Privacy Policy

1. The short version

• We collect what we need to build your courses, run your account and improve Eruditora.
• We use trusted service providers, including AI providers, to generate courses, narration, images and tutor answers. We send them only what each task needs.
• We do not sell your personal information, and we do not use it for third-party advertising.
• Telling us about learning needs is optional. If you do, we use it only to adapt your courses.
• You can access, correct, download or delete your information, and choose whether to receive marketing emails.

2. Information we collect

Information you give us

• Account details: your name, email address, password (stored in hashed form by our hosting platform), optional display name and profile photo.
• Course requests and preferences: learning goals, prior knowledge, target level, time available, learning style, preferred course format, and assessment choices such as quizzes, final exams and certificates.
• Learning needs (optional): if you choose to tell us about learning needs or preferences (for example, that you prefer plain text over busy visuals, or shorter lessons), we use this only to adapt your courses. Some of these choices could reveal information about your health. We treat them as sensitive, collect them only with your consent, and you can remove them at any time in your settings.
• AI tutor conversations: the questions you ask the AI tutor and its answers.
• Communications: messages you send through our contact form or by email, and your email preferences.
• Payment information: when you buy a subscription, payment card details are collected and processed directly by our payment provider. We receive only limited information such as your plan, billing period, the last four digits and expiry of your card, and your billing country.

Information created when you use the Service

• Learning activity: courses you enroll in, save or archive, lessons completed, quiz and exam answers and scores, certificates, streaks and estimated learning time.
• Technical information: IP address, browser and device type, operating system, pages visited, dates and times, and error logs. Our hosting platform collects some of this automatically to run and secure the Service.
• Cookies and similar technologies: see our Cookie Policy.

3. How we use your information

• To provide the Service: create your account, generate and deliver personalized courses, narration and images, run the AI tutor, track your progress, issue certificates and remember your settings.
• To check course requests: we automatically review course requests to make sure they are clear and appropriate under our Acceptable Use Policy, and to size the course to your plan. If a request is declined, we tell you why and how to fix it.
• To manage subscriptions: process payments, apply plan limits and send receipts.
• To communicate with you: send service emails (such as "your course is ready", password resets and important changes) and respond to your questions.
• Marketing, with your permission: send news, learning tips and offers only if you opt in. You can unsubscribe at any time.
• To improve Eruditora: understand how features are used, fix problems and improve course quality. Where we can, we use aggregated or de-identified data for this.
• To build our course library: a course generated for you may be added to our library or offered to other learners with similar goals. We never include your name, account details, learning needs or other personal information when we do this.
• To keep the Service safe and meet our legal obligations: prevent fraud and abuse, enforce our terms, and comply with law.

We do not use your personal information to make decisions that have legal or similarly significant effects on you based solely on automated processing. If you disagree with an automated decision, such as a declined course request, you can contact us and a person will review it.

4. Legal bases (EU and UK users)

If the GDPR applies to you, we rely on: performance of a contract (providing the Service you sign up for); legitimate interests (improving and securing the Service, preventing abuse, building our course library without personal information), balanced against your rights; consent (optional learning-needs information, marketing emails and non-essential cookies), which you can withdraw at any time; and legal obligation (for example, tax and accounting records).

5. How we share information

We share personal information only as described here:

• Service providers who process data on our behalf and under contract:
  • Hosting, database and application platform (Bubble, which runs on Amazon Web Services).
  • AI models for course generation, request review and the AI tutor (Anthropic). We send your course request, preferences and tutor messages, not your payment information. Under their commercial API terms, our AI providers do not use this data to train their models.
  • AI image generation (OpenAI) and narration (Google Cloud Text-to-Speech). We send lesson text and image descriptions, not your account details.
  • Image libraries (Wikimedia Commons and Pexels). We send search keywords only.
  • Email delivery, payment processing (such as Stripe) and, if we add them, analytics and customer support tools.
• Legal and safety reasons: if required by law or legal process, or to protect the rights, property or safety of Eruditora, our users or others.
• Business transfers: in connection with a merger, acquisition, financing or sale of assets, subject to this Policy.
• With your direction: for example, if you choose to share a certificate link.

We do not sell personal information or share it for cross-context behavioral advertising.

6. International transfers

Eruditora is based in Canada. Our service providers may store and process information in the United States and other countries whose privacy laws may differ from those where you live. When we transfer personal information, we use contractual and other safeguards to protect it, including Standard Contractual Clauses where required for transfers from the EU or UK. Information stored outside Canada may be accessible to courts and authorities of those countries.

7. How long we keep information

• Account and learning data: for as long as your account is active. After you ask us to delete your account, we delete or de-identify your personal information within 30 days, except as described below.
• Backups: deleted information may remain in secure backups for up to 90 days before it is overwritten.
• Billing records: kept as long as tax and accounting laws require (generally up to 7 years).
• Contact messages: kept for up to 2 years after the conversation ends.
• Courses in our library: courses that were added to the library do not contain your personal information and may be kept after your account is deleted.

8. Your rights and choices

Depending on where you live, you have the right to:

• access the personal information we hold about you and receive a copy, including in a portable format;
• correct inaccurate or incomplete information;
• delete your information or your account;
• withdraw consent, for example to learning-needs information or marketing emails;
• object to or restrict certain processing; and
• not be discriminated against for exercising your rights.

You can update much of your information yourself in your account settings. For anything else, email privacy@eruditora.com. We will respond within 30 days and may need to verify your identity first. If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec, or your local data protection authority.

Marketing emails: we only send them if you opt in, in line with Canada's Anti-Spam Legislation (CASL). Use the unsubscribe link in any marketing email or change your preference in your account settings. We will still send essential service emails.

9. Security

We use reasonable administrative, technical and physical safeguards to protect personal information, including encrypted connections (HTTPS), hashed passwords, access controls and privacy rules that limit who can see data. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach creates a real risk of significant harm to you, we will notify you and the relevant authorities as required by law.

10. Children

Eruditora is not intended for children under 16, and we do not knowingly collect their personal information. If you believe a child under 16 has given us personal information, please contact us and we will delete it.

11. Changes to this Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or in the Service before they take effect. The "Last updated" date at the top shows when it was last changed.

12. Contact us

Our Privacy Officer is responsible for how we protect personal information. Contact them at privacy@eruditora.com or through our contact form.

By mail: Privacy Officer, Dynovest Inc., 5510-386 Yonge Street, Toronto, ON M5B 0A5, Canada.