# Privacy Policy

**Effective Date:** November 14, 2026  
**Last Updated:** November 14, 2026  
**Controller:** Learn Basket ("we", "us", or "our")  
**Contact:** freelance.cro@gmail.com

Learn Basket is committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR) (EU) 2016/679 and other applicable data-protection laws. This Privacy Policy explains how we collect, use, share, and protect your personal data when you use our website and/or the Learn Basket tutoring-class management application (the "Service").

## 1. Who We Are (Data Controller)

Learn Basket is the data controller responsible for your personal data under this policy.

Contact: freelance.cro@gmail.com

## 2. Personal Data We Collect

We collect personal data that you provide directly, and technical data collected automatically:

### Data you provide
- Account data: name, email address, password hash, role (student, parent, tutor, organization admin).
- Organization data: organization name, plan, billing contact.
- User Content: lesson materials, homework submissions, class comments that you upload or create.
- Payment data: Stripe handles payment details; we do not store full credit-card numbers.

### Data collected automatically
- Technical data: IP address, browser type, device identifier, access logs, usage data.
- Cookies and similar technologies (see our Cookie Policy).

### Data about children
The Service is used by students who may be minors. We collect only the personal data necessary to provide the Service (name, email, submissions), and we do not use children's data for marketing. Parental access is read-only by design. Parents or guardians may request access to, correction of, or deletion of their child's data at any time.

## 3. How We Use Your Data

We process personal data for the following purposes, on the legal bases indicated:

| Purpose | Legal Basis |
|---------|-------------|
| Provide and operate the Service (classes, materials, submissions, comments) | Performance of a contract |
| Authenticate and manage accounts | Performance of a contract / legitimate interest |
| Role-based access control and organization isolation | Legitimate interest / legal obligation (security) |
| Billing and payments (via Stripe) | Performance of a contract |
| Support and communication | Legitimate interest |
| Security, fraud prevention, and abuse detection | Legitimate interest / legal obligation |
| Aggregated, anonymized analytics to improve the Service | Legitimate interest |

We do not sell your personal data. We do not use User Content to train artificial-intelligence models without your consent.

## 4. Sharing and Disclosure

We share personal data only as follows:

- **Organization members:** tutors, students, parents, and admins within the same organization can see each other's data according to their roles (e.g., parents have read-only access to their child's classes).
- **Service providers:** Clerk (authentication), Stripe (payments), Cloudflare R2 (file storage), Vercel (hosting). Each is a data processor bound by a data-processing agreement.
- **Legal requirements:** where required by law, regulation, legal process, or to protect safety.

Organization data is isolated between organizations. Only an internal platform administrator can cross organization boundaries, and only for support.

## 5. International Transfers

Your personal data may be processed in the European Economic Area (EEA) and in other countries where our service providers operate (e.g., the United States). Where data is transferred outside the EEA, we rely on appropriate safeguards such as the EU Commission's Standard Contractual Clauses or an adequacy decision.

## 6. Data Retention

We retain personal data:
- **Account data:** for as long as your account is active, then as required for tax, accounting, and legal compliance (typically up to 7 years).
- **User Content:** for as long as needed to provide the Service; deleted upon account deletion unless retention is required by law.
- **Logs and technical data:** up to 12 months.

You may request deletion of your data at any time (see Section 9).

## 7. Your Rights (Data Subjects)

Under the GDPR you have the right to:
- **Access** your personal data and receive a copy.
- **Rectify** inaccurate or incomplete data.
- **Erase** ("right to be forgotten") your personal data, subject to legal retention requirements.
- **Restrict** processing of your data.
- **Object** to processing based on legitimate interest or direct marketing.
- **Data portability** — receive your data in a structured, machine-readable format.
- **Withdraw consent** at any time where processing is based on consent.
- **Complain** to a supervisory authority (e.g., your national data-protection authority).

To exercise these rights, contact us at freelance.cro@gmail.com. We will respond within one month.

## 8. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:
- Encryption in transit (TLS) and at rest.
- Role-based access control enforced on the server for every request.
- Authentication via Clerk (with multi-factor authentication support).
- Regular security reviews.

No transmission over the internet is 100% secure; we cannot guarantee absolute security.

## 9. Contact and Requests

For questions about this Privacy Policy or to exercise your data-protection rights, contact us:

**Learn Basket**  
Email: freelance.cro@gmail.com

## 10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes and update the "Last Updated" date. Your continued use of the Service after changes become effective constitutes acceptance of the revised policy.

---

*This document is provided for informational purposes and does not constitute legal advice. Learn Basket is developed by AI and by its owner; the owner retains all rights to the Service and these documents.*