Privacy Notice

QAcademy AI ("we", "us") is the data controller for personal data we process about learners and visitors to qacademyai.com. This notice explains what we collect, why, how long we keep it, and how you exercise your rights under the EU GDPR, UK GDPR and the California Consumer Privacy Act (CCPA / CPRA).

What we collect

• Account data: email, name, password hash, optional avatar, role (learner / parent / creator / business).
• Learning data: course progress, lesson submissions, exercise answers, safety review scores, certificate claims.
• Technical data: IP address, browser type, device, timestamps — used for security, abuse prevention and aggregated analytics.
• Family accounts: child first name (only as provided by parent) and parent-controlled review preferences.

Why we process it (lawful basis)

• Contract: to provide your courses, certificates and account.
• Legitimate interests: to keep the platform secure, prevent abuse, and improve the product through aggregated analytics.
• Consent: for non-essential cookies, marketing emails and AI provider features that share prompts outside our infrastructure (you opt in per feature).
• Legal obligation: tax records, regulatory requests, child-safety obligations.

AI providers

Some lessons and tools use third-party AI providers (e.g. OpenAI, Anthropic, Google). When that happens we tell you in the interface, your prompts and completions are transmitted to that provider under their data agreement, and provider API keys are stored server-side only — never exposed to the browser. You can opt to use only the safety-reviewed in-app prompts and never call an external provider.

Family and child accounts

Family accounts are designed for parent-led learning. We do not knowingly collect personal data from children under 13 (or 16 in the EU) without verifiable parental consent. Parents always control child profiles, can review every submission, and can delete a child profile at any time. We never use child data for advertising, model training, profiling or behavioural marketing.

Who we share data with

• Infrastructure providers (Supabase, Cloudflare) under EU SCCs.
• Email delivery providers for transactional and account emails only.
• Payment processor for paid purchases (when launched). We never store full card numbers.
• Law enforcement only when legally compelled, and only the minimum necessary.

We do not sell personal data. We do not share data for cross-context behavioural advertising. CCPA-protected sale/share opt-out: not applicable because we do neither.

How long we keep data

• Active account data: while your account is open.
• After account deletion: permanently removed within 30 days; backups purged on a 35-day rotation.
• Issued certificates: retained for public verification unless you set them private or delete your account.
• Billing records: 7 years (legal/tax requirement).

Your rights

You have the right to access, correct, delete, restrict or object to processing, port your data to another service, and withdraw consent at any time. Exercise any of these from your Account & Privacy page (one-click export and deletion) or email privacy@qacademyai.com. We respond within 30 days. EU residents can complain to their national data protection authority; UK residents to the ICO; California residents may also designate an authorised agent.

International transfers

Data may be processed outside the EEA / UK by our sub-processors. We rely on the European Commission's Standard Contractual Clauses and (for UK) the IDTA, with additional technical safeguards (encryption in transit and at rest).

Security

TLS 1.2+ in transit, AES-256 at rest, row-level security on every user table, audit logs, principle-of-least-privilege service accounts, encrypted secrets, mandatory MFA for production access. We will notify affected users and regulators of any personal-data breach within 72 hours as required by Article 33 GDPR.

Contact & updates

Data controller: QAcademy AI. Email privacy@qacademyai.com. We will post material changes here and email account holders.

Effective July 2026. We will post material changes here and email account holders before they take effect.