Privacy Policy
MandarinMiles is a graded Chinese reading service operated by an individual for learners and families in Europe, the United Kingdom and the United States. This policy explains what personal data we collect, why we collect it, who receives it, how long we keep it and what rights you have. It is written in plain language; if anything is unclear, ask us at [email protected].
1. Who is responsible for your data
The data controller is David Yuan (operating as an individual / sole proprietor), available at [email protected]. Postal correspondence may be sent to the address given on the Contact & Imprint page.
David Chen is established in mainland China and does not maintain a representative under Article 27 GDPR or UK GDPR. Where processing is carried out by service providers outside the EEA/UK, the safeguards described in Section 6 apply. Data-protection enquiries are handled at the email address above. No statutory Data Protection Officer has been appointed; this paragraph will be updated if that changes.
2. What we collect
We collect only what is necessary to provide the service. The categories are:
- Account data — your email address, a password hash, account status and, if enabled, two-factor-authentication settings. We never store your password in readable form.
- Learning data — saved words, reading progress, level selections, and for family or classroom plans the seat names and levels entered by the adult account holder.
- Entitlement and transaction records — what you bought or subscribed to, dates, amounts, currency, payment gateway used, and an internal ledger of access rights. We do not receive or store full card numbers, bank details or PayPal credentials; these are handled exclusively by our payment providers.
- Consent records — your cookie choice (analytics / marketing), a timestamp, and whether a Global Privacy Control signal was present. This record contains no name or email address.
- Comments and correspondence — the content of any message you send us and the address you used.
- Technical and security data — IP address and request metadata in server and firewall logs, used for security, rate-limiting and abuse prevention; retained 30 days unless an incident requires longer preservation.
- Preferences — language, currency, script (simplified/traditional) and display choices stored in cookies so the site remembers how you like to read.
We do not collect: precise geolocation, biometric identifiers, racial or ethnic origin, political opinions, religious beliefs, health data, trade-union membership, genetic data, or any information about children under 13.
3. Why we process it, and our legal basis
| Purpose | Legal basis (GDPR / UK GDPR Art. 6) |
|---|---|
| Create and secure your account; deliver readers and audio | Performance of a contract (Art. 6(1)(b)) |
| Process purchases and manage access entitlements | Performance of a contract (Art. 6(1)(b)) |
| Keep accounting and tax records | Legal obligation (Art. 6(1)(c)) |
| Prevent fraud, abuse and unauthorised access; keep the service available | Legitimate interests (Art. 6(1)(f)) — security of the service and our users |
| Reply to support and privacy requests | Legitimate interests / legal obligation (Art. 6(1)(f), (c)) |
| Analytics and marketing cookies | Your consent (Art. 6(1)(a)) — no analytics or marketing provider is currently enabled, so no such scripts load |
| Newsletter, where offered | Your consent (Art. 6(1)(a)), withdrawable through the unsubscribe link in every message |
Where we rely on legitimate interests we have considered the impact on you and limited the data to what is necessary. You may request a copy of that balancing assessment at any time.
4. Cookies and similar technologies
Non-essential cookies are set only after you accept them in our consent banner; rejecting is a single click, exactly like accepting. We honour Global Privacy Control (GPC) as an opt-out signal. See our Cookie Policy for the complete cookie list and how to change your choice.
5. Who receives data
We share only what each provider needs to perform its role:
- Creem — our Merchant of Record for cards, Apple Pay and Google Pay, one-time purchases, subscriptions, renewals, refunds and tax. Creem processes payment and billing data under its own terms and privacy notice.
- PayPal — an optional wallet for one-time purchases only. PayPal processes your payment under its own privacy notice. It is never used for subscriptions or recurring billing.
- Cloudflare — content delivery, caching, bot management and the Turnstile challenge.
- Hosting and database provider — the server infrastructure on which mandarinmiles.com runs.
- Transactional email provider — Zoho Mail, used for account verification, password resets and service messages.
- Speech-synthesis provider — generates the narration audio for readers from our own text.
Service providers act under contract, may not use your data for their own purposes, and are listed in our sub-processor register, available on request at [email protected]. We do not sell personal information and we do not share it for cross-context behavioural advertising.
6. International transfers
Some providers process data outside the EEA/UK, including in the United States. Where that happens we rely on an adequacy decision (including the EU-US Data Privacy Framework and the UK Extension where applicable) or on Standard Contractual Clauses with a transfer-impact assessment, together with encryption in transit and access controls. You can request a copy of the relevant safeguards by writing to [email protected].
7. How long we keep it
- Account and learning data: until you delete your account, then removed or anonymised within 30 days except where law requires retention.
- Transaction and tax records: for the statutory period applicable to the Merchant of Record.
- Consent records: up to 12 months, as evidence of your choice.
- Server and security logs: 30 days; security-audit events are kept for a limited period for incident investigation.
- Support correspondence: up to 24 months after the matter is closed.
8. Your rights
If you are in the EEA or UK you may request access, rectification, erasure, restriction, portability, object to processing based on legitimate interests, and withdraw consent at any time without affecting the lawfulness of earlier processing. You may also lodge a complaint with your local supervisory authority.
California residents have additional rights described in our California Privacy Notice.
To exercise any right, email [email protected] or use our contact page. We may need to verify your identity (for example by confirming control of your account email). We respond within 30 days, or within the shorter or longer period the applicable law allows, with notice. These rights are free unless a request is manifestly unfounded or excessive.
9. Children
Our kids’ reading area is designed for children, but accounts are created and managed by adults. We do not knowingly collect personal data from children under 13 (COPPA) or below the age of digital consent in your country. See our Children’s Privacy Notice.
10. Automated decisions and profiling
We use automated rules to grade reading texts and to decide which content your entitlement unlocks. We do not make decisions about you that produce legal effects or similarly significantly affect you within the meaning of Article 22 GDPR, and we do not build advertising profiles.
11. Security
We use TLS in transit, access controls, optional two-factor authentication, rate-limiting, signed webhooks, a protected audio-delivery gateway, page-cache isolation for logged-in and sensitive pages, and security-event logging. No online service can be described as perfectly secure; if a breach affecting your data occurs we will notify you and the regulator where the law requires it.
12. AI-generated and synthetic content
Some illustrations on this site are created with generative AI tools and reviewed by a person before publication; reader narration is synthesised speech, not a human recording. Details and our labelling approach are in the AI Content Disclosure.
13. Changes
We will post material changes on this page and update the date above. Where a change requires your consent, we will ask for it before the change takes effect.
14. Contact
Privacy requests and questions: [email protected] · Contact & Imprint.
MandarinMiles is operated by David Yuan, an individual based in mainland China. This page is a transparency statement, not a certification or a claim of regulatory approval.