California Privacy Notice
Written for California residents. It is careful to separate what we actually do for everyone from what a statute would require if it applied to us — because at present, it does not.
Effective date: July 25, 2026Last updated: July 25, 2026
Published by SmartKourse
1. Does the CCPA apply to SmartKourse?
Our current assessment is no. The California Consumer Privacy Act as amended by the CPRA applies to businesses that meet specific thresholds — annual gross revenue above the statutory amount, buying, selling, or sharing the personal information of a large number of consumers, or deriving the majority of revenue from selling or sharing personal information. On our present assessment, SmartKourse does not meet any of them: we are small, and we neither sell nor share personal information for cross-context behavioral advertising at all.
So we do not claim that the CCPA applies to us, and we do not want to imply otherwise by publishing a notice that reads as if it does. That determination is documented internally and is reassessed as the business grows. If we cross a threshold, this page changes and the obligations in section 11 become binding rather than aspirational.
2. Why this page exists anyway
Two reasons. First, SmartKourse operates from California and many of our users are California residents, so you deserve a clear statement of how your information is handled in the vocabulary California law uses. Second, most of what the statute would require, we already do voluntarily — and we would rather commit to it in public than treat privacy as something that only starts at a revenue threshold.
3. Baseline practice vs. statutory obligations
Read this page with the distinction in mind:
- Baseline practice means something we do today for every user regardless of residence, as a matter of policy. You can rely on us to do it, and you can hold us to it under our Privacy Policy. It is a commitment, not a statutory entitlement, and the statutory enforcement mechanisms and deadlines do not attach to it.
- Statutory obligation means something that would legally bind us if the CCPA applied — with defined response deadlines, appeal rights, and regulator enforcement. Those are described in section 11 as what would apply, not as what currently does.
4. Categories of information we collect
Using the statutory category names, here is what we do and do not collect. Full detail, covering 11 server-side data groupings, is in the Privacy Policy inventory.
- Identifiers — collected. Email address, display name, account and creator identifiers, and — for staff audit logs — IP address.
- Customer records information — collected. Purchase and subscription records and payment-related identifiers. Card numbers are handled by Stripe and are not stored by us.
- Commercial information — collected. Courses purchased, plans, discount code usage, refund and dispute history.
- Internet or network activity — collected. Request metadata used to serve the site (IP, user agent) via our hosting provider, and Vercel Analytics / Speed Insights as part of hosting. SmartKourse does not currently write first-party per-visit analytics records to PostgreSQL.
- Geolocation data — not collected. We do not collect precise geolocation. Approximate location may be inferable from request metadata by our hosting provider.
- Audio, electronic, visual information — collected. Avatar images and course media that instructors upload, and images learners choose to upload.
- Professional or employment information — collected. Only what instructors voluntarily publish in a creator profile, such as a headline or bio.
- Education information — not collected. We are not an educational agency and do not hold student records covered by FERPA. Lesson progress is kept mostly in your own browser.
- Inferences / profiles — not collected. We do not build behavioral profiles or infer characteristics about you.
- Biometric information — not collected. Never collected. Identity verification for instructor payouts is performed by Stripe, not by us.
5. Sources and purposes
We collect information directly from you when you register, build a profile, author a course, buy access, contact support, or leave a review; automatically as you use the service; and from Stripe through payment webhooks. We use it to operate the service, process payments and instructor payouts, send transactional email, prevent fraud, moderate content, measure hosting traffic via Vercel Analytics, and meet legal and tax obligations. We do not buy personal information from data brokers.
6. Categories disclosed to service providers
In the last twelve months we disclosed personal information for business purposes to the following service providers, each acting on our instructions:
- Stripe, Inc. — Payment processing, Stripe Checkout, Stripe Connect payouts.
- Vercel Inc. — Application hosting, edge delivery, Vercel Blob object storage, and Vercel Analytics / Speed Insights.
- Prisma Postgres (or configured PostgreSQL host) — Primary application database.
- Hostinger SMTP and/or Resend (configured SMTP provider) — Transactional email delivery.
- YouTube (Google) — Embedded lesson video playback (privacy-enhanced embeds where used).
Instructors also receive limited information about learners who enroll in their courses, and public profile content is visible to other users by design.
