Privacy Policy
Last updated: 3 October 2026
1. Controller
The controller of your personal data under the GDPR is:
- [SELLER NAME]
- Address: [ADDRESS]
- Company ID (IČO): [COMPANY ID]
- Email: [CONTACT EMAIL]
For any privacy question or request, write to [CONTACT EMAIL].
2. What data we process, and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Email address, sign-in records | Your account and signing in | Contract, Art. 6(1)(b) |
| Messages and code you send in sessions, the tutor's replies, session summaries | Running the sessions and showing your history | Contract, Art. 6(1)(b) |
| A short learning record written by the tutor at the end of each session (for example strengths and topics to practise) | Letting the tutor build on your earlier sessions | Contract, Art. 6(1)(b) |
| Purchases, credits, payment status (no full card details) | Selling sessions, receipts, accounting, refunds | Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c) |
| Technical logs (for example IP address, error messages) | Security and fixing faults | Legitimate interest, Art. 6(1)(f) |
Please do not write sensitive personal data (about health, for example) or other people's personal data in your sessions. The tutor does not need it.
3. The AI tutor
Your session messages are sent to Anthropic, the provider of the AI model behind the tutor, to generate the replies. Under its commercial terms, Anthropic does not use this data to train its models. The tutor does not make decisions about you with legal or similarly significant effects.
4. Who receives your data
We use these service providers (processors), each under a data processing agreement:
- Supabase: database and sign-in
- Vercel: website hosting
- Anthropic: the AI model that writes the tutor's replies
- Stripe: payments. Stripe is also an independent controller for payment and fraud-prevention data.
- Resend: sending sign-in emails
Some of these providers process data outside the European Economic Area, mainly in the United States. Such transfers are protected by the EU–US Data Privacy Framework or by the European Commission's Standard Contractual Clauses. We do not sell your data and do not use it for advertising.
5. How long we keep it
- Account data, sessions and learning records: while your account exists. When you ask us to delete your account, we delete them within 30 days.
- Purchase and accounting records: for as long as accounting and tax law requires (in Slovakia, up to 10 years).
- Technical logs: a short time, usually a few weeks.
6. Cookies
We only use cookies that are strictly necessary to keep you signed in. We do not use analytics or advertising cookies, so we do not ask for cookie consent.
7. Your rights
You have the right to access your data, to have it corrected or deleted, to restrict or object to its processing, and to receive it in a portable format. To use these rights, write to [CONTACT EMAIL]. We reply within one month.
You may also complain to a data protection authority. In Slovakia this is the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov SR, dataprotection.gov.sk).
8. Age
The Service is meant for people aged 16 and over. Younger students need the consent of a parent or guardian.