1. Overview
This Privacy Policy explains how Edusodes (“Edusodes”, “we” or “us”) collects, uses, shares and protects personal information when you use the Edusodes website and application (the “Service”), and the choices and rights you have.
Edusodes is the controller of the personal information described in this policy. Where Edusodes provides the Service to an organization under a Teams plan, that organization may be the controller of its members’ data and Edusodes acts as its processor under our Data Processing Agreement.
2. Information we collect
Information you provide
- Account details: your name, email address and password. Passwords are stored only as a salted bcrypt hash; we never store or see your password in plain text.
- Learning requests: the topics, goals, levels and format choices you enter when creating a series.
- Communications: the content of emails you send us, for example support or privacy requests.
Information created when you use the Service
- Learning activity: the series in your library, episodes completed and when, quiz answers and scores, recall checks and season assessments and their results, streaks and release-schedule settings.
- Produced content: the season outlines and episodes produced for your custom series.
- Technical data: IP address, browser type, device information and request logs recorded by our servers and hosting providers for security and reliability.
Information from third parties
- Payment information: if you subscribe, our payment processor Stripe collects your payment details directly. We receive a customer identifier, subscription status and limited billing information, such as the card brand, the last four digits and the country. We do not receive or store full card numbers.
We do not knowingly collect special categories of personal information. Please do not include sensitive information, such as health details, in the topics or goals you enter.
3. How we use information and our legal bases
We use personal information for the purposes below. Where the EU or UK General Data Protection Regulation (GDPR) applies, we rely on the legal bases shown.
| Purpose | Information used | Legal basis |
|---|---|---|
| Create and secure your account, and keep you signed in | Account details, technical data | Performance of a contract |
| Produce your series and episodes | Learning requests, produced content | Performance of a contract |
| Grade quizzes, schedule recall checks and assessments, track progress and streaks, and release episodes on your schedule | Learning activity | Performance of a contract |
| Process subscriptions and payments | Account details, payment information | Performance of a contract; legal obligation (tax and accounting) |
| Respond to support, privacy and legal requests | Account details, communications | Performance of a contract; legal obligation |
| Send service messages, such as billing receipts and changes to these policies | Account details | Performance of a contract; legal obligation |
| Prevent abuse, detect fraud and protect the Service | Technical data, account details, learning requests | Legitimate interests in keeping the Service secure |
| Maintain and improve the Service, including aggregate measures of activation, retention, completion and learning | Learning activity and produced content, aggregated where possible, using our own database rather than third-party analytics | Legitimate interests in improving our product |
We do not use your personal information for advertising, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Episode content is produced by AI from your inputs, but this does not involve evaluating you as a person.
4. How AI is used
To produce custom series, we send the topic, goal, level and format you choose, together with the season outline, to our AI provider, Anthropic, through its commercial API. We do not send your name, email address or payment details with these requests.
Under its commercial terms, Anthropic acts as our service provider and does not use data submitted through its API to train its models. It may retain requests for a limited period for safety and abuse monitoring, as described in its own policies.
6. International transfers
Our service providers may process information in countries other than the one where you live, including the United States. Where we transfer personal information from the EEA, the UK or Switzerland to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, or on a provider’s certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions. You can ask us for more information about these safeguards.
7. How long we keep information
| Information | Retention period |
|---|---|
| Account details, learning requests, learning activity and produced content | While your account is open. Deleted within 30 days of your account being closed. |
| Backups | Overwritten on a rolling basis, normally within a further 35 days. |
| Billing and transaction records | As long as required by tax and accounting law, typically up to 7 years. |
| Server and security logs | Up to 90 days, unless needed longer to investigate a security incident. |
| Support and privacy correspondence | Up to 3 years after the request is resolved. |
When you remove a catalog series from your library, your progress in that series is deleted. When you delete a custom series, its episodes and your progress in it are deleted.
8. Security
We use technical and organizational measures designed to protect personal information, including:
- encryption in transit using HTTPS;
- salted bcrypt password hashing;
- signed, HTTP-only, same-site session cookies that scripts on the page cannot read;
- server-side authorization checks on every page, action and API request;
- limiting access to personal information to people who need it to operate the Service.
No method of transmission or storage is completely secure. If we become aware of a breach affecting your personal information, we will notify you and the relevant authorities as required by law. To report a vulnerability, contact security@edusodes.com.
9. Your rights
Depending on where you live, you may have the right to:
- access the personal information we hold about you and receive a copy of it;
- correct inaccurate information. You can update your name in Settings at any time;
- delete your account and personal information;
- receive your information in a portable, machine-readable format;
- object to or ask us to restrict processing based on legitimate interests;
- withdraw consent where processing is based on consent, without affecting earlier processing.
To exercise any of these rights, email privacy@edusodes.com from the address on your account. We will respond within one month, or within the period required by your local law. We may need to verify your identity before acting on a request. We will not discriminate against you for exercising your rights.
If you are in the EEA, the UK or Switzerland, you also have the right to lodge a complaint with your local data protection authority. We would appreciate the chance to address your concern first.
10. Notice for United States residents
This section supplements this policy for residents of US states with comprehensive privacy laws, including California under the California Consumer Privacy Act as amended (CCPA).
- Categories collected in the last 12 months: identifiers (name, email address, IP address); commercial information (subscription and transaction history); internet or other electronic network activity (learning activity and request logs); and inferences limited to your learning progress. Sources and purposes are described in sections 2 and 3.
- Disclosures: we disclose these categories to the service providers listed in section 5 for business purposes only.
- No sale or sharing: we do not sell personal information or share it for cross-context behavioral advertising, and have not done so in the last 12 months. We do not knowingly sell or share the personal information of consumers under 16.
- Sensitive personal information: we use account credentials only to authenticate you, and do not use or disclose sensitive personal information for purposes that would give rise to a right to limit.
- Your rights: you may request to know, access, correct or delete your personal information. You may use an authorized agent, and we will verify the request with you. If we decline a request, you may appeal by replying to our decision.
- Global Privacy Control: because we do not sell or share personal information, there is nothing to opt out of, but we honor opt-out preference signals.
11. Children
The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13 (or under 16 where local law sets a higher age) without the consent of a parent or guardian. If you believe a child has provided us with personal information without that consent, contact privacy@edusodes.com and we will delete it.
13. Changes to this policy
We may update this policy to reflect changes to the Service or the law. We will post the updated version on this page with a new effective date and, if the changes are material, notify you by email or in the Service before they take effect.
14. Contact us
For privacy questions or requests, contact privacy@edusodes.com.