Privacy and cookies
The British Council is the Data Controller for the personal information you provide to us by using AiBC tasks. This means we are responsible for determining how your information is collected, used, and disclosed to others.
Data we collect from you and for what purposes:
To deliver the AiBC tasks, depending on whether you do a speaking or writing task, we collect:
The language you speak best, which you provide to us when you register for AiBC tasks.
your User ID, your date of birth and your English Language level, data which you had provided to the application through which you access AiBC tasks, and which we transfer to the AiBC application.
To give you feedback: To help improve your English skills and, depending on the task (speaking or writing), we may collect your written responses or an audio recording of your conversation with our AI chatbot, which we turn into a transcript (written record of what you say). Please do not provide any personal or sensitive information during these tasks to protect your privacy.
To train our AI and conduct research: before we use any data for research and AI improvement, we remove personal identifiers and take additional measures to reduce the risk of identification.
To analyse the performance of our app: we gather usage analytics to help us understand how you interact with the AiBC tasks.
To measure user satisfaction: we use any information you choose to share in our optional survey at the end of the tasks, to help us improve our product.
Our Legal bases for using your data
Data protection laws state that we must have a lawful reason to use your personal data. Depending on the purposes we need to use it for, we rely on different justifications:
To provide the tasks and give you feedback, we use your data because it is necessary to deliver this service you signed up for in our Terms of Use.
To train our AI models, we use anonymous written responses, recordings and text transcripts because it is in our legitimate interest to improve the product.
To carry out customer satisfaction surveys, we rely on your consent.
To use web analytics, we rely on your consent which you give when you accept cookies.
How long we will keep your data
We will retain any data related with the provision of the service for three years.
Data used for our internal research and analysis will be kept for ten years.
Recipients of your personal information
The British Council will process your information securely and confidentially and only share it with third parties for the provision of our services. These third parties act as Processors under contract following our instructions.
We store all AiBC task related data in the UK and may also use data centres in other geographies based on regional needs.
We share recordings with speech-to-text suppliers for transcription. Data is processed and deleted in real time.
We share transcription data with chatbot suppliers for dialogue creation.
Where personal data is transferred outside the UK or EEA, we ensure appropriate safeguards are in place, such as adequacy decisions or Standard Contractual Clauses.
Your rights
The British Council complies with UK data protection laws and equivalent laws in other countries where applicable. You have rights over how we use your personal information, for example, to access your data, to ask us to correct any inaccuracies and/or to complain to a privacy regulator if you have concerns about how we have used your personal data. Where we rely on your consent, you may withdraw it at any time.
For details about how to exercise your rights, please see the privacy section of our website or contact IGDisclosures@britishcouncil.org
Cookies
We use cookies on this website to ensure security, improve functionality and provide you with a better experience, and you can accept or reject them on the cookie banner.
A cookie is a small text file that a website asks your browser to store on your device to remember information such as your language preferences or login details.
We use first-party cookies, which are set by our website, and third-party cookies, which are set by other domains to support our advertising and marketing activities.
Strictly Necessary Cookies
These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work.
| Set by | Cookie name(s) | Party | Lifespan | Purpose |
| GEEP authentication gateway | bearer | First party | 2 hours | The user’s session with the product. The partner hands the user over with an encrypted token (JWE); the gateway verifies it and stores a signed session token (JWT) in this cookie, which is checked on every request. |
| Amazon Cognito sign-in (oauth2-proxy) | _oauth2_proxy, _oauth2_proxy_csrf | First party | 24 hours (session); CSRF cookie is per request | Sign-in session for internal AiBC tools. The cookie holds a session reference, not the user’s tokens. |
| Amazon Cognito sign-in (oauth2-proxy) | _oauth2_proxy_logs, _oauth2_proxy_logs_csrf | First party | 24 hours | Sign-in session for internal staff dashboards. Not end-user facing. |
| Amazon Cognito hosted sign-in page (docs) | XSRF-TOKEN, csrf-state, cognito | Third party (amazoncognito.com domain) | Session (AWS managed) | Set by AWS during the sign-in redirect. Managed by AWS. |
Performance Cookies
These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies, we will not know when you have visited our site and will not be able to monitor its performance.
| Set by | Cookie name(s) | Party | Lifespan | Purpose |
| PostHog (production only) | ph_<project_key>_posthog | First party (third-party service) | 365 days (PostHog default) | Product analytics: distinct id, session id, feature-flag state. Data goes to PostHog’s EU region. |
| Google Tag Manager | _ga, _ga_* | Third party | Up to 2 years (GA default) | To collect information about how visitors interact with our website, such as pages visited and actions taken, so we can analyse usage, monitor performance and improve the user experience. |
Analytics Cookies
These cookies collect data on how you use our platform, using 3rd party services. They allow us to measure site performance, identify which features are most popular, and understand how users navigate our tools. All information gathered is aggregated and remains anonymous. If you do not allow these cookies, we will not include your visit in our performance reporting, limiting our ability to optimise the site for your needs.
| Set by | Cookie name(s) | Party | Lifespan | Purpose |
| Google Tag Manager | _ga, _ga_* | Third party | Up to 2 years (GA default) | To collect information about how visitors interact with our website, such as pages visited and actions taken, so we can analyse usage, monitor performance and improve the user experience. |
| Qualaroo (survey tool, loaded via GTM) | ki_r, ki_t, ki_s | Third party | Vendor defined | Survey targeting and frequency capping. We pass a hashed user id, L1 language, task id and language level to Qualaroo. |