Privacy Policy
Last updated: September 12, 2026
1. Who we are
Seller AI.NASTASIA, operated by Anastasia, based in Warsaw, Poland. Because we operate from Poland (EU), the General Data Protection Regulation (GDPR) applies to how we handle your data.
Contact ai.tester.course@gmail.com
Data controller
Your personal data is controlled by AI.NASTASIA - Anastasia, based in Warsaw, Poland - who created and delivers the course.
Contact: ai.tester.course@gmail.com
Payments are handled separately by Lemon Squeezy, LLC as Merchant of Record: it is the seller of record for the transaction, collects any VAT, and issues your invoice. Lemon Squeezy processes your billing data under its own privacy policy.
Given the nature and scale of our data processing, we are not required to appoint a Data Protection Officer under GDPR Art. 37. For all data protection inquiries, contact ai.tester.course@gmail.com.
2. What data we collect
We collect only what we need to run the course, process your payment, and provide the AI Mentor experience.
| Data type | Why we need it | Legal basis |
|---|---|---|
| Name and email address | Account creation, course access, communication | Contract performance |
| Payment information | Processing your purchase via Lemon Squeezy (we do not store card numbers) | Contract performance + Legal obligation |
| Course progress and quiz scores | Tracking your learning, unlocking modules, issuing certificates | Contract performance |
| Telegram user ID | Connecting your Telegram account to the AI Mentor bot | Contract performance |
| AI Mentor conversations and mentor memory | Providing personalized answers and continuity between sessions (see section 4) | Contract performance |
| Analytics data (Google Analytics 4) | Improving course content and user experience, only after you accept analytics cookies | Consent |
3. Third-party services
We use the following services to deliver the course. Each operates under its own privacy policy:
| Service | Location | Purpose |
|---|---|---|
| Lemon Squeezy Inc. | USA | Payment processing (Merchant of Record), sales tax/VAT collection |
| Supabase Inc. | USA (EU region available) | Database, authentication, user data storage |
| USA | Fonts | |
| Telegram | UAE / UK | AI Mentor bot, community, notifications |
| Anthropic | USA | AI Mentor responses (Claude API, primary) |
| OpenAI | USA | Voice input transcription (Whisper), RAG retrieval, AI Mentor fallback |
| ElevenLabs | USA | Voice synthesis for AI Mentor audio replies |
| Render | USA | Bot server hosting |
| Sentry (Functional Software, Inc.) | USA; course projects in the EU region | Technical error and availability monitoring. Error reports include the app version, error location and a technical request identifier. Filters remove account details, request bodies and credentials; session recording and AI conversation capture are disabled. |
| Resend, Inc. | USA | Transactional and course emails (name, email address) |
| Google Analytics 4 | USA | Website analytics (with your consent only) |
| Kinescope | EU (Netherlands / EEA) | Lecture video hosting and playback |
| Notion Labs, Inc. | USA | Course material references (no student PII) |
| MailerLite | EU | Optional lead-magnet subscriber sync |
International data transfers
Some providers process data in the United States. The transfer mechanism differs by provider:
- EU-US Data Privacy Framework (self-certified): Google, Render, ElevenLabs, Resend.
- Standard Contractual Clauses (SCC, Art. 46 GDPR): OpenAI, Supabase, and others where DPF certification is not held.
- Anthropic: EU-US Data Privacy Framework certification, plus Standard Contractual Clauses (SCC, Art. 46 GDPR) via its DPA. Lemon Squeezy: Standard Contractual Clauses (SCC, Art. 46 GDPR) via its DPA.
Where a provider relies on SCCs we also apply supplementary measures where appropriate. Copies of the relevant safeguards are available on request.
4. AI Mentor and your data
When you ask the AI Mentor a question, your message is sent to the Anthropic Claude API to generate a response. If the Claude route is unavailable or that call fails, the same question and the same student context block are sent to OpenAI instead, and OpenAI generates the answer. Whichever of the two answers you, when the mentor needs to look something up in the course material it sends a search query to OpenAI, where the course knowledge base is stored. If you send a voice message, it is first transcribed by OpenAI Whisper. If the AI Mentor replies with audio, the text is synthesized into voice by ElevenLabs.
These requests are not anonymous. So that the mentor can answer you personally, a student context block is sent together with your question. It contains: your first name; your interface language; the IT experience level and learning goal you chose at sign-up; your progress (current lecture and module, lectures completed, average quiz score, days since you enrolled, how recently you were last active); your gamification state (level, XP, current and longest streak, achievements earned); and your access type (Demo or full course). We do not send your email address, your Telegram user ID, or any payment or card data.
