GDPR & data rights

1. Your rights in practice

• Access: Get a copy of the personal data we hold about you, and the reasons we process it.
• Rectification: Correct anything inaccurate — name, email, phone number, country.
• Erasure: Have your account and data deleted, except records we must keep by law such as invoices.
• Restriction: Ask us to pause processing while a dispute about accuracy or legitimate interest is resolved.
• Portability: Receive your account and learning data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interests, including profiling for product analytics.
• Withdraw consent: Turn off marketing email or optional cookies at any time, with no effect on prior lawful use.
• Human review: Ask a person to review any automated decision that materially affects you. We do not make solely automated decisions about enrolment or pricing.

2. How to make a request

Email privacy@learneasyai.com from the address on your account, and tell us which right you want to exercise. We may ask one clarifying question to confirm identity — we will never ask for your password.

• We acknowledge within 72 hours.
• We complete the request within one month, or explain a justified extension of up to two further months.
• Requests are free unless they are manifestly excessive or repetitive.

3. Deleting your account

You can request full deletion at any time. We remove account, profile, and learning data, anonymise analytics events, and keep only what tax and accounting law requires. Deletion is irreversible and removes your certificates, so export them first.

4. Processors we rely on

Hosting and database, payment processing, transactional and marketing email, product analytics, customer support tooling, and Everflow for affiliate attribution. Each acts under a written data processing agreement and may only process data on our instructions.

5. International transfers

Where a processor is outside the EEA or UK, we rely on an adequacy decision or Standard Contractual Clauses, plus encryption in transit and at rest and a documented transfer risk assessment.

6. Breach notification

If a personal data breach is likely to create a risk to your rights, we notify the competent supervisory authority within 72 hours of becoming aware and inform affected students without undue delay, describing what happened and what to do.

7. Cookies and consent records

Optional cookies only run after you accept them in the banner, and your choice is stored so we can prove it. You can change your mind at any time on the Cookie Policy page.

8. Complaints

If you are unhappy with our response you can complain to your local supervisory authority. We would rather fix it first — write to privacy@learneasyai.com and mark it "escalation".