LanguagesWork privacy policy

Who is responsible

This policy covers LanguagesWork at https://languageswork.com. It covers browsing, posting, contacting advertisers, account access and optional advertising boosts.

The controller is Joshua S Powrie, a UK sole trader operating LanguagesWork. For privacy questions, information-rights requests or complaints, email hello@languageswork.com.

Information we collect

Account information includes your name, email, password hash, recovery records and sessions. An advertisement includes your chosen advertiser name, title, description, location, language, price, availability, website and contact email. Guest advertisements have a private management key; the server keeps its hash.

We hold ad views and contact-reveal counts, moderation results, reports, account-management history and subscription/payment references where boosts are enabled. Reports may include a hash derived from the reporting IP address, ad and date to prevent duplicates. Our server also receives ordinary connection and request information.

What other people can see

Approved ads and advertiser details are public and may be indexed. Your advertisement’s contact email is revealed when a visitor requests the contact link; use an address you are happy to make public. Your separate account sign-in email, password information, management key and private moderation details are not shown as account data.

Advertisers can see counts for their ads. Other advertisers are independent parties: information you send them directly is handled under their own practices. Guest edit links grant management access and should be kept private.

Google sign in

Google sign-in is optional. If you use it, Google sends a signed identity response containing your Google account identifier, verified email address and basic profile information. We verify that response and store the identifier and email to connect your website account. A suggested name may be shown during registration; you choose the name used on this service. Google profile photos are not automatically published.

We do not request access to your Gmail messages, Drive files, Calendar or contacts. We do not store the signed Google token, a Google access token or a refresh token. We do not sell Google account information, use it for advertising or use it to train AI models. Loading Google sign-in connects your browser to Google, which receives technical connection information and may use its own cookies. Google explains its processing at https://policies.google.com/privacy.

Connecting or disconnecting Google does not change ownership of your existing content. Account security checks apply before connecting an existing account or disconnecting Google. You can also review or revoke the connection through your Google Account. Disconnecting Google does not delete your website account, contributions or records that we still need to keep.

Why we use information

Account and ad information is used to provide the account, publication, management and optional boost services you request, under our contract with you.

We rely on legitimate interests to keep the board useful, detect scams and duplicates, moderate reports, protect accounts and measure service performance proportionately. Rules may automatically publish an ad or hold it for a moderator; you can ask us to review a decision. Required financial records are processed for legal obligations. Optional marketing requires an appropriate separate basis and choice.

Service providers and international transfers

Google provides optional authentication. Our configured SMTP email provider delivers password recovery and private ad-management messages. Mollie processes optional boost payments and subscriptions when enabled; we store references and status, not full card details.

Ad screening in this service runs within the application. It does not send ad text to an external AI moderation service. Linked advertiser websites receive information when you choose to visit them.

The application and uploaded files are hosted on a Netcup server. Our hosting, authentication, email, payment and communications providers may process information outside the UK, including in the European Economic Area and, depending on the provider, other countries. For transfers subject to UK restrictions, we require a valid transfer arrangement: a UK adequacy regulation where applicable, or appropriate contractual safeguards such as the UK International Data Transfer Agreement or UK Addendum to standard contractual clauses, with any necessary additional measures. Contact us for information about the recipient, destination and safeguards relevant to your information, or to request a copy of those safeguards.

We use access controls, protected connections, password hashing and checks against account abuse. Authorised service administrators may access records when needed for support, security and legal requests. We may disclose relevant information to professional advisers or authorities where necessary and lawful. We do not sell personal information.

Cookies and similar storage

Sign-in cookies last up to seven days; Google connection cookies up to ten minutes. The browser stores saved ads, language preferences and saved guest-management keys locally. Clearing site storage removes those local copies.

Optional measurement uses a visitor cookie for up to 30 days to count ad detail opens and contact reveals without counting the same browser again within 24 hours. The database stores a hash with an ad reference and timestamp. This cookie is set only if you choose Allow measurement in the Cookie choices control. You can decline or withdraw there at any time; browsing and contact reveal still work. A separate preference cookie remembers your choice for up to 180 days. Do Not Track and Global Privacy Control disable optional measurement.

How long we keep information

Google connection requests expire after ten minutes; the linked account identifier stays until disconnected or deleted. Password-reset links expire after 20 minutes. These expiry periods are not the retention period for all account records.

Deleting an ad removes it from the application’s ad table. Retention is assessed using the criteria below; removing something from public view is not necessarily erasure from all records.

We keep account information while it is needed to provide your account and requested services. On closure or an erasure request, we assess what can be deleted and what must remain for an outstanding transaction, complaint, safeguarding concern, legal claim or statutory accounting requirement. Support and security records are kept for as long as necessary to resolve the matter and protect the service; financial records follow the applicable tax and accounting requirements. We use the purpose of the record, outstanding obligations, limitation periods and the risk of harm to decide retention. We delete or anonymise information when it is no longer needed. Restricted backup copies may remain until replaced or expired through the backup process; they are not used for ordinary account access. Contact us for the retention decision affecting a particular record. Expiring a cookie or token does not itself delete the associated database record.

Your choices and rights

You can edit or delete an ad through your account or its management key, remove browser-saved ads, manage a boost subscription and disconnect Google at /google-login?manage=1. Contact us for account deletion or recovery of access.

Depending on the circumstances, you can ask to access or correct your personal information, receive a portable copy, restrict its use or have it erased. You can object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it without affecting earlier lawful processing. These rights have exceptions, including where records are needed for legal obligations, other people’s rights or legal claims.

Send requests or privacy complaints to the contact above. We may ask for proportionate information to confirm your identity. We normally respond to rights requests within one month and explain any lawful extension. You can complain to the UK Information Commissioner at https://ico.org.uk/make-a-complaint/ or, where applicable, your local data protection authority.

Children and sensitive information

Do not publish children’s private contact details, identification documents or unnecessary sensitive information. An adult advertising lessons for a child should use the adult’s own contact details and keep information about the child to the minimum needed. Contact us about a listing exposing a child’s information so we can restrict it and review removal.

Changes to this policy

We will update this policy when our service or information practices change. The current version and effective date will appear on this page. We will draw material changes to your attention and obtain a new choice where required before a new use begins.