The AI Mentor also keeps a memory of you. After a conversation, an OpenAI model reads that conversation and writes short free-text notes about you - for example what you do, what you are preparing for, or how you prefer things explained. These notes are stored in our database and are added to every later mentor request, so the mentor can continue from context instead of asking you again. Everything it has stored about you is included in your data export (section 5).
Anthropic, OpenAI, and ElevenLabs each operate under their own API data usage policies. As of this writing, none of them use API inputs to train their models by default.
4b. Telegram Mini App
When you use our Telegram Mini App, Telegram provides us with your user ID, first name, and language preference via the WebApp initData. This data is used to personalize your learning experience.
4c. Referral program data
If you join our referral program or use a referral link, we process: your generated referral code, the fact and count of referred purchases, and reward status. If you arrive via a referral link we store a first-party referral code (in localStorage and a 30-day same-site cookie) to attribute your visit; it carries only the referral code, no personal data.
To the person who referred you we show only aggregate counts (visits, conversions, rewards earned). We never reveal to a referrer the identity or email of the people they referred. Referral records are retained for 12 months after the reward is settled, then anonymized; anti-abuse aggregates may be kept longer in non-identifiable form. Referral attribution and payouts are processed together with Lemon Squeezy (affiliate program). See our Referral Program Terms.
5. Your rights under GDPR
As an EU-based business, we respect your rights under the General Data Protection Regulation. You can exercise any of these by emailing ai.tester.course@gmail.com:
- Access - request a copy of all personal data we hold about you
- Rectification - correct any inaccurate data
- Erasure - ask us to delete your personal data ("right to be forgotten")
- Portability - receive your data in a machine-readable format
- Restriction - request restriction of processing of your personal data (Art. 18)
- Object - object to processing of your data for certain purposes
- Withdraw consent - withdraw consent at any time where processing is based on consent
We will respond to any valid request without undue delay and in any event within one month.
6. How long we keep your data
| Data type | Retention period |
|---|---|
| Account data (name, email, progress) | Active account + 12 months after last activity |
| Payment records | 7 years (legal/tax requirement) |
| Server logs | 14 days |
| AI Mentor conversations | 90 days |
| Business inquiries (team/B2B leads) | 12 months from submission or last contact, then anonymized. Aggregate non-identifiable counts retained for funnel analytics. |
| DSAR audit log (subject access request records) | 3 years (Art. 5(2) accountability evidence) |
After retention periods expire, data is permanently deleted or anonymized.
Status of automated enforcement (checked 3 September 2026). The account-data and AI Mentor conversation windows in the table above are enforced by a daily job that is currently running in observation mode: it counts and logs the records that have passed each window, but does not yet delete or anonymize them. Until it is switched to enforcing, those records are still held past the periods stated. The business-inquiry anonymization and the internal telemetry prune do run for real. Separately, the memory notes the AI Mentor keeps about you (section 4) have no automatic expiry and are not covered by our automated deletion; an erasure request for them is handled by us directly at the address in section 5.
Self-serve data export: available in-app at any time via the "Export my data" button. We send a confirmation link to your registered email; click within 15 minutes to receive a JSON download (valid for 24 hours). Manual rights requests handled within one month via ai.tester.course@gmail.com.
7. Cookies and analytics
Essential cookies. Our web application uses strictly necessary cookies for login sessions and CSRF protection. These do not require consent.
Analytics cookies. With your consent, we use Google Analytics 4 to understand how our pages are used. GA4 sets analytics cookies (for example _ga). We run Google Consent Mode v2 in default-deny mode, so no analytics cookies are set until you accept them in our cookie banner. You can decline, and you can change your choice at any time by clearing site data or using the banner. We do not use advertising or cross-site tracking cookies, and we do not share analytics data with advertising networks.
Referral cookie. If you arrive via a referral link, we store a first-party referral code (in localStorage and a 30-day same-site cookie) solely to attribute your visit to the person who referred you. It carries only the referral code, no personal data.
8. Children
This course is designed for professionals and is not intended for anyone under 16 years old. We do not knowingly collect data from children. If you believe a child under 16 has provided us with personal data, contact us and we will delete it.
9. Complaints
If you believe we are handling your data incorrectly, please contact us first at ai.tester.course@gmail.com - we want to fix it.
You also have the right to lodge a complaint with the Polish Data Protection Authority (UODO):
- Website: uodo.gov.pl
- Urząd Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland
10. Changes to this policy
If we make significant changes, we will notify you by email. Minor updates (clarifications, formatting) may happen without notice. The "last updated" date at the top always reflects the current version.