Privacy Policy

1. Short summary

• We collect what is needed to run accounts, sell and deliver digital courses, pay instructors, answer support requests, and keep the platform secure.
• We do not sell personal information and we do not run behavioral advertising, ad pixels, or retargeting.
• Stripe handles payment card data. We never receive or store full card numbers, and we do not even store a Stripe Customer ID against your account.
• Lesson progress is kept mostly in your own browser, not as a server-side record of what you watched.
• Traffic analytics use Vercel Analytics and Speed Insights (part of our hosting). SmartKourse does not currently write first-party per-visit analytics records to PostgreSQL.

2. Scope of this policy

This policy covers the SmartKourse website, learner and creator accounts, and the SmartKourse API. It does not cover third-party sites you reach through course links, or the independent practices of instructors who use information you provide to them directly.

3. Who is responsible

SmartKourse is responsible for the personal information described here. The operating legal entity name and registered address are pending owner configuration and will be published before public launch; until then, privacy correspondence should go through the contact form on this website.

Privacy contact: Contact form on this website (email address pending owner configuration).

4. What we collect, in detail

The table below is generated from our internal data inventory, so it stays in sync with what the application actually stores.

5. Where the data comes from

Most information comes directly from you: registration, profile settings, creator onboarding, course authoring, checkout, contact forms, and reviews. The rest is generated automatically as you use the service (request metadata, hosting analytics via Vercel, audit entries) or received from Stripe through webhooks confirming payment, subscription, refund, dispute, and payout events. We do not buy personal information from data brokers or enrich profiles from external sources.

6. Why we process it

• Operate the service: authenticate you, show your courses, grant and enforce access entitlements, and run creator tooling.
• Payments and payouts: take payment through Stripe, reconcile ledger entries, calculate platform fees, and transfer instructor earnings.
• Transactional communication: email verification, password reset, purchase and subscription notices, refund decisions, and policy updates.
• Security and fraud prevention: detect abuse, investigate chargeback fraud, and keep staff audit records of administrative actions.
• Moderation: review reported content, enforce the Content and Acceptable Use policies, and handle copyright notices.
• First-party / hosting analytics: understand which pages are used, primarily via Vercel Analytics and Speed Insights that ship with hosting.
• Legal and tax compliance: keep records required for accounting, disputes, and responses to lawful requests.

7. Data kept in your browser, not on our servers

Some information stays on your device. This is a deliberate design choice and it has consequences worth understanding.

• HttpOnly session cookies (access + refresh), Readable CSRF cookie for double-submit protection, Non-sensitive readable session-hint cookie (sk_session_hint=1), and Optional sessionStorage display snapshot (name/email for chrome only; not auth tokens) — HttpOnly access/refresh cookies until logout or expiry. Readable CSRF and session-hint cookies are cleared with the session. Optional display snapshot lives in sessionStorage for the tab only. Tokens are never stored in localStorage.
• Lesson progress markers, including your last viewed lesson and completed-lesson checkmarks, are held primarily in browser local storage. We do not build a server-side record of every lesson you watched.

Because of this, clearing your browser storage or switching devices can reset your visible progress. Your purchased access itself is stored server-side and is not affected.

Prefer a preference control instead of clearing everything? Use Cookie Settings below, or read the full inventory in the Cookie Policy.

8. Payment data and Stripe

Card details are entered into Stripe’s hosted checkout and are processed by Stripe. SmartKourse does not receive, store, or log full card numbers, CVCs, or bank credentials. What we keep is the transaction record: amounts, currency, status, and Stripe reference identifiers for checkout sessions, payment intents, charges, invoices, subscriptions, refunds, disputes, transfers, and payouts.

We do not persist a Stripe Customer ID on your account record. Instructors who take payouts complete Stripe Connect onboarding, and the identity and tax information that process requires is collected and held by Stripe, not by us; we store the resulting Connect account identifier and payout status. On the SmartKourse creator profile we collect country only (not a street address) so we can prompt instructors about Stripe payout support for their region.

9. Service providers we actually use

These providers act on our instructions to deliver the service. Embedded YouTube players are the one component that can set third-party storage in your browser when you interact with a video; we use privacy-enhanced embeds where available, but playback is still governed by Google’s policies.

10. What we do not use

To be explicit, the following are not present in the product today, and we will update this policy before adding any of them:

• Google OAuth (env placeholders only; not implemented in auth flows)
• Sentry or other APM
• Marketing email platforms
• Advertising / retargeting pixels
• Affiliate tracking networks

11. When we disclose information

• To service providers listed in section 9, for the purposes described there.
• To instructors, in limited form. Instructors can see that a learner enrolled and can see reviews, ratings, and comments left on their courses along with the associated public profile. They do not receive your payment details.
• To other users, whatever you choose to make public: display name, avatar, bio, creator profile, reviews, and comments.
• For legal reasons, when we reasonably believe disclosure is required by law, valid legal process, or is necessary to investigate fraud, protect rights and safety, or enforce our terms.
• In a business transfer, such as a merger, acquisition, or asset sale, subject to this policy continuing to apply to the transferred data.

