Privacy Policy

• Email address — collected at sign-up via Supabase Auth
• Subscription status and plan tier — stored in our database
• Stripe customer ID — stored when you subscribe, used to manage billing
• Learning progress — which modules you have completed, stored in our database
• Feedback submissions — message, optional email, and category submitted via the feedback form; sent to our support inbox and not stored in our database
• Anonymised usage analytics — page views and behavioural events (e.g. upgrade button clicks) via Vercel Analytics (no cookies, no PII)
• Analytics cookies — pseudonymous identifiers, session data, and device/browser information via Google Analytics 4, set only with your consent

We do not collect names, addresses, or payment card details. Card data is handled entirely by Stripe.

• To provide and manage your account
• To process subscription payments via Stripe
• To send transactional emails (account confirmation, password reset) via Supabase
• To understand aggregate usage patterns and improve the platform

We do not sell your data. We do not send marketing emails without your explicit consent.

• Contract performance — processing your email and subscription data to deliver the service you signed up for
• Legitimate interests — anonymised, cookieless analytics via Vercel Analytics to improve the platform
• Consent — Google Analytics 4 cookies, set only if you accept via the cookie banner

• Supabase — database and authentication, hosted in the EU (Ireland). Privacy policy. Data Processing Agreement in place.
• Stripe — payment processing, operated from the United States. Data is transferred under Standard Contractual Clauses. Privacy policy. Data Processing Agreement in place.
• Vercel — hosting and privacy-friendly analytics (cookieless, no PII), operated from the United States. Data is transferred under Standard Contractual Clauses. Privacy policy. Data Processing Agreement in place.
• Resend — transactional email delivery (feedback form submissions and account emails), operated from the United States. Data is transferred under Standard Contractual Clauses. Privacy policy. Data Processing Agreement in place.
• Google Analytics — analytics (only if you consent), operated by Google LLC from the United States. Data is transferred under Standard Contractual Clauses. Data retention is set to 2 months. IP addresses are anonymised by default. Privacy policy. Data Processing Agreement in place.

• Supabase session cookie — strictly necessary for authentication. Does not require consent under UK GDPR.
• Vercel Analytics — does not use cookies.
• Google Analytics cookies — set only with your consent:
  • _ga — distinguishes unique users; expires after 2 years
  • _ga_SL0LVPV4SH — maintains session state; expires after 2 years
  You can withdraw consent at any time by clearing your browser cookies or contacting us. Ad tracking and personalisation signals are always denied regardless of your choice.