Privacy Policy

Effective: 1 September 2026 · Last updated: 1 September 2026

ELT Education Inc. (“ELT,” “we,” “us,” or “our”) operates PCAT (Practical English Test), an online English proficiency assessment service (the “Service”). This Privacy Policy explains how we collect, use, disclose, retain and protect personal information and other data relating to Users and Test Takers.

We process personal information in accordance with the Act on the Protection of Personal Information of Japan (“APPI”) and other laws applicable to our processing activities.

Article 1 (Data Controller / Business Operator)

The entity responsible for handling personal information in connection with the Service is:

Company: ELT Education Inc.
Japanese Company Name: 株式会社ELTエデュケーション
Representative Director: Tatsuya TANAKA / 田中達也
Headquarters: 5-32-12 Shiba, Minato City, Tokyo 108-0014, Japan
Corporate Website: https://elteduc.com/
Service URL: https://app.eltpcat.com/
Privacy Contact: contact form https://elteduc.com/contact or email info@elteduc.com

Article 2 (Who This Policy Applies To)

This Policy applies to:

individuals who create an account for the Service;
individuals who purchase Credits;
individuals who take PCAT;
employees, officers, job candidates, learners and other individuals who take PCAT through a company or other organization;
individuals who contact ELT in relation to the Service; and
other individuals whose personal information ELT processes in connection with the Service.

Where a company or other organization arranges a Test for another person, the contracting party and the Test Taker may be different persons.

Article 3 (Information We Collect)

We may collect the following information in connection with the Service.

1. Account and Basic Information

name;
email address;
account ID and other identifiers used within the Service;
employer, organization or other profile information entered by the User.

We do not collect date of birth, gender, nationality or similar information.

2. Google Account Information

If a User signs in using a Google account, we receive information from Google that is necessary to authenticate the User and create or operate the PCAT account.

We receive the information covered by the OpenID Connect openid, email and profile scopes: the Google account identifier, email address, name and profile image.

ELT does not obtain the User's Google account password.

3. Payment Information

Payments for Credits and other charges relating to the Service are processed through Stripe.

We may receive or access information relating to a transaction, including:

purchase amount;
number of Credits purchased;
date and time of payment;
payment status;
Stripe customer IDs, payment IDs and other transaction identifiers;
card-related information made available to ELT by Stripe;
billing information; and
other information necessary for payment processing.

The Service uses Stripe Checkout. Card numbers, expiration dates and security codes are entered on a payment page hosted by Stripe and are never received or stored by ELT. We store the payment identifiers issued by Stripe, the number of Credits purchased and whether the payment succeeded.

4. Audio Recorded During a Test

A microphone is required for the Speaking portion of PCAT. We record the Test Taker's spoken responses.

Audio is used primarily for:

scoring Speaking performance;
speech recognition;
generating Score Reports;
quality assurance;
reviewing suspected Misconduct or Test incidents; and
improving test items and scoring quality.

Audio is retained for two years from the date of the Test.

Access to audio is, as a matter of policy, restricted to ELT personnel and service providers who are authorized and have a business need to access it for the operation of the Service, scoring, quality assurance, integrity review, incident handling or related purposes.

5. Video Recorded During a Test

A Test Taker may choose to enable the browser camera during the Test. PCAT itself may be taken with the camera disabled.

If the camera is enabled, video of the Test session is recorded.

Video is used primarily for:

reviewing the testing environment;
assisting with identity verification;
detecting and investigating impersonation or other Misconduct;
responding to Test-related inquiries or challenges; and
protecting the integrity and reliability of the Service.

Video is retained for one year from the date of the Test. Because video affects privacy more significantly than audio or written responses, we limit this period to what is necessary for integrity review and for handling challenges.

Access to video is, as a matter of policy, restricted to ELT personnel and service providers who are authorized and have a business need to access it for integrity review, identity verification, inquiry handling, system operation or related purposes.

