TCF Base Privacy Policy
Effective Date: October 1, 2026
Last Updated: October 1, 2026
Applies To: Students, candidates, and users in Canada, North America, South America, Europe, and internationally.
1. Overview & Data Controller
This Privacy Policy describes how TCF Base ("we", "us", or "our") collects, uses, stores, and protects personal data when you use the website tcfbase.com, our interactive French learning workspace, audio-video podcasts, diagnostic tools, and exam simulator.
TCF Base is operated by B C DE SOUSA CODESIGNERS, a company registered in Brazil under CNPJ no. 18.848.888/0001-82, located at RUA 137, 556, sala 101, Goiania-GO, CEP 74.170-120, Brazil. We act as the Data Controller under applicable data protection laws, including the Brazilian General Data Protection Law (LGPD - Lei nÂş 13.709/2018), the European General Data Protection Regulation (GDPR), and the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA / Quebec Law 25).
If you have questions regarding this policy or your personal data, please contact our Data Protection Officer at: legal@tcfbase.com.
2. Personal Data We Collect
We collect personal information in the following categories:
- Account & Identity Information:
- Name, email address, profile avatar, and unique authentication identifier provided through our authentication partner (Clerk).
- Learning Progress & Academic Data:
- Selected target level (e.g., CLB 7 / NCLC 7), native language preference (English or Portuguese), learning mode (Full Access or Drip-In), diagnostic quiz responses, module test scores, and completed lesson timestamps.
- User-Generated Educational Content:
- Written responses submitted during TCF Writing Tasks (Tâches 1, 2, and 3);
- Audio recordings captured through your device microphone for browser speech recognition and pronunciation scoring;
- Personal notes and glossary entries saved in the learning workspace.
- Billing & Purchase Records:
- Payment status, Stripe customer identifier, purchase timestamps, and currency. (Note: Full payment card details are collected and processed directly by Stripe; TCF Base never stores your full credit card number).
- Technical & Audit Metadata:
- IP address, browser type, operating system, device characteristics, referrer URLs, and legal acceptance timestamps (recorded to verify and audit terms consent).
3. How We Use Your Data & Legal Bases
We process your personal information for the following specific purposes and lawful bases:
| Processing Purpose | Lawful Basis (LGPD / GDPR / PIPEDA) |
|---|---|
| Creating and managing your account and user profile | Performance of Contract (Art. 7, V LGPD; Art. 6(1)(b) GDPR) |
| Delivering interactive curriculum lessons, audio, and podcasts | Performance of Contract |
| Providing instant AI feedback on writing and speaking tasks | Performance of Contract & Legitimate Interest |
| Processing lifetime access payments and invoices | Performance of Contract & Legal Compliance (Tax records) |
| Recording and auditing your acceptance of legal terms | Compliance with Legal Obligation & Exercise of Rights |
| Protecting platform security, preventing abuse and unauthorized sharing | Legitimate Interest (Platform integrity and security) |
| Responding to student inquiries and support requests | Legitimate Interest & Performance of Contract |
4. Artificial Intelligence Data Processing & Zero-Training Commitment
TCF Base integrates enterprise AI models (such as Google Gemini and OpenAI) to evaluate writing submissions and provide real-time grammatical and phonemic diagnostics.
- Transient Processing: Text submissions sent to our AI evaluation pipeline are transmitted over encrypted TLS connections solely to generate immediate student feedback.
- Zero Public Model Training: Under our enterprise API agreements, your submitted essays, exercises, and speaking transcripts are NOT used to train, retrain, or improve public foundational AI models operated by Google or OpenAI.
- Microphone Audio Handling: Spoken pronunciation practice is evaluated natively within your browser using Web Speech APIs or processed transiently without persistent long-term storage of raw voice biometric templates.
5. Technology Subprocessors & Third-Party Sharing
We partner with specialized, security-certified cloud subprocessors to deliver the platform:
- Clerk Inc. (USA): User authentication, session management, and multi-factor security.
- Stripe Inc. (USA/EU): PCI-DSS Level 1 certified payment processing.
- Amazon Web Services (AWS S3 - US East): Cloud storage and CDN distribution for audio masterclasses and podcasts.
