Privacy Policy

1. Controller

LearnEasyAI is the data controller for the personal data described here. For any privacy question, write to privacy@learneasyai.com. Our registered details are on the Imprint page.

2. What we collect

• Account data: name, email address, phone number, country, learning goal, password hash.
• Learning data: courses started, lab submissions, progress, assessment results, certificates.
• Billing data: plan, invoices, and payment status. Card details are handled by our payment provider — we never see or store the full card number.
• Communication data: support messages, marketing preferences, email delivery events.
• Technical data: IP address, device and browser type, pages viewed, referring URL, and affiliate click identifiers.

3. Why we use it, and our legal basis

• To provide the service — account creation, access links, course delivery, certificates. Basis: performance of a contract.
• To take payment — subscriptions, invoices, refunds. Basis: contract and legal obligation.
• To secure the platform — fraud prevention, abuse detection, trial-abuse checks. Basis: legitimate interests.
• To improve the product — aggregated analytics on which lessons work. Basis: consent for optional analytics cookies, legitimate interests for server-side aggregates.
• To market to you — course updates and the weekly AI briefing. Basis: consent, withdrawable at any time via the unsubscribe link.
• To pay affiliates — attributing a sign-up to a partner via Everflow. Basis: legitimate interests and contract with the partner.

4. Phone numbers

We collect a phone number at sign-up so we can verify accounts, recover access when email fails, and reach you about scheduled cohorts. We do not sell phone numbers and we do not send marketing SMS unless you opt in separately.

5. Who we share data with

We use carefully selected processors and share only what each one needs:

• Cloud hosting and database providers (platform operation)
• Payment provider (billing and fraud checks)
• Transactional and marketing email provider (access links, receipts, newsletters)
• Analytics provider (aggregated product usage, only with your consent)
• Everflow (affiliate click and conversion attribution)
• Professional advisers or authorities where the law requires it

We do not sell personal data, and we do not share it for third-party advertising profiling.

6. International transfers

Some providers operate outside the EEA or UK. Where that happens we rely on adequacy decisions or Standard Contractual Clauses together with additional technical safeguards such as encryption in transit and at rest.

7. How long we keep data

• Account and learning data: while your account is open, then up to 12 months after closure.
• Invoices and tax records: as long as accounting law requires, typically 6–10 years.
• Support correspondence: 24 months.
• Marketing consent records: until withdrawal, plus 24 months as proof of consent.
• Affiliate attribution logs: 24 months for payout disputes.

8. Your rights

You can request access, correction, deletion, restriction, portability, and object to processing based on legitimate interests. You can withdraw consent at any time. The GDPR page explains exactly how to exercise each right and how quickly we respond. You may also complain to your local data protection authority.

9. Security

Data is encrypted in transit and at rest. Access to production data is limited to staff who need it and is logged. Passwords are stored only as salted hashes, and email access links are single-use and short-lived.

10. Children

The platform is not intended for children under 16. If we learn that we hold data about a child without the required consent, we delete it.

11. Changes

We will post any update here and, for material changes, notify you by email. The date at the top of this page always reflects the current version.