Privacy and Cookie Policy

Version in force as of: October 18, 2026

In short. NeoSkills Academy uses your data only to prepare you for the Duolingo English Test: to manage your account, score your exercises, track your progress, process your payments and keep the Platform secure. Your data is never sold, your voice recordings are not used to identify you.

Article 1 — Purpose and scope

1.1. This Privacy and Cookie Policy (the "Policy") explains how NeoSkills Academy collects and processes the personal data of people who use the website https://neoskills.academy and the online learning area available after login (together, the "Platform").

1.2. It applies to learners ("Learners"), parents or legal guardians of minor Learners, customers who purchase a plan ("Customers"), website visitors and anyone who contacts our support team (together, "you").

1.3. It supplements the Terms of Use (https://neoskills.academy/terms) and the Terms of Sale (https://neoskills.academy/terms-of-sale).

1.4. NeoSkills Academy is an independent preparation platform and a member of the Duolingo English Test Global Partner Network. It is not Duolingo, Inc. and does not issue official DET scores. Duolingo® and Duolingo English Test® are trademarks of Duolingo, Inc.

Article 2 — Data controller

2.1. The data controller is NeoSkills Academy, a SARL (limited liability company), whose registered office is at 4, rue Nahas Nahoui, 2nd floor, apartment 3, Maârif, Casablanca, Morocco, registered in the Casablanca Trade Register under no. 664947 (IF: 72069967; ICE: 003943522000060).

2.2. For any question about your data: contact@neoskillsacademy.com — WhatsApp: provided in the platform.

2.3. Person responsible for data protection: Mr Mohammed Taha HARRATI, reachable at the same address.

Article 3 — Applicable law and representatives

3.1. All users. As NeoSkills Academy is established in Morocco, all processing is subject to Law No. 09-08 and its implementing texts, as well as to the CNDP's deliberations.

3.2. Users in the European Union. When we offer our services to people in the European Union or the European Economic Area, Regulation (EU) 2016/679 (the "GDPR") also applies to the processing that concerns them (Article 3(2) GDPR).

3.3. Users in the United Kingdom. The UK GDPR and the Data Protection Act 2018 apply on the same basis.

Article 4 — Data we process

4.1. Depending on how you use the Platform, we process the following categories of data:

• Identity and contact details: first name, last name, email address, phone number, country;

• Account credentials: login email and password (stored only in hashed form);

• Learning profile: level, target score, display name;

• Learning content: answers to the diagnostic and exercises, written responses, voice recordings of your spoken answers and their transcripts;

• Results: estimated scores, automated feedback, progress, experience points, streaks and, for the Premium plan, teacher feedback;

• Orders and payments: plan chosen, amount, currency, date, transaction ID, proof of bank transfer or Cash Plus receipt. We never receive or store your full card number;

• Support communications: messages sent by email or WhatsApp and their attachments;

• Technical data: IP address, device type, browser, connection logs, security events;

• Cookies and trackers: see Article 13.

4.2. Mandatory fields are indicated at the point of collection. Without this information, we cannot create your account, process your order or answer your request. All other information is optional.

4.3. We do not ask for sensitive data (health, opinions, religion, etc.). Please do not include any in your exercise answers or messages.

Article 5 — Purposes, legal bases and retention periods

5.1. The table below sets out the purposes for which we process your data, the legal basis under the GDPR and how long we keep it. Under Law No. 09-08, this processing is based on your consent or on one of the exceptions provided by law (performance of a contract, legal obligation, legitimate interest).

5.2. When these periods expire, the data is deleted or irreversibly anonymised. Data may be kept longer where a legal obligation, an investigation or a dispute requires it, and only for that purpose.

5.3. Where we rely on our legitimate interest, we ensure that it does not disproportionately affect your rights. You may object to such processing (Article 11).