12. No sale, no targeted advertising

We do not sell personal information for money or other valuable consideration, and we do not share it for cross-context behavioral advertising. We do not knowingly collect or use sensitive personal information for inferring characteristics. There are no ad networks, retargeting pixels, or affiliate tracking scripts in the product.

13. How long we keep things

Retention is set per data type in section 4. In general: account and profile data persist while your account exists and are soft-deleted on account deletion; unverified accounts may be hard-deleted after roughly thirty days; payment, tax, and dispute records are kept as long as accounting and legal obligations require, which typically outlasts the account itself; and security and audit logs are kept for review of staff actions and incidents.

Two candid notes. First, production traffic measurement relies on Vercel Analytics / Speed Insights; SmartKourse does not currently write first-party per-visit analytics records to PostgreSQL. Second, admin audit logs store staff IP addresses in plaintext, while the contact form stores a hashed IP and a truncated user-agent string instead.

14. Security

We hash passwords, use TLS in transit, restrict administrative functions to staff accounts, keep an audit trail of administrative actions, and rely on managed providers for hosting and database infrastructure.

No online service can guarantee absolute security, and we do not claim to. Please use a unique password and tell us at Contact form on this website (email address pending owner configuration) if you suspect your account has been accessed by someone else.

15. Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, or obtain a portable copy of your personal information, and to be free from discrimination for exercising those rights. Regardless of where you live, we offer all users the following:

• View and edit your profile, display name, avatar, bio, and preferences.
• Request a copy of the personal information we hold about you.
• Request account deletion. Note that deleting an account ends access to purchased courses, and records we must keep for tax, dispute, and legal reasons will remain.
• Clear browser-side data yourself, including session cookies (HttpOnly access and refresh, readable CSRF and session hint), optional sessionStorage display snapshot, and lesson progress markers in localStorage.
• Ask us to correct inaccurate information, or to remove a review or comment you posted.

We do not use your data for automated decision-making that produces legal or similarly significant effects. Creator risk levels and manual-review requirements are set by staff, not by an automated scoring pipeline.

16. How to make a request

Send your request to Contact form on this website (email address pending owner configuration), or use the contact form and select the privacy topic. Tell us what you want and use the email address associated with your account so we can match the request to it. We may ask for additional verification before acting on a request involving access or deletion, and we may decline requests we cannot verify or that would compromise another person’s privacy or our legal obligations.

You may use an authorized agent where the law permits; we will ask for proof of authorization. We aim to acknowledge requests promptly and respond within the timeframe the applicable law requires. If we decline a request, we will explain why.

17. California residents

SmartKourse is based in California, and California residents use the service. Our current assessment is that SmartKourse does not meet the business thresholds that trigger the California Consumer Privacy Act as amended by the CPRA, so we do not represent that the CCPA applies to us today. That determination is documented internally and is revisited as the business grows.

Independent of that threshold question, we voluntarily extend the substance of those rights — access, deletion, correction, portability, and non-discrimination — to every user, and we do not sell or share personal information for cross-context behavioral advertising. The California Privacy Notice explains the distinction between what we do as a baseline practice and what would change if the statute became applicable.

18. Children and teens

Accounts require a minimum age of 13. Users under 18 should have a parent or guardian involved in account creation and any purchase. We do not knowingly collect personal information from children below the minimum age. If you are a parent or guardian and believe your child has provided information to us, contact Contact form on this website (email address pending owner configuration) and we will delete it.

19. International users and transfers

The service is operated from the United States, and our hosting, database, email, payment, and video providers may process data in the United States and other countries. If you use SmartKourse from outside the United States, you understand that your information will be transferred to and processed in the United States, where data-protection law differs from your own. Appropriate transfer mechanisms and processor agreements are part of the pending counsel review.

20. Incident notification

We maintain an internal data-breach response plan. If a security incident affects your personal information in a way that requires notification, we will notify affected users and regulators as applicable law requires, describing what happened and what steps to take.

21. Changes to this policy

We will update this policy when our practices change — including before we add any provider currently listed in section 10. Material changes will be announced by email or in-app notice, and the “Last updated” date at the top will change.

22. Contact

Privacy questions and requests: Contact form on this website (email address pending owner configuration). General support: Contact form on this website (email address pending owner configuration). You may also use the contact form.