In short: we use your data to run your account, courses, community and payments. We don't sell it and we don't use it for advertising. Optional things — visitor statistics and automatic translation — only happen if you say yes. You can download or delete your data yourself from your profile.
Townshub Limited (company reg. HE 481530, VAT CY60229992X), Nicosia, Cyprus, is the controller of your personal data. Contact: admin@townshub.com.
We follow the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Cyprus data protection law (Law 125(I)/2018). Our supervisory authority is the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus.
| Data | Why | Legal basis (GDPR Art. 6) |
|---|---|---|
| Name, email, password (stored hashed — we can't see it), role, profile photo, bio, learning goal, location (optional) | Your account | Contract |
| Course progress, quiz results, XP, streaks, badges, project submissions | Running your courses | Contract |
| Posts, replies, likes, direct messages | Community features | Contract |
| Live-class video and audio, in-class chat, whiteboard, attendance | Live teaching | Contract |
| Voice recordings when you use pronunciation practice or the AI conversation tutor | Scoring your pronunciation and running conversation practice. Recordings go to our speech providers (section 5) and are not stored by us — we keep only your scores | Contract |
| Billing name and address, customer and transaction IDs, invoices (we never see your card number — Stripe, Flutterwave or Apple handle payment) | Billing, tax and accounting | Contract; legal obligation |
| Email address and your marketing choice | Account emails (receipts, password resets, service notices); marketing emails only if you opted in | Contract; consent |
| Device token and reminder settings (mobile app) | Lesson reminders, if you allow notifications | Consent (device permission) |
| Visitor statistics: pages visited, referrer, device, browser, screen size, country. Your country is worked out on our own server and your IP address is not stored | Improving the platform | Consent (cookie banner) |
| Your cookie choices, with a timestamp | Proving what you agreed to | Legal obligation |
| Server logs kept by our host (IP address, browser, page requested) | Security and fraud prevention | Legitimate interests |
| Which partner referred you (if any), and your payments while that referral counts | Paying our affiliate partners a commission. Partners see only totals, never your name or email | Legitimate interests |
| Partner programme (only if you apply to be a partner): your application (name or organisation, country, website, audience, how you'll promote), partner code, earnings and payouts, and the bank account you give us for payouts (stored encrypted). If you connect Stripe, only your Stripe account id and whether it can receive payouts. For schools and organisations: the names of staff you create links for, and your page logo and welcome text | Reviewing your application, running the partnership and paying your commission (automatically through Stripe, Paystack or Flutterwave) | Contract |
We don't make decisions about you that have legal or similarly significant effects by automated means. AI-generated feedback (for example pronunciation scores or reply suggestions) is advisory, and you can ask a person to review it.
| Name | Purpose | Duration |
|---|---|---|
PHPSESSID | Keeps you signed in | Until you close the browser |
lang, lang_pick, googtrans | The language you chose from the menu | 12 months |
th_consent | Remembers your cookie choices | 12 months |
theme (local storage) | Light or dark mode | Until cleared |
Payment pages load Stripe, which may set its own cookies to prevent fraud during the payment you started.
The iPhone app does not track you. Inside the Townshub Academy app we use only the strictly necessary cookies above. The optional categories below are switched off and cannot be turned on there, so no analytics and no automatic translation run, and we do not share data with advertisers or data brokers or link it with third-party data for advertising.