8. Sensitive personal information
We do not collect sensitive personal information for the purpose of inferring characteristics, and we do not use or disclose it beyond the purposes the statute permits without a right to limit. Account credentials are the one item in a sensitive-adjacent category, and they are used solely to authenticate you. Payment card data and instructor identity verification documents are handled by Stripe, not by us.
9. Retention
We keep each category only as long as needed for the purpose it was collected for, or as legal, tax, and dispute obligations require. Per-category retention is listed in the Privacy Policy. We disclose there, candidly, that SmartKourse does not currently write first-party per-visit analytics records to PostgreSQL, and that admin audit records do not yet have an automated purge job and are managed operationally.
10. Rights we honor for everyone today
Regardless of whether any statute compels it, and regardless of where you live, we offer:
- Know and access. Ask what personal information we hold about you and get a copy.
- Correct. Ask us to fix inaccurate information, or edit most of it yourself in account settings.
- Delete. Ask us to delete your account and associated personal information, subject to records we must retain for tax, accounting, dispute, and legal reasons.
- Portability. Receive your data in a readable format.
- Non-discrimination. We will not degrade your service or charge you more for exercising any of these.
- Self-service deletion of browser data. Lesson progress markers and optional display preferences live in your browser and you can clear them yourself at any time. Auth tokens are HttpOnly cookies (not localStorage) and clear when you sign out or clear site data.
11. Rights that would apply if the CCPA covered us
If SmartKourse became a covered business, the following would apply as legal obligations with statutory deadlines and enforcement:
- Right to know categories and specific pieces of personal information collected.
- Right to know categories of sources, purposes, and third-party recipients.
- Right to delete, subject to the statutory exceptions.
- Right to correct inaccurate personal information.
- Right to opt out of sale or sharing — which would remain inapplicable in substance, since we do neither.
- Right to limit use of sensitive personal information.
- Right to non-discrimination and to designate an authorized agent.
- A 45-day response deadline, extendable to 90 days with notice, and a duty to recognize opt-out preference signals.
The practical difference today is procedural rather than substantive: the entitlements above closely match what section 10 already gives you, but without the statutory clock and enforcement mechanism.
12. How to exercise your rights
Email Contact form on this website (email address pending owner configuration) or use the contact form and choose the privacy topic. Tell us what you want, and write from the email address on your account so we can match the request. We aim to acknowledge promptly and to resolve requests within 45 days, mirroring the statutory timeline even though it does not currently bind us. If we need longer or must decline part of a request, we will explain why.
13. Verification and authorized agents
To protect you, we verify requests before disclosing or deleting information — usually by confirming control of the account email, and for sensitive requests by asking for additional detail only the account holder would know. We do not ask for your password, and we will never ask for a full payment card number.
An authorized agent may submit a request on your behalf with written authorization, and we may still ask you to confirm directly.
14. Global Privacy Control and opt-out signals
Browser opt-out preference signals such as Global Privacy Control communicate a request not to sell or share personal information. Since SmartKourse does not sell or share personal information for advertising, such a signal has nothing to act on here — there is no data flow for it to stop. If we ever introduce a practice that constitutes a sale or share, we will implement honoring these signals as part of that change, and say so on this page.
15. Minors
The minimum account age is 13. We do not knowingly sell or share the personal information of consumers under 16 — an easy commitment, since we do not sell or share anyone’s. Parents and guardians may contact Contact form on this website (email address pending owner configuration) about a minor’s account.
16. California “Shine the Light”
California Civil Code § 1798.83 lets residents request information about disclosure of personal information to third parties for their own direct marketing purposes. SmartKourse does not disclose personal information to third parties for their direct marketing purposes, so there is nothing to report — but you may still ask, at Contact form on this website (email address pending owner configuration), and we will confirm in writing.
17. Non-discrimination
We do not deny service, charge different prices, provide a different quality of service, or retaliate because you exercised a privacy right. We do not run financial-incentive programs in exchange for personal information.
18. Reassessment and changes
We revisit CCPA applicability as the business grows, and we will update this page when the assessment changes, when our practices change, or at least annually. If we ever begin selling or sharing personal information, we will say so prominently, add the required opt-out mechanism, and honor opt-out preference signals before the practice starts. Like every policy here, this notice is pending review by qualified counsel.
19. Contact
Privacy requests and questions: Contact form on this website (email address pending owner configuration), or the contact form. See also the Privacy Policy and Cookie Policy.