Article 6 — Voice recordings, automated scoring and artificial intelligence

6.1. How it works. When you answer a speaking exercise, your voice is recorded and then converted into text by a speech-to-text tool. Your written responses and these transcripts are analysed by a self-hosted language model running on the infrastructure of NeoSkills Academy. The model produces an estimated score and feedback covering, in particular, fluency, coherence, grammar and vocabulary; pronunciation analysis is being added progressively.

6.2. Practice estimates. The scores and feedback produced are educational estimates. They are not official Duolingo English Test scores, are not shared with Duolingo or any institution, and have no legal effect or similarly significant effect on you. They are therefore not a decision based solely on automated processing within the meaning of Article 22 GDPR. We nevertheless tell you about them for transparency.

6.3. Human involvement. No one reviews your answers, except under the Premium plan, which includes teacher review, or where you ask our support team to look at a result. Teachers are bound by confidentiality.

6.4. No model training without your agreement. Your answers, recordings and transcripts are not used to train or fine-tune artificial intelligence models.

6.5. No biometric identification. Your voice is used only to assess your answer. We do not create voiceprints and do not use your voice to identify or authenticate you. The recordings are therefore not biometric data processed for the purpose of identification.

6.6. Recommendation. Record your answers in a quiet place and avoid having other people audible in the background.

Article 7 — Minors

7.1. The Platform is not intended for children under 13, who may not create an account. If we learn that an account has been created by a child under 13, we will delete it.

7.2. For a Learner aged 13 to 17, or who has not reached the age of majority or the age of digital consent applicable in their country (for example 15 in France or 16 in Germany), the account is created and the purchase is made or authorised by a parent or legal guardian. The parent or guardian accepts the applicable terms, gives the necessary consents (Article 8 GDPR where applicable), supervises use of the Platform and may exercise the Learner's data rights.

7.3. We collect from minors only the data needed for the service. We do not send marketing to a minor without the consent of their parent or legal guardian.

7.4. The Duolingo English Test applies its own parental permission rules for minor test takers; these are a matter for Duolingo.

Article 8 — Recipients and processors

8.1. Your data is accessible only to authorised NeoSkills Academy staff who need it for their duties, and to the following recipients, under a contract. Providers acting as processors process your data only on our instructions and are bound by confidentiality and security obligations:

8.2. Card payments are made on the CMI secure payment page: NeoSkills Academy neither sees nor stores your full card details. PayPal, WhatsApp (Meta) and payment institutions also apply their own privacy policies to the processing they carry out on their own behalf.

8.3. Duolingo. We do not share any Learner data with Duolingo, Inc., except where you ask us to help you obtain a discount voucher or book the DET; we then pass on only the information needed for that request. Your registration for the DET on Duolingo's website is governed by Duolingo's privacy policy.

8.4. Group offers. Where your access is funded by an institution or organisation, contact us via mail or WhatsApp.

8.5. Other recipients. Your data may be disclosed to administrative or judicial authorities where required by law.

8.6. Leaderboard. Your display name, points and leaderboard position are visible to other Learners. We recommend using a pseudonym.

8.7. We never sell or rent your data.

Article 9 — Transfers outside Morocco and the European Union

9.1. Some of the recipients listed in Article 8 process data outside Morocco, in particular in the United States.

9.2. Moroccan law. In accordance with Article 43 of Law No. 09-08, transfers to countries recognised by the CNDP as providing an adequate level of protection (in particular the Member States of the European Union and the United Kingdom) are made on that basis. Transfers to other countries, including the United States, are based on Article 44 of the same law.

9.3. GDPR and UK GDPR. For users in the European Union or the United Kingdom, transfers to providers established in the United States rely on the EU–US Data Privacy Framework and its UK Extension where the provider is certified, or otherwise on the standard contractual clauses adopted by the European Commission (supplemented, for the United Kingdom, by the UK Addendum). Morocco is not covered by a European Commission adequacy decision: your data is processed by NeoSkills Academy in Morocco subject to the safeguards described in this Policy.