Even where a Corporate Customer has arranged the Test, we do not provide the Test video itself to the Corporate Customer or make it available for viewing. What we provide to a Corporate Customer is limited to the Test results and the record of the Test session described in Article 10 (whether the camera was enabled, the number and duration of focus-loss events, and the number of attempted restricted actions).

Because audio and video may reveal a Test Taker's speech, behavior and surroundings and therefore involve a high degree of privacy sensitivity, ELT limits their purposes of use and access to what is reasonably necessary.

6. Test Responses

We collect responses submitted or spoken by Test Takers in connection with Reading, Listening, Writing, Speaking and other Test items.

This may include:

multiple-choice responses;
written responses;
spoken responses and transcripts generated from those responses; and
other answers submitted through the Service.

We use Test responses for scoring, Score Report generation, quality assurance, integrity review, and improvement of test items and assessment methods.

7. Test-Session Activity Logs

To protect test integrity and assess the reliability of Score Reports, the Service detects and records certain activities during a Test, including:

attempts to copy;
attempts to paste;
attempts to print;
attempts to use the right-click function;
attempts to use in-page search;
the number of times focus leaves the screen, tab or window in which the Service is displayed;
the duration of focus-loss events;
records of exiting full-screen mode; and
records of Test audio playback stopping other than through an on-screen action.

These activity records are displayed in the Score Report.

Activity logs are used as one source of information in reviewing possible Misconduct. A recorded activity does not, by itself, automatically establish that Misconduct occurred.

8. Device, Network and Technical Information

When the Service is accessed or used, we may automatically collect:

IP address;
browser type and version;
operating system and device information;
date and time of access;
access logs;
session information;
error information;
connectivity information;
information collected through cookies and similar technologies;
the User-Agent string identifying the browser and device; and
the display language setting.

9. Information Provided by Corporate Customers

If a Corporate Customer arranges a Test for an employee, candidate or other person, we may receive information about the Test Taker from that Corporate Customer, such as the Test Taker's name, email address and other information necessary to arrange and administer the Test.

Specifically, we receive the Test Taker's name and email address. Any other information received from a Corporate Customer is specified in the relevant individual agreement.

10. Inquiry Information

When an individual contacts us, we may collect:

name;
email address;
organization;
content of the inquiry;
communication history; and
other information voluntarily provided by the individual.

Article 4 (Purposes of Processing)

We use personal information and other data for the following purposes.

1. Providing and Operating the Service

creating, authenticating and managing accounts;
identifying Users and Test Takers;
enabling Google sign-in;
processing and managing purchases and Credits;
processing payments;
administering Tests and enabling eligible Test sessions to be resumed;
responding to inquiries; and
delivering important Service notices.

2. Scoring and Generating Score Reports

scoring Speaking, Listening, Reading and Writing performance;
processing responses using AI, large language models and speech recognition;
generating CEFR-based level information and other PCAT assessment results;
generating, displaying and providing Score Reports;
performing scoring quality assurance; and
conducting human review of certain scoring results where appropriate.

3. Identity Verification and Test Integrity

verifying or assisting in verifying the identity of Test Takers;
detecting, investigating and preventing impersonation and other Misconduct;
reviewing copy, paste and other restricted activities;
reviewing focus-loss and other Test-session behavior;
reviewing potentially compromised Test results;
investigating score validity; and
preventing security abuse and unauthorized use.

4. Service Improvement and Quality Assurance

improving Service features, user interface and usability;
investigating and correcting errors and incidents;
evaluating the accuracy and consistency of scoring;
quality assurance of speech recognition and other scoring processes; and
statistical analysis of Service usage.

5. Improvement of Test Items and Assessment Quality

analyzing item difficulty, discrimination and other item performance;
improving question wording and formats;
improving scoring criteria and assessment methods;
developing, tuning and evaluating scoring models dedicated to PCAT (internally within ELT only — see Article 5.3);
identifying problematic test items or scoring behavior; and
improving the overall quality and reliability of PCAT.

