secure hash by our sign-in provider — we can't read it); display name, if you add one; profile photo, if you upload one or sign in with Google.
Why: to create your account, sign you in, keep it secure and show your name and photo on your desk.
Legal basis: performance of our contract with you (GDPR art. 6(1)(b); KVKK art. 5(2)(c))
Your desk
What: resources you save, lesson plans you write, worksheet drafts, the classes you teach if you tell us (age groups and levels, such as “Movers” or “B1 adults”, a name you give a class, what you need most, the topic a class is on for now if you choose one, and what you mark as used with a class), your planner if you use it (your timetable, the lessons on your calendar with their plans, notes and how far you got, term dates and holidays; a private student is kept by the name or nickname you give, the level and your note, and nothing else; the secret address of your calendar feed, if you make one, shows your lessons to whoever has it, and you can replace it at any time; a cover link you make for a lesson shows that lesson's class, time, your note and its plan to whoever has it, until you stop it or a month after the lesson; plans you share with your school are seen by its teachers, with your first name), material you ask us to make (content requests), pictures you upload (made smaller in your browser first, kept until you delete them or your account; anyone who has a link to material that uses them can see them), and your settings (for example, whether you want a note when you use a free open in class). You can download all of it as one file under My desk › Account.
Why: so your work is there next time and on your other devices.
Legal basis: performance of our contract with you (GDPR art. 6(1)(b); KVKK art. 5(2)(c))
Usage records
What: which Premium items a free account opens with its monthly free opens; for subscribers, which Premium items are opened on which day; notifications we show you.
Why: to count your free opens, to check refund requests fairly (our 7-day refund depends on whether Premium was used), and to prevent abuse of accounts.
Legal basis: performance of our contract with you (GDPR art. 6(1)(b); KVKK art. 5(2)(c)); for refund checks and abuse prevention, our legitimate interests (GDPR art. 6(1)(f); KVKK art. 5(2)(f)) and establishing, exercising or defending legal claims (GDPR art. 6(1)(f); KVKK art. 5(2)(e)).
Subscription and payments
What: payment provider, plan, status, renewal dates, the country of your connection at checkout (worked out from your IP address, to show the right price and tax), and the customer and subscription references the provider gives us. We never see or store card details.
Why: to run your subscription, apply local prices and taxes, handle refunds and keep the records tax and commercial law require.
Legal basis: performance of our contract with you (GDPR art. 6(1)(b); KVKK art. 5(2)(c)); compliance with a legal obligation (GDPR art. 6(1)(c); KVKK art. 5(2)(ç)).
Proof that you accepted the purchase terms
What: when you buy, we record the time, which version of the terms and pre-contract information you were shown, the boxes you ticked, your IP address and your browser's user-agent string.
Why: to be able to show that the contract was concluded and that the required information and consents were given before payment.
Legal basis: compliance with a legal obligation (GDPR art. 6(1)(c); KVKK art. 5(2)(ç)); establishing, exercising or defending legal claims (GDPR art. 6(1)(f); KVKK art. 5(2)(e)).
Checkout details in Türkiye (until 24 October 2026)
What: only if you paid in Turkish lira before 24 October 2026: name, surname, mobile number, province, district and billing address; your Turkish ID number if you gave it; for a company invoice, the company name, tax office and tax number. They went to iyzico for the payment, and we keep them in our database (admins only) for the e-Arşiv invoice of that payment and as long as Turkish tax law requires.
Why: because the payment institution and Turkish invoicing rules require them.
Legal basis: performance of our contract with you (GDPR art. 6(1)(b); KVKK art. 5(2)(c)); compliance with a legal obligation (GDPR art. 6(1)(c); KVKK art. 5(2)(ç)).
Reports you send us
What: the text of a "Report a mistake" or "Report this plan" message, and your account ID if you are signed in.
Why: to fix mistakes, deal with problem content in shared lesson plans and, if needed, reply to you.
Legal basis: our legitimate interests (GDPR art. 6(1)(f); KVKK art. 5(2)(f))
School licenses
What: if you ask for a school pilot: your name, work e-mail, phone (optional), role, school, city, number of teachers and your message. If you join a school with its link: which school, when you joined or left, and whether you are its coordinator.
Why: to set up and run the school's pilot or license and to take its payment. A school's coordinators see the name and e-mail of each teacher in it, when they joined and when they last used the site, and the school's use in total (prints, games, class links); never what a teacher opens, saves or makes.
