Operator: Kyle Atkins (sole trader), Sliema, Malta
Contact: kyle@abcwebsites.org
Last updated: 28 June 2026
What this covers
This policy applies to abcwebsites.online and all tools and services hosted on it, including the ABC Learning Hub, EFL practice tools, IELTS/FCE/CAE test suites, the Otto AI assistant, and the deep-sea tools catalogue. A separate privacy notice covers the Learning Hub in more detail.
What data I collect and why
Contact form submissions
Data: Name, email address, project description.
Purpose: To reply to your enquiry and, if we work together, to deliver and invoice the project.
Legal basis: Performance of a contract (Article 6(1)(b) GDPR), or pre-contractual steps at your request.
Kept: As long as needed to close the project, then deleted.
Site analytics
Data: Page path, approximate country, device type. Your IP address is used only to compute a salted daily hash (never stored raw).
Tool: Self-hosted analytics (abc-hit.php) running on this server. No cookies. No tracking pixels. No data sent to third parties.
Legal basis: Legitimate interests (Article 6(1)(f) GDPR), understanding which tools are used so I can improve them. This processing does not use cookies or persistent identifiers.
Kept: Aggregate counts; individual visit records are pruned after 90 days.
Member accounts and subscriptions
Data: Email address, subscription plan, login timestamps, tool usage counts.
Purpose: To give you access to the tools included in your plan and to enforce fair-use limits.
Legal basis: Performance of a contract (Article 6(1)(b) GDPR).
Kept: For the duration of your subscription plus 12 months, then deleted on request.
Stored: In a self-hosted database on this server. Not shared with third parties except Stripe for payment processing (see below).
Google sign-in
If you log in with Google, Google authenticates you and shares your email address and display name with this site. Two session cookies are then set on your device (abc_sess, HttpOnly, expires 30 days; abc_ctx, plan hint, expires 30 days). These cookies are necessary for the login to work. Google’s own privacy policy governs what Google collects during the sign-in process.
Otto AI assistant
When you send a message to Otto, the text is sent to an AI language model (currently provided by Anthropic via API). Otto does not log conversations on this server beyond a single session. However, the AI provider may retain API inputs for up to 30 days for safety and quality purposes under their own terms. Do not send Otto sensitive personal information. If you use Otto in a school or classroom context, please ensure that any student data shared complies with your institution’s data protection obligations.
CEFR placement test: optional email
If you enter your email at the end of the CEFR placement test, it is used to send you a one-page study plan. Legal basis: consent (Article 6(1)(a) GDPR). You can withdraw consent at any time by emailing kyle@abcwebsites.org.
Attendance and classroom tools
The attendance tool collects student check-in records (name and timestamp) for use by the teacher who set up the session. This data is stored temporarily on this server and is not shared. Teachers are responsible for ensuring students and, where applicable, their guardians are informed of this collection.
Third-party processors
The following companies process data on my behalf. Each is bound by a data processing agreement or equivalent safeguard.
| Processor | Purpose | Location | Safeguard |
|---|---|---|---|
| DreamHost | Web hosting | US (California) | EU-US Data Privacy Framework |
| Google / Firebase | Sign-in authentication | US / global | EU-US Data Privacy Framework + Google DPA |
| Stripe | Payment processing | US / Ireland | EU-US Data Privacy Framework + Stripe DPA |
| Brevo (formerly Sendinblue) | Transactional email delivery | EU (France) | Brevo DPA |
| HuggingFace | Otto AI hosting | EU (France) / US | HuggingFace DPA |
| Anthropic | Otto AI language model | US (California) | Anthropic API DPA (in progress) |
For transfers to US-based processors, I rely on the EU-US Data Privacy Framework where the processor is certified, and on Standard Contractual Clauses (SCCs) where they are not.
What I do not do
- Sell, rent, or trade your data with marketers or data brokers
- Use advertising cookies, tracking pixels, or cross-site profiling
- Use Google Analytics, Facebook Pixel, or session-replay tools (Hotjar, Clarity, FullStory)
Children and minors
This site is intended for users aged 16 and over. If used in a classroom context involving younger students, the teacher or school administrator is responsible for obtaining any necessary parental consent and informing students and guardians about data processing. If you believe a child under 16 has provided personal data directly through this site, please contact kyle@abcwebsites.org and the data will be deleted.
Your rights
Under GDPR you have the right to access, correct, delete, or export your data, and to object to or restrict processing. To exercise any of these rights, email kyle@abcwebsites.org. I will respond within 30 days, free of charge. You also have the right to lodge a complaint with Malta’s Information and Data Protection Commissioner (IDPC).
Hosting
abcwebsites.online is hosted by DreamHost (US-based). Server logs (IP addresses, timestamps) are retained by DreamHost under their own privacy policy and rotated within 30 days. The analytics, member database, and gate backend run on this server under my control.
Changes to this policy
Material changes will be announced to active subscribers by email at least 14 days before they take effect. The “last updated” date at the top of this page always reflects the current version.