Where identification of an individual is not necessary, we will endeavor, where appropriate, to use anonymization, pseudonymization, aggregation or other techniques that reduce direct identifiability.

6. Legal Compliance and Dispute Handling

complying with applicable law;
protecting ELT's rights and property;
investigating violations of applicable Terms of Use; and
handling disputes, claims, inquiries and challenges.

Article 5 (AI-Assisted Scoring and Use of Data)

1. AI Scoring

The Service uses large language models, speech recognition and other AI technologies to score Test Taker responses.

Accordingly, written responses, Speaking audio or transcripts, test-item information and other data necessary for scoring may be processed using AI systems.

2. Human Review

For quality assurance, integrity review, inquiry handling or other purposes reasonably necessary to operate the Service, authorized ELT personnel or service providers may review responses, audio, video, scores and other relevant information.

3. Use of Test Data for AI Model Training or Improvement

Whether Test Taker responses, audio, video or other personal data are used to train or retrain ELT's own AI models or the foundation or general-purpose models of an AI service provider is as follows.

We do not use Test Taker responses, audio, video or other personal data to train or retrain any general-purpose or foundation AI model, whether our own or an AI service provider's. Nor do we supply such data to a third party for the training of its AI models.

Azure OpenAI Service (Microsoft) and the Claude API (Anthropic), which we use for scoring, both state that data submitted through their APIs is not used to train foundation models by default. We use these services with those default settings.

We may, however, use Test Taker responses, audio and scoring results internally within ELT to improve the scoring accuracy and item quality of PCAT. Video recorded during a Test is used only for the purposes set out in Article 3.5 (integrity review and related purposes) and is not used for this purpose. This use includes:

comparing machine scores against human ratings, and tuning and validating scoring criteria, scoring prompts and assessment methods;
developing, tuning (including fine-tuning) and evaluating scoring models dedicated to PCAT; and
analyzing item difficulty and discrimination, and detecting problematic items or scoring behavior.

This use is carried out internally, for the operation and quality improvement of PCAT, and is distinct from training a general-purpose or foundation AI model. Where identification of an individual is not necessary for that purpose, we apply anonymization, pseudonymization or other techniques that reduce direct identifiability as far as practicable before use. Access is limited to personnel who need it for their work.

4. Nature of Automated Processing

PCAT generates scores using automated AI-assisted processing. Certain scoring results may also be reviewed by a human.

Where a Corporate Customer uses PCAT in recruitment, placement or another employment context, ELT does not itself make the final recruitment, placement, promotion, termination or other employment decision.

Article 6 (Data Storage Location)

Test audio, video and written response data are stored in the Japan region of Microsoft Azure.
For AI scoring or other processing, data may be transmitted to or processed by AI service providers or other processors located outside Japan. See Article 9 for further information.
Backups are stored in the same region as production data (Japan). Under our current configuration, we do not replicate data to a geographically separate region (geo-redundancy).

Article 7 (Retention and Deletion)

We retain personal information only for as long as reasonably necessary to fulfill the purposes described in this Policy, comply with applicable law, address disputes or integrity investigations, or satisfy other legitimate retention requirements. We then delete, anonymize or otherwise appropriately dispose of the data.

1. Account Information

Retention period: for as long as the account exists. After an account is deleted, information is retained for no more than three years from the date of deletion (excluding information we are required by law to keep, payment records, and information needed for a dispute or integrity investigation).

Where deletion of an account is requested, we will, within 30 days after confirming the request, delete the account information from our production environment or process it into a form that does not identify an individual. Information that we are required by law to retain, payment records and information necessary for a dispute or an integrity investigation will be retained for the period required. Erasure from backups is addressed in paragraph 8 below.

2. Audio

Retention period: two years from the date of the Test.

Following expiration of the retention period, audio will be deleted or rendered non-identifiable unless continued retention is required by law or reasonably necessary for a dispute, integrity investigation or similar matter.

