Privacy Policy

What we collect

Account data (name, email, password hash), learning evidence (progress positions, quiz attempts, certificates), and purchase records. We deliberately collect no birth dates, no addresses (Stripe holds billing data), and use no tracking pixels in email. Analytics are cookieless (Plausible), which is why there is no cookie banner.

Why we process it

To deliver the service you signed up for (contract), to keep the platform secure and meet tax law (legal obligation), and to improve the product with aggregate, non-identifying statistics (legitimate interest). GDPR applies to all users regardless of location.

Your rights

Export and erasure are self-serve and honored within 30 days. Erasure removes your profile and behavioral data. Two things survive, by law and by design: purchase records are retained pseudonymized for 7 years (Estonian accounting law), and issued certificate serials remain verifiable with your name redacted — certificates are permanent records, names are not.

Processors

Stripe (payments), Cloudflare (video delivery and storage), our database host, and our email provider process data under data processing agreements. The current processor list is available on request at [email protected].

Retention and security

Logs are kept 30 days with no PII beyond user ids. Passwords are bcrypt-hashed; sessions are revocable server-side; video access uses short-lived signed tokens. Report vulnerabilities via security.txt.