We collect information you provide directly, such as your name, email address, and payment details when you register or purchase courses. We also automatically collect usage data including pages visited, course progress, and device information.
Legal basis (GDPR, Art. 6): contract performance, legitimate interest, and explicit consent where required.
Owner action required: List exact data categories, retention periods, and legal bases per jurisdiction before publishing.
We use your personal data to: provide and improve the platform, process payments, send course updates and receipts, respond to support requests, and comply with legal obligations.
We do not sell your personal data to third parties.
Owner action required: Confirm exact processing purposes and whether any profiling or automated decision-making is performed (GDPR Art. 22).
We share your data with trusted service providers who assist us in operating the platform, including cloud hosting (Supabase / Vercel), payment processors (Stripe), and email delivery (Resend). All processors are bound by data processing agreements (DPAs).
We may disclose data if required by law or to protect our legal rights.
Owner action required: Sign DPAs with all 6 processors. Verify adequacy decisions or SCCs for any data transfers outside EEA (relevant for KZ). Current DPA status: PENDING.
Depending on your location, you have the right to: access your personal data, correct inaccurate data, request deletion ("right to be forgotten"), restrict or object to processing, data portability, and withdraw consent at any time.
To exercise these rights, contact us at: [TODO: Insert DPO/privacy contact email].
EU/EEA residents may lodge a complaint with the relevant supervisory authority (e.g., AEPD for Spain).
Kazakhstan residents may contact the Committee on Information Security of the Ministry of Digital Development.
We use essential cookies to operate the platform (session management, security) and optional analytics cookies to understand usage patterns. You can manage your cookie preferences at any time via the cookie banner.
We use Google Analytics 4 (GA4) for aggregate analytics. GA4 data is anonymised and does not identify individual users.
Owner action required: Complete the cookie audit and align with the separate Cookie Policy page (/cookies) before launch.
We implement industry-standard security measures including TLS encryption in transit, bcrypt password hashing (cost factor ≥12), MFA support, row-level security on all database tables, and regular security audits.
In the event of a data breach, we will notify affected users and relevant supervisory authorities within the timeframes required by applicable law (72 hours under GDPR).
For privacy-related questions or to exercise your data rights, contact our Data Protection Officer (DPO):
Owner action required: Designate a DPO or privacy point-of-contact and insert their details here before launch.