Privacy Policy

1. Who we are

The EZ Model website and learning platform (“the Service”, “we”, “us”) is operated by Dr. Elham Zandvakili as an independent educational project. We are the data controller for personal information collected through this Service.

You can reach us at dr.ez.model@gmail.com.

This Service is a personal educational project. It is not operated by, and does not speak for, any college or district, even where course materials are used in a class.

2. What we collect

Information you give us

• Account details — your email address, a display name (optional), and a password. Passwords are stored only as a salted bcrypt hash; we never store or see the password itself.
• Messages you send — anything you write in the contact form, the newsletter sign-up, or the optional “Share Your Reflection” form.
• Learning activity you create — progress, scores, answers, saved words, and similar records produced as you use the courses, games, and apps.
• Conversations with the AI Tutor — the messages you type, and audio you record if you use voice features.

Information collected automatically

• Usage events — for example page views and scroll depth, together with a random session identifier and, if you are signed in, your account ID. These are stored in our own database; we do not use Google Analytics or advertising trackers.
• Technical data — our hosting provider processes standard server logs, including IP address, browser type, and time of request, to deliver and secure the site.

What we do not collect

• We do not collect payment card details. The Service does not sell anything directly; book links take you to Amazon, which has its own privacy policy.
• We do not use advertising cookies, ad networks, or cross-site tracking pixels.
• We do not sell or rent personal information, and we do not share it for cross-context behavioural advertising.

3. How we use it

• To create and run your account, keep you signed in, and let you enrol in games and apps.
• To save your learning progress to your own account so it follows you between devices.
• To provide the AI Tutor and voice practice features you choose to use.
• To reply to messages you send us.
• To send you a password-reset link when you request one.
• To understand which parts of the Service are used, so we can improve them.
• To keep the Service secure — for example rate-limiting sign-in attempts to deter attacks.
• To meet legal obligations.

We do not use your personal information to make decisions about you by automated means that produce legal or similarly significant effects.

4. Legal bases (UK/EU visitors)

Where the UK GDPR or EU GDPR applies, we rely on:

• Contract — to provide the account and learning features you asked for.
• Legitimate interests — to keep the Service secure, prevent abuse, and understand aggregate usage, balanced against your rights.
• Consent — for optional analytics, for the newsletter, for reflections you choose to submit, and for any use of your work in research. You may withdraw consent at any time.
• Legal obligation — where we must retain or disclose information by law.

5. Who we share it with

We share personal information only with the service providers needed to run the Service, and only as far as necessary. We do not sell it.

We may also disclose information if required by law, to enforce our terms, or to protect the rights and safety of users.

6. AI features

The AI Tutor and voice practice send what you type or say to an external AI provider (currently OpenAI and/or Google Gemini) so a response can be generated. Please treat these features like any online service:

• Do not enter sensitive personal information — health details, government identifiers, financial data, or anyone else's private information.
• AI output can be wrong or misleading. It is a practice aid, not authoritative advice, and never a substitute for professional, medical, legal, or academic judgement.
• Providers handle data under their own terms. We do not control their processing.

7. Cookies & local storage

We use a small number of first-party items only. Full details are in the Cookie Policy.

• Essential — a sign-in session cookie (ez_session), set only when you sign in. It is HttpOnly, SameSite=Strict, and expires after 7 days. Without it you cannot stay signed in.
• Functional local storage — your user ID and saved game progress are kept in your browser so games work offline and two students on the same computer do not overwrite each other.
• Analytics — optional, and off until you accept. You can change your choice at any time from the “Cookie settings” link in the footer.

We do not use advertising or cross-site tracking cookies.

8. How long we keep it

• Account and learning records — while your account is active, and then deleted on request.
• Password-reset tokens — stored as a hash and valid for 60 minutes; single-use.
• Messages you send us — kept as long as needed to handle your enquiry and keep a reasonable record.
• Usage events — kept in aggregate to understand trends.
• Research data — kept for the period approved for the study, then securely destroyed.

If you ask us to delete your account, we delete your account record and the learning data attached to it, except where we must keep something to meet a legal obligation.

9. How we protect it

• Traffic is encrypted in transit with HTTPS.
• Passwords are stored only as bcrypt hashes.
• Your session uses an HttpOnly cookie, so scripts in the page cannot read it.
• Every request for your data is authorised against your own session; one account cannot read another's records.
• Sign-in and account creation are rate-limited to deter automated attacks.
• A Content Security Policy and related headers reduce the risk of injected scripts.

No online service can promise perfect security, but we take these measures seriously and review them as the Service grows.

10. Children & students

The Service is intended for adult learners and for students in post-secondary courses. It is not directed to children under 13, and we do not knowingly collect personal information from them. Accounts may not be created by anyone under 13.

If you believe a child under 13 has given us personal information, contact us and we will delete it promptly.

Where a school or teacher introduces learners aged 13–17 to the Service, we expect the school or the parent/guardian to provide any consent required by law before those learners create accounts.

11. Students & education records (FERPA)

Where the Service is used as part of a course, some records may be “education records” under the U.S. Family Educational Rights and Privacy Act (FERPA). In that setting:

• We use student information only to provide the educational service, not for advertising or unrelated purposes.
• Course-related records are shared with your instructor, and with your institution where it is entitled to them.
• Students may ask their instructor or institution to review or correct records held about them.
• Your grade never depends on optional features such as newsletters, reflections, or research participation.

12. Research participation

Some course activities may be part of approved educational research. Where that is the case:

• Participation is voluntary and requires separate informed consent.
• Declining will not affect your grade, your access to materials, or your standing.
• Research responses are anonymous or coded wherever possible, and findings are reported in aggregate.
• You may withdraw at any time without penalty.

13. Your rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you, and receive a copy.
• Correct information that is inaccurate or incomplete.
• Delete your account and personal information.
• Object to or restrict certain processing.
• Withdraw consent where processing relies on it.
• Lodge a complaint with your data protection authority.

To exercise any of these, email dr.ez.model@gmail.com. We will respond within the time your law allows — generally 30 days — and we will not treat you differently for asking.

14. California rights

If you are a California resident, the CCPA/CPRA gives you the rights to know, delete, and correct personal information, to opt out of its sale or sharing, and not to be discriminated against for exercising those rights.

We do not sell personal information, and we do not share it for cross-context behavioural advertising — including for anyone under 16. In the past 12 months we have collected the categories described in section 2 for the purposes in section 3.

15. International transfers

We operate from the United States, and our providers may process data in the United States and elsewhere. If you use the Service from outside the U.S., your information will be transferred there, where privacy laws may differ from your own. Where required, we rely on appropriate safeguards such as the European Commission's standard contractual clauses.

16. Changes to this policy

We may update this policy as the Service changes. We will revise the “Last updated” date above, and for significant changes we will give notice on the site. Continuing to use the Service after a change means you accept the updated policy.

17. Contact

Questions, requests, or complaints: dr.ez.model@gmail.com, or use the contact form.

See also: Terms of Use · Cookie Policy · Accessibility