Legal basis: performance of our contract with you (GDPR art. 6(1)(b); KVKK art. 5(2)(c)); for a pilot request, our legitimate interests (GDPR art. 6(1)(f); KVKK art. 5(2)(f)).
Emails
What: your email address and the emails we send you (via our email provider).
Why: account emails (confirming your address, resetting your password); a service note when you use a free open in class, which you can switch off on My desk; purchase confirmations (for Turkish purchases, with a copy of your contract); and a reminder before each yearly renewal. Ideas for your classes (picks for the classes you teach and what's new) only if you tick the box asking for them, as often as you choose; each has a one-click unsubscribe, and you can stop them under My desk › Notifications & e-mails. We keep when and where you said yes, and for teachers in Türkiye we record that consent in the national Message Management System (İYS), as the law requires.
Legal basis: performance of our contract with you (GDPR art. 6(1)(b); KVKK art. 5(2)(c)); for the contract copy, compliance with a legal obligation (GDPR art. 6(1)(c); KVKK art. 5(2)(ç)); for the service note, our legitimate interests (GDPR art. 6(1)(f); KVKK art. 5(2)(f)); for ideas for your classes, your consent, which you can withdraw at any time (GDPR art. 6(1)(a); KVKK art. 5(1)).
Visit statistics and technical data
What: aggregated page views and performance measurements (for example, how quickly pages load) from Vercel Web Analytics and Speed Insights, which work without cookies; and the technical request data (such as IP address and browser type) that any web server necessarily receives, which our host processes for delivery and security.
Why: to keep the site fast, secure and working, and to see which pages are useful.
Legal basis: our legitimate interests (GDPR art. 6(1)(f); KVKK art. 5(2)(f))
How you found us
What: during your visit, and only if you create an account, we note how you found the site: the referring site's name (such as google.com), the campaign tags in the link you followed, the page you arrived on and a discount code if the link carried one. We keep this with your account, together with your answer to “How did you hear about us?” if you give one. Nothing is stored on your device for this: no cookie and no browser storage. No IP address, no fingerprinting and no tracking cookies from third parties.
Why: to know which channels bring teachers to ESL Pathway, so we spend our time on the ones that work, and to apply a discount code from a link at checkout during the same visit.
Legal basis: our legitimate interests (GDPR art. 6(1)(f); KVKK art. 5(2)(f))
What is used on the site
What: which pages are opened, how long each one is in active use (seconds while the page is visible and you have used it in the last few minutes), and which main buttons are pressed (for example print, download PDF, play a game, sign in, open the pricing page), with a random number for the visit that is forgotten when you close the tab, and, if you are signed in or sign in during that visit, your account. For a search that finds nothing we keep its words. Nothing is stored on your device for this: no cookie and no browser storage. No IP address, no details of your browser or device, no fingerprinting, nothing shared with others. If your browser asks sites not to track you (Global Privacy Control or Do Not Track), nothing is counted.
Why: to see which material and tools teachers actually use, where the site loses them and what the library is missing, so we improve the right things; and, if you are signed in, to put first in the libraries the levels, topics and kinds of material you use most, from what you opened, saved and printed in the last six months (you can switch this off or start fresh in My desk › Account › Your data). Signed out, only what you open in that tab is used for this, in your browser's memory, and it is forgotten when you close the tab. One teacher in ten sees the usual order, so we can tell whether the personal one helps.
Legal basis: our legitimate interests (GDPR art. 6(1)(f); KVKK art. 5(2)(f))
Students
Students never need an account. When a teacher shares a class link (for example, for a quiz or game), a student may type a nickname or initials so the teacher can see their score. We ask students not to type their full name. We store only that nickname and the score, and only the teacher who made the link can see them.
Class links expire after 30 days. Links and their results are deleted automatically about 30 days after they expire, and teachers can delete them sooner from My desk. We don't use students' answers for anything else.
Teachers use class links under their own responsibility and must get any permission their school, or the students' parents or guardians, requires. Please don't type other personal information about students anywhere on the site.
Things that stay on your device
- Class lists in Tools stay in your browser and are never sent to us.
- The microphone (in Shadowing and the noise meter) is processed on your device only. Nothing is recorded to our servers or uploaded, and recordings disappear when you close the page.
- Read-aloud uses the voices built into your browser or device.
Who processes data for us
We share data only with the providers we need to run ESL Pathway, and only as much as each one needs:
- Supabase — database, sign-in and file storage (profile photos). Servers in the EU (Frankfurt, Germany).
