Privacy Notice

Who we are

The Hakso English School Oy (Finland) operates Waterwheel Business AI and is the data controller for the personal data described here. Contact: aaron.hakso@gmail.com.

What we collect and why

• Account data (name, email, login credentials via our authentication provider) — to create and secure your account. Legal basis: performance of our contract with you.
• Learner profile (native language, English level, job title, industry, department, interests, goals) — to adapt situations and coaching to your work. Legal basis: contract.
• Conversation content (what you type or say in situations and Real Work Mode, including any workplace details you choose to describe, plus transcripts and generated audio) — to run the lesson, produce feedback and track progress. Legal basis: contract. Please avoid entering confidential or special-category information.
• Learning records (vocabulary, corrections, skill scores, session history) — to show your progress over time. Legal basis: contract.
• Usage and technical data (device, browser, IP address, log and error data) — for security, fraud prevention, support and product improvement. Legal basis: legitimate interests.
• Support messages — to answer you. Legal basis: legitimate interests.

Who we share it with

• Service providers / subprocessors: our hosting and database provider, the AI model gateway that generates conversation and feedback, and our voice (text-to-speech) provider.
• Paddle.com Market Limited, our Merchant of Record, for the sale of subscriptions, payments, subscription management, invoicing and tax compliance.
• Professional advisers (legal, accounting) and authorities where required by law.

We do not sell personal data and we do not use it to train third-party models.

International transfers

Some providers process data outside the EEA (notably in the United States). Where that happens we rely on adequacy decisions or EU Standard Contractual Clauses with appropriate safeguards.

Retention

We keep account and learning data for as long as your account is active and for up to 12 months afterwards, then delete or anonymise it. Cached audio is kept up to 12 months. Billing records are kept as long as Finnish accounting law requires.

Your rights

Under the GDPR you may request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interests; you may withdraw consent where consent applies. Write to aaron.hakso@gmail.com and we will respond within one month. You may also complain to the Finnish Data Protection Ombudsman or your local supervisory authority.

Security

We use encryption in transit, access controls, row-level database isolation so learners can only reach their own records, and least-privilege access for staff.

Cookies

We use essential cookies and local storage to keep you signed in and remember preferences such as whether voices are enabled. Our payment provider sets cookies necessary for checkout. We do not use advertising cookies. You can clear or block cookies in your browser, though sign-in will not work without the essential ones.