Privacy Policy

1. Who we are

LearnAI Studio is operated by Digital Creative Academy LLC, established in Switzerland. We are the controller for personal data processed to provide the Service. Our registered address is available on request. We process personal data under the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU GDPR, UK GDPR, and UK Data Protection Act 2018.

Contact: learning-support@digital-creative-academy.com

Where an employer or other organisation assigns learning and determines how learner information is used, that organisation may also act as a controller. Contact your organisation for questions about its own use of your learning records.

2. What data we collect

We collect the following personal data when you register and use the Service:

• Account data: your display name, username, and email address
• Authentication data: password hashes, registered passkey information, and information used to verify and secure your account
• Content data: source materials, microlearning content, settings, and messages or responses submitted to AI assistance and learning-feedback features
• Learning and collaboration data: assignments, pathway and section progress, completion status, scores, ratings, time spent, due dates, comments, reviews, group membership, invitations, and reminder history
• Usage and security data: projects created, content generated, features used, login and activity timestamps, and security or diagnostic logs
• Payment data: subscription and purchase references, billing status, and credit balances used to manage access; Stripe handles card details, which we do not store
• Technical data: IP address, browser and device information, request metadata, and essential cookie or browser-storage identifiers used to deliver and secure the Service

3. How we use your data

We use your personal data to:

• Provide and maintain your account and the Service
• Send transactional emails such as account verification and password reset codes
• Enable team workspaces, collaboration, reviews, public Library publication, assignments, reminders, learner progress, certificates, and administrator reports or exports
• Generate and improve content when you request AI features, and record whether content was AI-generated or AI-assisted
• Operate, troubleshoot, and improve the Service using usage and diagnostic information; records linked to an account or device remain personal data even when reports show aggregate statistics

We do not sell your personal data to third parties and do not use it for advertising purposes.

4. Legal basis for processing

Where GDPR or UK GDPR applies, we rely on:

• Contract: processing necessary to provide the Service you signed up for (account management, content delivery, billing)
• Legitimate interests: service security, fraud prevention, support, debugging, product improvement, collaboration, and proportionate learning administration, balanced against your rights
• Legal obligation: where we are required to retain records for tax, legal, or regulatory purposes
• Consent: where we specifically request it for an optional activity and consent is the appropriate legal basis; you may withdraw it prospectively

We do not use learner scores or AI features to make solely automated decisions producing legal or similarly significant effects. Automated moderation may flag content for review or restrict publication; contact us if you believe a decision is incorrect.

Accepting the Terms or creating an account is not blanket consent to every use of personal data. Avoid submitting unnecessary sensitive information or other people's personal or confidential material. Where health or other special-category data is processed and GDPR Article 9 applies, an additional permitted condition is required; contractual necessity alone is insufficient. An organisation's responsibilities for its learners do not remove our own obligations.

5. Data security

Safeguards include account authentication, password hashing, access controls, and encryption of selected account information. This does not mean that every content item, export, or browser copy is individually encrypted. Our application and providers must process relevant content to deliver the Service; this is not end-to-end encryption that prevents them from accessing it.

No system can guarantee absolute security. Applicable law governs our security and breach-notification responsibilities. Protect your credentials and review sharing permissions before publishing or inviting others.

6. Service providers and external content

Relevant information is processed by these providers to deliver the features you use:

• OpenAI — for content generation, AI tutor conversations, moderation, learning feedback, translations, and podcast audio. Relevant messages, prompts, source material, course context, and generated output are processed. Submitted material may itself contain personal data. Retention and model-training terms depend on the API and contractual arrangements; this notice does not promise zero provider retention. See OpenAI's Privacy Policy
• Perplexity — for research and video discovery. Topic, objective, or search queries may be processed; do not include personal or confidential data unless authorised. See Perplexity's Privacy Policy
• Pexels — for stock image sourcing. Image search terms are sent to retrieve suitable media
• Stripe — for subscriptions, one-time purchases, and payment processing. Stripe handles card details; we retain references and status information needed to manage purchases and access. See Stripe's Privacy Policy
• Google Workspace — for transactional email, including verification, password reset, invitations, billing notices, and learning reminders
• Render — for application hosting and managed database infrastructure
• Cloudflare — for DNS, CDN, DDoS protection, traffic delivery, and R2 object storage used for generated audio and related files

Pages and lessons may also load external images, fonts, or embedded content, including Google Fonts, YouTube, and Vimeo. Loading or interacting with these resources can disclose your IP address and browser information to the external provider, which may use its own storage or tracking under its policies. Linked resources and exported courses may operate outside LearnAI Studio.

Where a provider acts as our processor, applicable law requires appropriate processing terms and safeguards. Some providers also act independently for their own legal, security, payment, or media-service purposes. Their policies do not replace our own responsibilities.

