Privacy Policy

Effective date: May 12, 2026  |  Last updated: Jul 31, 2026

This Privacy Policy explains how LearnCoachAssist ("we", "us", "our"), the operator of learncoachassist.com (the "Service"), collects, uses, discloses, and protects information about you when you use the Service. It is written to meet the disclosure requirements of the EU General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA), Brazil's LGPD, and other major data protection laws. If any provision of local law gives you greater rights than this policy, that local law controls.

1. Who is the data controller?

The data controller (or "business" under CCPA) is the operator of LearnCoachAssist. You can reach our privacy team at privacy@learncoachassist.com. If you are located in the European Economic Area or the UK and require a representative, please contact us at the same address and we will provide one as required by applicable law.

2. Information we collect

2.1 Information you provide

• Account data — name (optional), email address, and a hashed password if you register.
• Communications — messages you send us through the contact form, support emails, or deck requests.
• Newsletter — your email address if you subscribe.
• Billing — if you purchase a paid plan, our payment processor (e.g., Stripe) collects payment information. We never see or store full card numbers; we receive only a token and the last four digits.

2.2 Information collected automatically

• Usage data — pages visited, study sessions, flashcards reviewed, performance metrics, referrers, and product events used to improve the Service. We collect none of this unless you accept analytics cookies. If you decline, or have not answered the banner, the site works exactly the same and we record nothing.
• Device data — browser type, operating system, screen size and language preference. Our analytics records do not store your IP address. Your login session record does store it, for security.
• A visitor identifier — if, and only if, you accept analytics cookies, we derive an identifier from your IP address, browser and language so that A/B tests stay consistent for you. Decline and we use a random value instead, which identifies nothing and lasts only for that visit.
• Cookies and similar technologies — see Section 6.

2.3 Where you came from (first-touch source)

If you accept analytics cookies and then create an account, we store on that account the marketing source of the visit you arrived on — for example that you came from a link we posted on Facebook, or from a search result. We call this your first-touch source. We keep it to understand which channels bring us people who find the Service useful; it is not shared, and it is not used to target you.

It is recorded once and never changed by later visits. If you withdraw consent for analytics, we delete it. If you never consented, we record only that fact, not a source.

2.4 Information from third parties

If you sign in via a social provider or if a payment processor verifies your purchase, we may receive limited account-verification data from them.

3. How we use information

We use information for the purposes below, and only as long as needed for each purpose:

• Provide the Service — authenticate you, store your study progress, deliver flashcard decks (legal basis: contract).
• Secure the Service — diagnose bugs, prevent fraud, monitor abuse (legal basis: legitimate interests; you may object — see Section 8).
• Understand how the Service is used — first-party analytics, including which marketing source brought you (legal basis: consent). We ask before collecting any of it, we do not fall back to legitimate interests if you decline, and withdrawing is as easy as giving it.
• Communicate with you — service notices, password resets, replies to support requests (legal basis: contract or legitimate interests). Marketing emails are sent only with your consent and you can unsubscribe at any time.
• Personalize content — recommend decks, remember preferences, surface helpful study suggestions (legal basis: legitimate interests or consent where required).
• Show advertising — see Section 5 for our use of Google AdSense.
• Comply with legal obligations — recordkeeping, responding to lawful requests (legal basis: legal obligation).

4. Legal bases under GDPR

If you are in the EEA or UK, we rely on these legal bases: performance of a contract (to provide accounts and paid features), legitimate interests (to run a secure, performant, and useful Service), consent (for non-essential cookies, marketing emails, and personalized advertising), and legal obligation (to meet tax, accounting, and law-enforcement requirements). Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of past processing.

5. Advertising — Google AdSense

LearnCoachAssist uses Google AdSense to display advertisements that help keep the free tier free. Google is an independent controller of the data it processes through AdSense. As an AdSense publisher, we disclose the following:

• Third-party vendors, including Google, use cookies and similar technologies to serve ads based on a user's prior visits to this and other websites.
• Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to our site and/or other sites on the Internet.
• You can opt out of personalized advertising by visiting Google Ads Settings.
• You can also opt out of a third-party vendor's use of cookies for personalized advertising by visiting aboutads.info or youronlinechoices.eu (for European users).
• For users in the EEA, the UK, and Switzerland, we use Google's Consent Mode and request your consent through our cookie banner before serving personalized ads. If you decline, only non-personalized advertising is shown.
• We do not knowingly enable advertising directed to children under 16 and follow Google's policies for child-directed sites and content.

For more information about how Google handles data, see How Google uses information from sites or apps that use our services.

6. Cookies and similar technologies

We use a small number of cookies and similar technologies:

• Strictly necessary — session/auth cookies and CSRF tokens. Always on; required for the site to function.
• Preferences — remember locale, dark mode, and your study settings.
• Analytics — pseudonymous aggregated usage data to understand product use.
• Advertising — Google AdSense cookies for ad serving and (with consent) personalized ads.

You can change your cookie choices at any time via our cookie policy. Most browsers also let you control or delete cookies through their settings.