- Neon Inc. (USA): Serverless, encrypted PostgreSQL database hosting.
- Google Cloud Platform & OpenAI LLC (USA): AI language models for automated educational evaluation.
- ElevenLabs Inc. (USA): Neural voice generation for pedagogical host dialogues.
All subprocessors are bound by Data Processing Agreements (DPAs) requiring adherence to strict confidentiality, security, and international transfer standards.
6. International Data Transfers
TCF Base operates internationally. Your personal data is primarily stored in secure cloud data centers located in the United States, and may be accessed by our administrative team in Brazil or Canada. When transferring data across borders, we implement robust legal safeguards, including Standard Contractual Clauses (SCCs), data protection agreements, and encryption standards recognized by the EU, Brazilian ANPD, and Canadian privacy authorities.
7. Data Retention & Deletion
- Active Accounts: We retain your learning records, test scores, and account profile for as long as your account remains active, allowing you to access your lifetime study history whenever you wish.
- Tax & Audit Logs: Transaction records and legal terms acceptance logs are retained for statutory periods required by fiscal, tax, and regulatory compliance laws (typically 5 years).
- Account Deletion: You may request the permanent deletion of your account and associated learning data at any time by contacting legal@tcfbase.com. Upon verification, we will permanently delete or anonymize your personal data within 30 days, subject to mandatory legal retention requirements.
8. Your Privacy Rights
Depending on your jurisdiction (such as under LGPD in Brazil, GDPR in Europe/UK, or PIPEDA in Canada), you are entitled to exercise the following rights:
- Right of Access: Request confirmation of processing and access to copies of your personal data.
- Right to Rectification: Request correction of inaccurate, outdated, or incomplete data.
- Right to Erasure ("Right to Be Forgotten"): Request deletion of data processed under your consent or when no longer necessary.
- Right to Data Portability: Receive an export of your learning data in a structured, commonly used format.
- Right to Withdraw Consent: Revoke any consent previously provided without affecting the lawfulness of prior processing.
- Right to Non-Discrimination: You will never be penalized or receive degraded service for exercising your privacy rights.
To exercise any of these rights, send an email to legal@tcfbase.com with the subject "Privacy Rights Request". We respond to all verified requests within statutory timeframes.
9. Cookies & Local Storage
TCF Base minimizes tracking. We use:
- Essential Cookies: Necessary session cookies managed by Clerk to maintain secure authentication and CSRF defense.
- Browser Local Storage: Storing your UI preference settings (
tcf_user_settings), dark/light mode preference, and learning pace on your local device. - No Third-Party Ad Trackers: We do not deploy invasive third-party behavioral advertising cookies or cross-site tracking pixels.
10. Data Security Measures
We implement comprehensive administrative, physical, and technical controls to safeguard your data, including:
- 256-bit TLS/SSL encryption for all data in transit;
- Database encryption at rest with automated backups;
- Strict principle of least privilege for engineering and administrative access;
- Continuous monitoring and rate limiting to prevent automated scraping or credential attacks.
11. Children's Privacy
TCF Base is designed for adult students and immigration candidates preparing for the TCF Canada exam. We do not knowingly solicit or collect personal data from individuals under 18 years of age. If we learn that a minor has provided us with personal data, we will promptly delete such information.
12. Changes to this Privacy Policy
We may revise this Privacy Policy periodically to reflect enhancements to our platform, changes in technology, or regulatory developments. When updates are published, the "Last Updated" date at the top of this document will be revised. Material changes will be communicated via email or through prominent notifications in your student workspace.
13. Contact & Regulatory Authorities
If you have any questions, concerns, or complaints regarding our privacy practices:
- Entity: B C DE SOUSA CODESIGNERS (CNPJ 18.848.888/0001-82)
- Data Protection Inquiries: legal@tcfbase.com
- Address: RUA 137, 556, sala 101, Goiania-GO, CEP 74.170-120, Brazil
- Supervisory Authorities: You also have the right to lodge a complaint with your local regulatory authority (e.g., ANPD in Brazil, the Office of the Privacy Commissioner of Canada, or your competent European Data Protection Authority).