7. International data transfers

Personal data may be processed in Switzerland, the United Kingdom, the European Economic Area, the United States, or other provider locations. Where required, a transfer must be covered by an adequacy decision or appropriate safeguards, such as Standard Contractual Clauses with relevant Swiss or UK adaptations and any necessary supplementary measures. Contact us for the countries and safeguards applicable to your data and how to obtain a copy where applicable.

8. Team, administrator, and public visibility

If you join a Team workspace or receive assigned learning, authorised owners, administrators, assigners, and relevant content owners may see your name, username, email, group membership, assignments, due dates, progress, completion, scores, ratings, time spent, comments, and recent activity. They may export relevant learning records to CSV and send reminders. Access is limited by workspace role and content relationship.

If a creator publishes a lesson to the public Library, its title, description, category, tags, cover image, language versions, content preview, and AI provenance may be visible to Library users. Learner enrolment and progress are not public. Creators can remove their lesson from the Library or revoke its public link.

Public links, permitted embeds, downloads, and exports can make content available outside the workspace. Revoking a link or removing a Library item does not recall copies already downloaded or exported. Organisations and recipients are responsible for their own use and retention of those copies.

9. Data retention

Retention depends on the purposes above, legal obligations, disputes, security, and service operation. Scheduled maintenance uses the following default periods and limits. Eligibility does not guarantee removal on an exact day: completion depends on the configured schedule and successful processing.

• Unverified accounts: eligible for cleanup after 48 hours if email verification is not completed
• Verification and reset codes: removed after expiry; verification codes last 30 minutes and reset codes 10 minutes
• Sessions: authentication tokens expire after 30 days and can be revoked earlier
• Learning event analytics: detailed event records become eligible for cleanup after 90 days; current assignment, progress, completion, score, rating, and certificate records remain while the account, assignment, or workspace requires them
• Draft projects: stale drafts become eligible for archiving after 90 days. Archived projects remain in your account but are no longer listed in your active workspace.
• Deleted content (trash): content moved to trash becomes eligible for permanent cleanup after 30 days; do not rely on recovery after that period.
• SCORM exports: scheduled cleanup aims to keep the latest 3 export files per project and remove older exports.
• Inactive free accounts: accounts without paid access or recent activity for approximately 14 months may be scheduled for deletion after at least 30 days' email warning
• Invitations, comments, and reviews: retained while needed for the relevant workspace, content, or account, then deleted or anonymised when no longer required
• Billing records: retained for the period required by tax, accounting, fraud-prevention, and other applicable laws

You may request deletion without waiting for inactivity cleanup. Personal resources are removed through account deletion unless legal retention or shared-workspace responsibilities require otherwise; shared or Team resources may remain or transfer to an authorised owner. Deletion of active records does not establish immediate erasure of every backup, provider record, recipient export, or browser copy. Contact us for the scope, timing, and any retention exception applicable to your request.

10. Your rights

Depending on the law that applies, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data ("right to be forgotten")
• Object to or restrict processing in certain circumstances
• Data portability (receive your data in a machine-readable format)
• Withdraw consent where processing relies on consent
• Complain to a competent data-protection authority

To exercise any of these rights, contact us at learning-support@digital-creative-academy.com.

We may request proportionate identity verification; do not send passwords, card details, or unnecessary learning content. Where EU or UK GDPR applies, requests are normally addressed without undue delay and within one month. A permitted extension of up to two further months requires notice and reasons within the first month. Requests are normally free, subject to lawful exceptions. Other applicable statutory deadlines remain unaffected.

You may complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC). If EU GDPR or UK GDPR applies, you may also complain to the supervisory authority in your country, including the UK Information Commissioner's Office (ICO) where relevant.

11. Cookies and browser storage

We use an authentication cookie and browser storage for interface preferences, notification state, and in-progress work. Blocking or clearing storage may sign you out or remove local content. Account deletion does not automatically clear every device, and clearing browser data does not delete server records. We do not use advertising cookies or third-party behavioural analytics cookies for our own analytics; external content providers may use their own technologies as described above.

12. Children

The Service is intended for users aged 16 or over, consistent with our Terms. Organisations assigning learning must respect this age requirement and establish an appropriate legal basis and any required authorisation for processing learner data. Organisational access is not an exemption from these requirements.

13. Changes to this policy

We may update this Privacy Policy for legal, security, operational, or product reasons. We will notify registered users of material changes where required and publish the updated date here. Continued use is not consent to new processing that requires consent.

14. Contact us

Digital Creative Academy LLC, Switzerland. Registered address available on request. For privacy enquiries or rights requests, contact learning-support@digital-creative-academy.com.