3. Video

Retention period: one year from the date of the Test.

Because video involves heightened privacy considerations, this period is shorter than the periods applied to audio and to written responses, and reflects the time reasonably necessary for integrity review, identity verification, challenge handling and related purposes.

4. Written Responses and Scoring Data

Retention period: five years from the date of the Test. This period is longer than the periods applied to audio and video so that we can reissue Score Reports and respond to requests about a Test Taker's testing history.

Where responses are used for longer-term analysis to improve test items and scoring methods, we will apply anonymization, pseudonymization or other safeguards as appropriate.

5. Activity and Access Logs

Retention period: activity records from a Test session form part of the Score Report and are retained for the same period as in paragraph 4 above. System access logs are retained for one year from the date they are collected.

6. Payment Information

Retention period: in ELT's databases, seven years from the last day of the fiscal year in which the transaction occurred, reflecting statutory bookkeeping-retention requirements. Retention within Stripe is governed by Stripe's own terms.

7. Corporate-Customer Data

The handling of data when a corporate agreement ends or a Corporate Customer requests deletion will be governed by the applicable agreement and applicable law.

Unless the applicable agreement provides otherwise, we will delete the Test Taker information received from a Corporate Customer within 90 days after that corporate agreement ends. A Test Taker's own account information and Test results are retained in accordance with the periods set out in this Article as they apply to the Test Taker.

8. Backups

Information deleted from production systems may remain in system backups for a limited period.

Database backups expire automatically within a maximum of 35 days. Information deleted from the production environment is therefore also erased from backups no later than the expiry of that period.

Article 8 (Service Providers and Processing on Our Behalf)

We may engage service providers to process personal data on our behalf to the extent necessary to provide the Service.

Key service providers or service categories include the following.

1. Microsoft Azure

Purpose: hosting, storage, infrastructure and related services
Provider: Microsoft (Microsoft Azure)
Primary storage location: Japan region
Data: account information, audio, video, written responses, scores, logs and other data necessary to operate the Service

2. AI and Speech Recognition Services

We use three services.

(a) Azure OpenAI Service (Microsoft)

Purpose: scoring of Writing and Speaking responses
Data processed: written responses, Speaking transcripts, test-item information
Processing location: the Azure region configured by ELT

(b) Azure AI Speech (Microsoft)

Purpose: transcription and pronunciation assessment of Speaking audio
Data processed: test audio
Processing location: Japan region (japaneast)

(c) Anthropic (Claude API)

Purpose: translating scoring feedback into Japanese
Data processed: the per-dimension scoring commentary only. Response text itself, audio and video are not sent, although the commentary may quote part of a response
Provider location: United States

Use for model training: each of these providers states that data submitted through its API is not used to train foundation models, and we use these services with those default settings (see Article 5.3).

3. Stripe

Purpose: card payments, transaction processing, payment-fraud prevention and payment administration
Provider: Stripe
Provider/processing location: Stripe is headquartered in the United States and processes data in accordance with its own data-processing terms
Data: payment and transaction information processed by Stripe

4. Google

Purpose: authentication and sign-in using Google accounts
Provider: Google
Data: authentication and profile information made available through Google OAuth
OAuth scopes: openid, email, profile

We select and supervise service providers in a manner appropriate to the nature and risks of the personal data involved and use contractual or other safeguards as required by applicable law.

Article 9 (Third-Party Disclosures and International Transfers)

1. Disclosure to Third Parties

We do not disclose personal data to third parties except where:

the individual has consented;
disclosure is required or permitted by law;
disclosure is necessary to protect a person's life, body or property and obtaining consent is difficult;
another exception under the APPI or other applicable law applies; or
the transfer constitutes outsourcing, a business succession or another arrangement that is not treated as a third-party disclosure under applicable law.

2. Transfers to AI Providers or Other Recipients Outside Japan

Providers used for AI scoring, speech recognition or other functions may be located outside Japan or may process data outside Japan.