Article 10 — Security

10.1. We implement technical and organisational measures appropriate to the risks, including:

• encryption of data in transit (HTTPS);

• hashing of passwords;

• access control and the principle of least privilege;

• regular backups;

• logging of security events;

• confidentiality commitments from authorised staff and providers.

10.2. In the event of a data breach likely to present a risk to you, we follow an incident management procedure and notify the competent authorities and, where required by law, the individuals concerned.

10.3. You help keep your account secure by keeping your password confidential and not sharing your account.

10.4. Data collected over the internet, an open network, may travel across networks without an absolute guarantee of security and may be read or used by unauthorised third parties, despite the measures described above (Article 5 of Law No. 09-08).

Article 11 — Your rights

11.1. All users (Law No. 09-08). You have:

• a right of access to your data;

• a right to rectify, update or erase data that is inaccurate, incomplete or unlawfully processed;

• a right to object, on legitimate grounds, to the processing of your data, and a right to object to marketing without giving reasons.

11.2. Users covered by the GDPR or UK GDPR. You also have:

• a right to erasure;

• a right to restriction of processing;

• a right to data portability for data you have provided to us, where processing is based on contract or consent;

• a right to object to processing based on our legitimate interest;

• the right to lodge a complaint with a supervisory authority (Article 12).

11.3. These rights may be limited where the law so requires, for example for accounting records that we must keep.

Article 12 — Exercising your rights and complaints

12.1. To exercise your rights, write to contact@neoskillsacademy.com, stating your request and the email address of your account. The parent or legal guardian of a minor Learner may act on the Learner's behalf.

12.2. If we have reasonable doubts about your identity, we may ask you for additional information, in a proportionate manner. We ask for an identity document only where strictly necessary.

12.3. We respond within a reasonable time, make justified corrections within the ten clear days required by Article 8 of Law No. 09-08 and, for users covered by the GDPR or UK GDPR, within one month, which may be extended by two months for complex requests, in which case we will let you know. Exercising your rights is free of charge, unless a request is manifestly unfounded or excessive.

Article 13 — Cookies and trackers

13.1. A cookie is a small file placed on your device when you visit a website. The Platform uses cookies and similar technologies in accordance with CNDP deliberation No. D-939-2025 and, for users in the European Union and the United Kingdom, the applicable European and UK rules.

13.2. Categories.

13.3. Current use. Only the two strictly necessary cookies listed below are used. We do not currently use audience measurement, marketing or advertising cookies.

13.4. Future changes. If non-essential cookies are introduced, this Policy will be updated and any required consent will be obtained before they are placed.

13.5. Managing cookies. You can block or delete cookies using your browser settings. Blocking these necessary cookies may prevent sign-in or keeping your session open.

13.6. List of cookies.

Article 14 — Marketing communications

14.1. We send you offers, tips and news by email or WhatsApp only if you have consented, for example by ticking an unticked box, in accordance with Law No. 09-08 and the CNDP's deliberations (in particular D-940-2025).

14.2. Every marketing email contains a free unsubscribe link. You can also withdraw your consent at any time by replying to the WhatsApp message or by writing to contact@neoskillsacademy.com.

14.3. Service messages (order confirmation, access activation, security, support replies) are not marketing communications and are sent to you while your account is active.

Article 15 — Changes to this Policy

15.1. We may amend this Policy to reflect changes to our services or to the law. The date of the version in force appears at the top of the document.

15.2. If we make a significant change, we will inform you by email or by a message on the Platform before it takes effect. Where a change requires your consent, we will ask for it again.

Article 16 — Language and contact

16.1. This Policy is written in English and translated into French. In the event of any discrepancy, the English version prevails.

16.2. For any question: NeoSkills Academy, 4, rue Nahas Nahoui, 2nd floor, apartment 3, Maârif, Casablanca, Morocco — contact@neoskillsacademy.com.