| Category | What it does | Stored on your device |
|---|---|---|
| Analytics | Visitor statistics, kept on our own servers. Nothing is shared with advertisers. | _th_sk — a random ID in session storage, cleared when you close the tab |
| Analytics (affiliate referral) | If you arrived through a partner's link, remembers their code so the partner gets credit if you subscribe. Partners never see who you are. | th_ref — 30 days (or this visit only without consent) |
| Automatic translation | Translates pages into your browser's language using Google Translate. Page text and your IP address go to Google. (Choosing a language yourself from the menu works without this.) | googtrans |
You can change your choices at any time:
We don't sell personal data. These providers process it on our behalf, under data processing agreements:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, sign-in, file storage | EU (Ireland) |
| Hostinger | Website hosting, email delivery, server logs; our live-class server | EU (Germany; live classes France) |
| Stripe | Card payments, subscriptions, invoices; payouts to partners who connect a Stripe account (Stripe Connect) | EU (Ireland) / US |
| Paystack | Payouts to partners' Nigerian bank accounts (account number, bank and holder name) | Nigeria / EU |
| Flutterwave | Payments in Africa; payouts to partners' Nigerian bank accounts (account number, bank and holder name) | Nigeria / US |
| Apple | iPhone in-app purchases and notifications | US |
| Google Firebase | Android notifications | US |
| Microsoft Azure Speech | Pronunciation scoring (your voice) | EU (Germany) |
| ElevenLabs | Lesson audio and the AI conversation tutor (your voice) | US / EU |
| HeyGen (with LiveKit) | AI video tutor (your voice and video during live avatar sessions) | US |
| Anthropic | The AI features you use: the live-class assistant (@assistant), conversation practice and AI tutor, AI feedback on quiz answers, agents; also course-content tools and reply suggestions | US |
| OpenAI, Perplexity, Google Gemini | Content-creation tools used by instructors | US |
| Bunny.net | Course video streaming | EU (Slovenia) |
| Google Translate | Page translation — only with your consent or when you pick a language | US |
| OpenStreetMap Foundation | Members map images and location lookup | UK |
| YouTube | Class recordings, only if you press play | US |
AI features. When you use the live-class assistant (@assistant), conversation practice, the AI tutor, AI feedback on quiz answers or agents, what you type (and your voice in the voice and video tutors) is sent to the AI providers listed above so they can write the reply. In the iPhone app we ask your permission first and these features stay off until you allow them; you can change this at any time in Profile > Privacy & your data.
AI replies to your public posts. Only if you turn it on in Profile > Privacy & your data (it is off by default), an automated AI assistant may reply to your public community posts. The text of the post is sent to Anthropic to write the reply, which is labelled as AI-written and is not from our instructor. We record when you turn it on or off, and you can switch it off at any time. Private messages are never read by AI.
Where data leaves the European Economic Area, we rely on the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework. The UK has an EU adequacy decision.
Country lookup uses IP geolocation by DB-IP, from a database stored on our own server — your IP address is not sent to DB-IP.
| Data | Kept for |
|---|---|
| Account, course, community and message data | Until you delete your account (or ask us to) |
| Payment and invoice records | 7 years (Cyprus tax and accounting law); unlinked from your account if you delete it |
| Partner applications that were rejected or withdrawn | 12 months |
| Partner bank details | Until 90 days after the partnership ends and nothing is owed |
| Partner staff links (staff names), co-branded page text and logo | Until the partner removes them or the partnership account is deleted |
| Partner commission and payout records | 7 years (accounting); unlinked from you if you delete your account |
| Visitor statistics | 13 months |
| Cookie-consent records | 3 years |
| Notification send log | 90 days |
| Server logs | As kept by our host for security, then deleted |
Expired data is deleted automatically every day.
You have the right to access your data, download it in a portable format, correct it, have it deleted, restrict or object to processing, and withdraw consent at any time (this doesn't affect processing before you withdrew).
You can also complain to the Office of the Commissioner for Personal Data Protection, Cyprus (dataprotection.gov.cy), or to the data protection authority where you live or work.
Townshub is for people aged 16 or over. (Cyprus law allows children from 14 to consent to online services; we chose a higher minimum.) Younger learners may use Townshub only with a parent or guardian who creates the account and agrees on their behalf. If we learn we hold a child's data without that consent, we will delete it.
No system is perfectly secure. If a breach puts your rights at risk, we will report it to the Commissioner within 72 hours and tell you without undue delay, as GDPR Articles 33 and 34 require.
We'll email you about material changes at least 14 days before they take effect. The date at the top shows when the current version took effect.
Townshub Limited
Nicosia, Cyprus
Email: admin@townshub.com
© 2026 Townshub Limited. — Terms & Conditions — Cookie settings