Privacy Policy

Effective date: 17 October 2026

StepFluent is operated by EZRAN TECH, registered in Malaysia under registration number 202403112840 (MA0315851-P) (“EZRAN TECH”, “we”, “us” or “our”).

Business location: Kuala Lumpur, Malaysia
Contact: hello@stepfluent.com

1. What we collect and why

We use your information to run accounts, provide maths practice, save progress, connect families, send requested reports, manage payments and support, and keep StepFluent secure.

• Account and student details: name, email or existing username, password hash, age, year group, school, country, course and avatar. Parent-created student accounts may also include gender and date of birth.
• Learning and family records: answers, scores, hints, activity dates, progress, linked accounts and sharing preferences.
• Payment and support records: membership status, payment references, correspondence, email verification and delivery records, and permission records where collected.
• Technical information: IP address, approximate country, sessions and security logs.

Information comes from you, a parent or guardian, your use of StepFluent, and our payment and email providers. Required fields are needed for the relevant feature; without them, that feature may be unavailable. Payment details are needed only for paid membership. Contact us to discuss alternatives or limits on processing.

2. Students and permission

Students under 18 must have their parent’s or legal guardian’s permission before registering and using StepFluent. Students can then register and learn directly, without extra approval checkboxes or an approval screen.

A parent providing a child’s information must have authority to do so. We do not independently verify permission during registration. If required permission is missing, contact us so we can restrict the affected use, resolve the issue or arrange deletion where appropriate.

3. Who can see your information

Connected parents can see results while sharing is enabled. A parent who created a student account may also manage its profile and family membership. Turning sharing off stops future access and report emails, but cannot recall copies already received. Keep connection codes private.

We share only relevant information with staff and providers who help operate StepFluent, including hosting, backup, security, Hostinger email and Stripe payments. Providers must protect information and use it for their assigned role. Stripe handles card details; our account database does not store full card numbers or security codes.

We may also disclose information when lawfully required, to professional advisers, or during a lawful business transfer with appropriate safeguards. Entering a school name does not give that school access to results.

We do not sell student data or use it for targeted advertising. Optional promotional emails require a separate choice and can be stopped.

4. Storage, security and deletion

Some providers may process data outside Malaysia. We will use a lawful transfer condition and appropriate protection before such transfers.

We use reasonable security measures, but no online service is completely secure. We investigate breaches and notify authorities and affected people when legally required.

We keep information only as long as needed for the purposes above and accounting, security or legal requirements, then delete or irreversibly anonymise it. Limited records may remain after account closure; protected backups expire through their backup cycle.

5. Cookies and your device

We use a session cookie for sign-in and security, and browser storage for preferences, unfinished activities and work waiting to sync. Clearing storage can remove unsaved work. Sign out on shared devices. Account deletion does not erase copies already stored on devices or received by others.

6. Your choices and help

Email hello@stepfluent.com to request access, corrections, deletion, withdrawal of consent, limits on processing or data portability where available under law. Parents and guardians can contact us on a child’s behalf. We may check identity and authority, and will respond within legal time limits and explain any lawful restriction or fee. Withdrawing permission may prevent use of an affected feature.

You can also complain to Malaysia’s Personal Data Protection Commissioner. Cancelling a subscription and deleting an account are separate actions; contact us if you need help.

We will update this page and its effective date when the policy changes, notify users of important changes and obtain fresh permission where required.