Privacy Notice

1. Scope and controller

Erudoza’s legal operator controls the personal information described here when you use erudoza.com or the Erudoza service. Privacy questions and requests may be sent to legal@erudoza.com. This notice does not cover third-party sites or services you visit independently. The operator’s formal legal identity and business address will be disclosed before paid subscriptions launch. If the law where you live requires those details before account use, do not create an account until they are posted.

2. Information we collect

• Account information: Google account identifier, verified email address, display name, and profile image.
• Launch-update information: the email address and consent record you submit when joining a plan waitlist or requesting product updates.
• Learning information: course enrollments and creations, lesson progress, quiz results, confidence ratings, review dates, bookmarks, notes, goals, preferences, and badges.
• AI feature content: course requests, tutor messages, lesson context, generated responses, token usage, request identifiers, and safety-review results. Blocked-content records contain categories and a one-way fingerprint rather than the blocked text.
• Product and traffic information: aggregate page views and product events such as starting a course, beginning or completing a lesson, completing practice, or demonstrating a criterion. Events may include randomly generated first-party actor and session identifiers, a pseudonymous referral code, broad route, campaign labels, acquisition channel, referring hostname, and content or experiment version. Erudoza does not store the full referring page address or private learning text in product analytics.
• Technical information: browser and device information, IP address and security or hosting logs collected by our infrastructure providers, approximate region, error data, and consent records.
• Payment information: when paid plans launch, our payment processor will handle card details; Erudoza expects to receive billing contact, customer and subscription identifiers, transaction status, and limited payment metadata rather than complete card numbers.

3. How we use information

We use information to authenticate users; provide, synchronize, personalize, and improve learning features; evaluate product demand and learning outcomes; send updates people explicitly request; attribute broad acquisition channels; generate requested AI content; calculate progress and limits; prevent fraud and abuse; secure and troubleshoot the service; communicate material account or subscription information; comply with law; and enforce our agreements. Owner activity is excluded from first-party product measurement where the signed-in owner account is known. We do not sell personal information or use third-party behavioral advertising. We do not use your Google profile to expose the owner’s private sign-in identity.

4. Legal bases

Where the GDPR or similar law applies, we process information to perform our contract with you, pursue legitimate interests in operating and securing the service, comply with legal obligations, and, where required, based on consent. You may withdraw consent where consent is the basis, without affecting earlier lawful processing.

5. Service providers and disclosures

Information may be processed by Google and Firebase for sign-in and cloud data services; OpenAI for requested AI features and safety controls; Sites, cloud, network, monitoring, and email providers for delivery and security; professional advisers and authorities where legally required; and Stripe or another disclosed processor when paid billing launches. Providers may only use information for contracted services, their documented independent purposes, or as law requires. We may transfer information in a merger, financing, reorganization, or sale subject to appropriate notice and safeguards.

6. AI data handling and transparency

Prompts, lesson context, and generated output sent through AI features are transmitted to OpenAI. Erudoza requests that Responses API application state not be stored, and OpenAI states that API data is not used to train its models by default unless the customer opts in. OpenAI may retain abuse-monitoring logs for up to 30 days by default, or longer where legally required. Erudoza identifies direct AI interactions and AI-assisted course or lesson material in the interface and machine-readable page markup. We also apply input limits, moderation, per-account quotas, and pseudonymous safety identifiers to reduce abuse and unnecessary disclosure. Do not enter secrets, highly sensitive personal information, or information you lack permission to use.

7. Cookies and local storage

Erudoza uses browser storage needed to remember your theme, support authentication and session continuity, avoid duplicate session counts, and keep a first-touch acquisition record. The acquisition record contains a broad channel, optional pseudonymous referral code, campaign labels, referring hostname, and landing path rather than a cross-site advertising identifier or full referring URL. Random first-party actor and session identifiers help calculate aggregate funnels. We do not currently use advertising cookies. If optional third-party analytics or marketing technologies are introduced, this notice and any required consent controls will be updated first.

8. Retention

Account and learning information is generally kept while your account is active. Waitlist contact information and consent records are kept while the requested updates remain relevant or until consent is withdrawn, subject to limited records reasonably needed to document consent. Product events are retained long enough to evaluate acquisition, activation, learning, and retention trends, then deleted or de-identified when no longer reasonably needed. When you delete an eligible account, Erudoza deletes the active account data under its control, subject to limited records that must be retained to comply with law, resolve disputes, document consent, or prevent abuse. AI usage and idempotency records are otherwise kept as needed to enforce limits and investigate failures. Billing records, after paid plans launch, may be retained for applicable tax, accounting, and consumer-protection periods. Hosting, authentication, and security providers may retain logs or backups under their policies.

9. Security

We use HTTPS, verified authentication tokens, server-side authorization, restricted database rules, bounded inputs, content moderation, quotas, and access-limited service credentials. No online system is perfectly secure. Protect your Google account, use a secure device, and report suspected misuse promptly.

10. Your choices and rights

You can browse published topics and course outlines without an account, change your theme, and control basic site preferences. A free account is required before lesson content or account-linked learning records are delivered. Signed-in users can export a copy of their account data or request account deletion in the Privacy Center. The owner account requires a verified manual transfer or service-shutdown process before deletion so published-course control is not orphaned. Depending on where you live, you may also request access, correction, deletion, portability, restriction, or objection; appeal a denied privacy request; or withdraw consent. You may have rights to know categories and recipients or to opt out of sale, sharing, targeted advertising, or certain profiling. Erudoza does not currently sell or share personal information for cross-context behavioral advertising. Send manual requests from the email associated with your account to legal@erudoza.com so we can verify them. You may use an authorized agent where law permits. We will not discriminate against you for exercising a privacy right.

11. International processing

Erudoza and its providers may process information in the United States and other countries that may have different data-protection laws. Where required, we rely on appropriate contractual or legal transfer safeguards.

12. Children

Erudoza is a general-audience service and accounts are not intended for children under 13. Registration requires confirmation that the person creating the account is at least 13 and, if the person is a minor where they live, that a parent or legal guardian has reviewed and agreed to the legal terms. We do not knowingly collect personal information from children under 13. If you believe a child under 13 provided personal information, contact legal@erudoza.com so we can investigate and delete it where required.

13. Changes and complaints

We will post updates here and change the effective date. Material changes may also be shown in the service or sent by email. You may contact us with a concern and, where applicable, complain to your local data-protection authority or state regulator.