The relevant provider and jurisdictional information is:

Provider: Anthropic (Claude API)
Country of establishment: United States
Data transferred or processed: the per-dimension scoring commentary only. Response text itself, audio and video are not sent, although the commentary may quote part of a response
Legal mechanism for transfer/outsourcing: we treat this transfer as outsourcing under the APPI (Article 27, paragraph 5, item 1). We do not permit the service provider to handle the data beyond the scope of the purposes set out in this Policy

Azure OpenAI Service and Azure AI Speech (both Microsoft) process data in the Azure region configured by ELT. Speech transcription is processed in the Japan region (japaneast).

Where personal data is transferred to or processed by a service provider outside Japan, ELT will take the information-provision, consent, contractual, monitoring and other measures required by the APPI and other applicable law.

3. Legally Required Disclosures

We may disclose information where required by a lawful request from a court, law-enforcement agency, regulator or other public authority.

Article 10 (Sharing with Corporate Customers)

1. Corporate-Sponsored Tests

Where an employer, prospective employer, school, training provider or other organization (a “Corporate Customer”) arranges a Test, ELT may share Test results and related information with that Corporate Customer in accordance with the relevant agreement, notices provided to the Test Taker and applicable law.

2. Information That May Be Shared

Information shared with a Corporate Customer may include:

Test Taker name and other identifiers;
date and time of the Test;
PCAT score and CEFR-based level;
skill-specific results;
the Score Report;
copy, paste and other activity records;
the number and duration of focus-loss events;
information relating to score validity or integrity review; and
whether the Test was taken with the camera enabled.

3. Audio and Video

Whether raw Test audio or video is disclosed or made available to Corporate Customers is:

Audio: not provided
Video: not provided

What we provide to a Corporate Customer is limited to the Test results and the records of the Test session listed in paragraph 2 above.

If audio or video is provided to a Corporate Customer, the purpose, scope, access rights, retention and other relevant details will be disclosed to the Test Taker, and any procedures required by applicable law will be followed.

4. Corporate Customer's Subsequent Use

Corporate Customers may use Score Reports for purposes determined by them, including recruitment, placement and training.

A Corporate Customer's subsequent use of personal information received from ELT may be subject to the Corporate Customer's own privacy policy, internal rules and legal obligations.

PCAT provides information relating to English proficiency. ELT does not make final recruitment, placement, promotion, termination or other employment decisions on behalf of Corporate Customers.

Article 11 (Cookies and Similar Technologies)

The Service may use cookies, local storage and similar technologies for authentication, maintaining login sessions, security, fraud prevention, saving preferences, operating the Service and related purposes.
These technologies may include:
- cookies required for authentication and session management;
- security and fraud-prevention technologies; and
- technologies used to save User preferences.

The Service does not use cookies for advertising purposes or cookies used for behavioral tracking by third parties.

Users may disable cookies through browser settings. However, disabling cookies that are necessary for the Service may prevent login or other features from functioning properly.
Because the cookies and similar technologies used by the Service are limited to those described above, we do not maintain a separate Cookie Policy.

Article 12 (Security Measures)

ELT implements necessary and appropriate organizational, personnel, physical and technical safeguards, in accordance with applicable law, to protect personal information against unauthorized access, loss, destruction, alteration, leakage and other risks.

1. Organizational Measures

defining responsibility and authority for personal-data handling;
managing access rights;
maintaining incident reporting and response procedures; and
reviewing personal-data handling practices.

The person responsible for the handling of personal information is ELT's Representative Director. Any incident involving leakage or a similar event must be reported to that person promptly, and will be handled in accordance with Article 15.

2. Personnel Measures

privacy and security training for personnel handling personal data;
controls designed to prevent access by unauthorized personnel; and
confidentiality obligations and related controls.

3. Physical Measures

controls over access to devices and media containing personal data; and
measures designed to prevent theft or loss of devices and media.