7. Sharing information

We do not sell your personal information for money. We share information only:

• With service providers acting as processors on our behalf — hosting (e.g., Hetzner), email delivery, error monitoring, payment processing (Stripe), and analytics. Each is bound by a written data-processing agreement.
• With advertising partners — primarily Google AdSense — which act as independent controllers for the data they collect through ads.
• To comply with legal obligations, lawful requests, or to defend our rights and the safety of users.
• In a business transfer (merger, acquisition), in which case we will notify you and any new owner must respect the commitments in this policy.

Under CCPA, the limited sharing for advertising described above may be considered a "sale" or "share" of personal information. California residents can opt out using the link "Do Not Sell or Share My Personal Information" on this page (or by emailing us).

8. Your rights

Depending on where you live, you may have the following rights:

• Access — request a copy of your personal data.
• Rectification — correct inaccurate or incomplete data.
• Erasure ("right to be forgotten") — ask us to delete your account and data, subject to legal exceptions.
• Restriction & objection — limit or object to certain processing, including profiling for marketing.
• Portability — receive your data in a machine-readable format.
• Withdraw consent — at any time, for processing based on consent.
• Opt out of sale/sharing (CCPA/CPRA) and personalized advertising.
• Non-discrimination — we won't deny you service for exercising your rights.
• Complain to your local data protection authority (e.g., your EU member-state DPA, the UK ICO, or the California Privacy Protection Agency).

To exercise any right, email privacy@learncoachassist.com from the address on your account or use the in-app account deletion at Settings → Delete account. Both routes do exactly the same thing. We respond within 30 days (45 days for complex CCPA requests).

8.1 What deletion actually does

Because people reasonably read "delete" in different ways, here is precisely what happens:

• Destroyed — your name, email address, password, username, bio, avatar, first-touch source, study progress, decks, streaks, points, milestones, quiz history, push subscriptions, contact messages, newsletter subscription, and your login sessions (so you are signed out everywhere).
• Kept, with the link to you removed — analytics records of what happened on the site. Once they are no longer connected to you they describe the site, not a person, and they are deleted in full at the end of the retention period below.
• Kept, still attached to your account record — payments and refunds. Tax law requires us to keep these, and the UK/EU right to erasure explicitly does not override a legal obligation. To keep them valid, your account row survives as an anonymised shell: it holds nothing that identifies you, cannot be logged into, and has no access to anything.

9. International transfers

Our servers are operated in the European Union (Finland). Some of our processors and Google's advertising infrastructure may transfer data outside the EEA, the UK, or your country of residence. Where data is transferred from the EEA or UK, we rely on the European Commission's Standard Contractual Clauses or other lawful mechanisms.

10. Data retention

We keep your data only as long as needed:

• Account data — while your account is active. On deletion it is destroyed immediately, as described in Section 8.1.
• Analytics — 26 months, after which records are deleted automatically by a scheduled job. This is enforced in code, not by hand.
• Records of a transaction (a subscription starting, lapsing, or a payment failing) — kept with your billing records rather than under the analytics period above, because they evidence a transaction rather than describe your behaviour.
• Billing records — for the period required by applicable tax law (typically 7–10 years).

This policy describes the Service as it currently behaves. It is written by the people who built it and has not been reviewed by a lawyer; if you rely on it for a legal purpose, tell us and we will get it reviewed.

11. Security

We protect personal data with industry-standard safeguards: TLS in transit, encryption at rest for sensitive fields, hashed passwords (bcrypt), least-privilege access, regular updates, and continuous monitoring. No method of transmission or storage is 100% secure; we cannot guarantee absolute security.

12. Children

The Service is intended for users aged 16 and older. We do not knowingly collect personal information from children under 16 (or under 13 in the United States — COPPA). If you believe we have collected information from a child, contact us and we will delete it promptly.

13. Asia-Pacific notices

If you are located in Japan (APPI), South Korea (PIPA), India (DPDP Act), Australia (Privacy Act), Singapore (PDPA), Hong Kong (PDPO), or another APAC jurisdiction, we comply with the local equivalents of the principles described above. You may submit data subject requests to the contact in Section 1 in English or your local language; we will reply in English. Sensitive data, where applicable under PIPA, APPI, or DPDP, is processed only with explicit consent.

14. Brazil (LGPD)

If you are in Brazil, you may exercise the rights guaranteed by Lei Geral de Proteção de Dados (LGPD): access, correction, anonymization, blocking, deletion, portability, and information about sharing. Contact our data protection officer at privacy@learncoachassist.com.

15. Changes to this policy

We may update this policy from time to time. When we do, we will revise the "Last updated" date and, for material changes, notify you by email or in-app banner before the change takes effect.

16. Contact

Questions, requests, or complaints? Email privacy@learncoachassist.com.

This policy is provided in good faith for transparency and AdSense / GDPR / CCPA / LGPD / APAC compliance. It is not legal advice; consult a qualified attorney for advice tailored to your jurisdiction.