Privacy Policy
Last updated: [YYYY-MM-DD]
This Privacy Policy explains how [COMPANY LEGAL NAME](“we”, “us”) collects and processes personal data when you use the Academy Portal, in accordance with the EU General Data Protection Regulation (GDPR). For privacy questions or to exercise your rights, contact us at [privacy@example.com].
Who is the data controller
[COMPANY LEGAL NAME], [REGISTERED ADDRESS], [COUNTRY], is the controller responsible for your personal data.
What data we collect
- Account data: your name, email address and hashed password.
- Profile data: optional profile picture; for teachers, biography, languages, specializations and phone number.
- Learning data: cohort enrolments, class and private-lesson schedules, assignment submissions, scores and feedback.
- Communications: direct messages exchanged with teachers or students, and your conversations with the AI Tutor.
- Technical data: authentication cookies and session tokens necessary to keep you signed in.
Why we process it and on what legal basis
- To provide the service and your account — performance of a contract (Art. 6(1)(b)).
- To keep the platform secure and functioning — our legitimate interests (Art. 6(1)(f)).
- To send service and account emails — performance of a contract and legitimate interests.
- Where we ask for it, on the basis of your consent (Art. 6(1)(a)), which you may withdraw at any time.
Hosting and sub-processors
Personal data is hosted in [HOSTING REGION, e.g. EU (Frankfurt)]. We share data only with processors who act on our instructions:
- [Cloud hosting provider]
- [Transactional email provider]
- Anthropic (AI Tutor responses)
How long we keep it
We keep personal data for as long as your account is active and as required to provide the service. When you delete your account, we anonymise your identifying data so you can no longer be identified, while retaining the minimum needed for legal and accounting obligations.
Your rights
Under the GDPR you have the right to:
- access a copy of your data (you can export it from Settings);
- rectify inaccurate data;
- erase your account and data (available from Settings);
- restrict or object to processing;
- data portability;
- withdraw consent at any time;
- lodge a complaint with your local data protection supervisory authority.
Contact
To exercise any of these rights, email [privacy@example.com].