Personal data held by the Service is stored in Microsoft Azure data centers, and physical management of the server facilities is carried out by Microsoft. On the workstations used to handle personal data, we apply screen locking and disk encryption, and our practice is not to copy personal data onto removable media.

4. Technical Measures

access control;
authentication and authorization;
protection against unauthorized access;
protection of data in transit and at rest;
logging and monitoring; and
vulnerability management and other security measures.

Specifically, we have implemented the following measures.

Encryption at rest: stored data is encrypted using the encryption-at-rest features provided by Microsoft Azure storage and databases.
Encryption in transit: communications between a User's browser and ELT, and between ELT and each service provider, are encrypted using TLS. Connections to storage are restricted to TLS 1.2 or later.
Restriction of public access: stored audio and video are configured so that they cannot be retrieved by a third party who knows the URL, and are delivered only to the Test Taker through signed URLs that expire.
Privilege management: Test Taker and administrator privileges are kept separate, and administrative functions are limited to accounts holding administrator privileges.
Logging: access logs and application logs are collected and retained for 30 days.
Vulnerability management: we continuously monitor vulnerability information for dependency packages and apply the necessary updates.

5. Understanding Foreign Environments

Where a service provider located outside Japan processes personal data, ELT will, to the extent required by applicable law, assess the relevant foreign privacy environment and implement appropriate safeguards.

Article 13 (Access, Correction, Deletion and Restriction Requests)

Subject to the APPI and other applicable law, an individual may request notification of purpose of use, access to retained personal data, correction, addition or deletion of inaccurate data, suspension or deletion of use, suspension of third-party provision, disclosure of records of third-party provision, and other rights available under applicable law.

1. Contact

Requests should be submitted through the following contact page and identified as a request concerning personal information:

https://elteduc.com/contact

2. Identity Verification

We may request information reasonably necessary to verify that the requester is the data subject or a duly authorized representative.

As a general rule, we verify identity by contacting the email address registered to the account. If identity cannot be confirmed in that way, we may ask for a copy of an official identification document or other additional supporting materials.

3. Fees

We do not charge any fee for notification of the purpose of use or for disclosure of personal information or other such requests.

4. Response

We will review valid requests and respond within a reasonable period in accordance with applicable law.

Where applicable law permits us to deny all or part of a request, we may do so and will provide an explanation to the extent required by law.

5. Account Deletion

Deleting a PCAT account is not necessarily the same as exercising a statutory right to deletion or restriction of processing.

Even after an account is deleted, some information may be retained where necessary to comply with legal obligations, maintain payment records, address disputes or integrity investigations, or complete backup-retention cycles.

Article 14 (Children and Minors)

Where a minor uses the Service, consent of a parent or legal representative or another procedure may be required depending on the Test Taker's age, the manner in which the Service is provided and applicable law.

The Service is intended for individuals aged 16 or over. Individuals under 16 may not use the Service. An individual aged 16 or 17 must obtain the consent of their legal representative before using the Service. We do not verify age at registration, so obtaining that consent is the responsibility of the User.

Where a Corporate Customer, school or other third party arranges a Test for a minor, that Corporate Customer or other party is responsible for providing the necessary explanation to, and obtaining consent from, the Test Taker and their legal representative.

Article 15 (Personal Data Breaches)

If a leakage, loss, destruction or other personal-data incident occurs, ELT will investigate the incident and take appropriate measures to contain harm and prevent recurrence.

Where notification to the Personal Information Protection Commission of Japan or affected individuals is required by law, ELT will make such notifications in accordance with applicable requirements.

Article 16 (Changes to This Policy)

We may amend this Policy in response to changes in law, changes to the Service, changes in third-party services or other circumstances.
If a change is material, we will provide notice of the revised Policy and its effective date through the Service, an ELT website, email or another appropriate method.
Where applicable law requires consent to a particular change, we will obtain the required consent.
Unless otherwise stated, the revised Policy will take effect on the effective date specified by ELT.