- Vercel — hosting, Web Analytics and Speed Insights. USA: our server functions run in Washington, D.C., and pages are delivered through a global network from the location nearest to you.
- Resend — sending our emails. A US company; our emails are sent from its Japan (Tokyo) region.
- Lemon Squeezy — payments. USA. Lemon Squeezy is the merchant of record: it collects your billing details itself, as a separate controller, under its own privacy policy.
- iyzico — card payments in Turkish lira made before 24 October 2026. Türkiye.
- Logo Yazılım (Logo İşbaşı) — issuing the e-Arşiv invoices for payments in Turkish lira made before 24 October 2026 and sending them to the Turkish Revenue Administration. Türkiye.
- Google — only if you choose “Continue with Google”, YouTube playback after you press play. USA.
We may also disclose data where the law requires it, for example to a court or a tax authority.
International transfers
Some of these providers are outside Türkiye and outside the European Economic Area, mainly in the USA (and, for sending emails, Japan, which the European Commission recognizes as providing adequate protection). Where data is transferred, we rely on the providers' data processing terms and, where applicable, the European Commission's standard contractual clauses (or the EU–US Data Privacy Framework, where a provider is certified). For transfers from Türkiye, we rely on the mechanisms set out in article 9 of the KVKK, such as standard contracts. You can ask us for more information about these safeguards.
How long we keep data
- Account and desk: until you delete your account. If a free account has not been used for 3 years, we may delete it after emailing you at least 30 days beforehand.
- Subscriber usage records (which Premium items were opened on which day): about 400 days, so we can check refund requests and disputes.
- Class links and student results: at most about 60 days (links expire after 30 days and are deleted about 30 days later), or sooner if the teacher deletes them.
- Reports: until the report is dealt with, and then for 1 year.
- School licenses: pilot requests for 2 years; a school's record and who was in it while the license runs and for 3 years after it ends (payment records as tax law requires).
- Payment, invoice and purchase-consent records: as long as tax and commercial law requires — typically up to 10 years — even if you delete your account.
- Backups and logs: deleted data can remain in our providers' backups and technical logs for a short time until they are overwritten.
Your rights
Depending on the law that applies to you, you have the right to:
- know whether we process your data and get a copy of it (GDPR art. 15; KVKK art. 11(a)–(b));
- know why we process it and whether it is used for that purpose (KVKK art. 11(c));
- know who we transfer it to, in Türkiye or abroad (KVKK art. 11(ç));
- have inaccurate or incomplete data corrected (GDPR art. 16; KVKK art. 11(d));
- have your data deleted or destroyed (GDPR art. 17; KVKK art. 11(e) and art. 7);
- have us tell the recipients of your data about a correction or deletion (GDPR art. 19; KVKK art. 11(f));
- restrict how we use your data (GDPR art. 18);
- receive the data you gave us in a machine-readable format and have it passed to another provider (GDPR art. 20);
- object to processing based on our legitimate interests (GDPR art. 21);
- object to a result that goes against you and comes solely from automated analysis (KVKK art. 11(g)); under GDPR art. 22, not to be subject to decisions based solely on automated processing — we don't make such decisions;
- claim compensation for damage caused by unlawful processing (KVKK art. 11(ğ); GDPR art. 82);
- withdraw any consent you have given, at any time, without affecting what was done before (GDPR art. 7(3)).
How to use your rights
Delete your account yourself: use “Delete my account” on My desk → Account. If you have an active subscription, cancel it first. Deleting removes your account, desk, lesson plans, class links and results, profile photo and usage records. Payment, invoice and purchase-consent records are kept only as long as the law requires (see above).
Everything else: write to info@eslpathway.com, preferably from your account's email address so we can confirm it's you. We reply within 30 days. Applicants in Türkiye can also use the methods described in our KVKK Aydınlatma Metni.
Complaints
Please tell us first and we'll try to put things right. You can also complain to a supervisory authority: in Türkiye, the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu), after first applying to us; in the EU or EEA, the data protection authority where you live or work; in the UK, the Information Commissioner's Office.
Children
Accounts are for teachers and tutors aged 18 or over; ESL Pathway accounts are not meant for children. Students use class links only under their teacher's responsibility, as described above. If you think a child has created an account, write to us and we'll delete it.
Changes to this policy
We'll update this page when our services or the law change, and change the date at the top. If a change matters, we'll tell account holders by email before it takes effect.
Contact
Questions about privacy: info@eslpathway.com. Postal address: see “Who we are” above.
Questions? Write to info@eslpathway.com.