Privacy Policy
Last updated: July 2, 2026
1. Who we are
Seller AI.NASTASIA, operated by Anastasia, based in Warsaw, Poland. Because we operate from Poland (EU), the General Data Protection Regulation (GDPR) applies to how we handle your data.
Contact ai.tester.course@gmail.com
Data controller
Your personal data is controlled by AI.NASTASIA - Anastasia, based in Warsaw, Poland - who created and delivers the course.
Contact: ai.tester.course@gmail.com
Payments are handled separately by Lemon Squeezy, LLC as Merchant of Record: it is the seller of record for the transaction, collects any VAT, and issues your invoice. Lemon Squeezy processes your billing data under its own privacy policy.
Given the nature and scale of our data processing, we are not required to appoint a Data Protection Officer under GDPR Art. 37. For all data protection inquiries, contact ai.tester.course@gmail.com.
2. What data we collect
We collect only what we need to run the course, process your payment, and provide the AI Mentor experience.
| Data type | Why we need it | Legal basis |
|---|---|---|
| Name and email address | Account creation, course access, communication | Contract performance |
| Payment information | Processing your purchase via Lemon Squeezy (we do not store card numbers) | Contract performance + Legal obligation |
| Course progress and quiz scores | Tracking your learning, unlocking modules, issuing certificates | Contract performance |
| Telegram user ID | Connecting your Telegram account to the AI Mentor bot | Contract performance |
| AI Mentor conversations | Providing personalized answers, improving response quality | Consent (opt-in feature) |
| Analytics data (Google Analytics 4) | Improving course content and user experience, only after you accept analytics cookies | Consent |
3. Third-party services
We use the following services to deliver the course. Each operates under its own privacy policy:
| Service | Location | Purpose |
|---|---|---|
| Lemon Squeezy Inc. | USA | Payment processing (Merchant of Record), sales tax/VAT collection |
| Supabase Inc. | USA (EU region available) | Database, authentication, user data storage |
| USA | Fonts | |
| Telegram | UAE / UK | AI Mentor bot, community, notifications |
| Anthropic | USA | AI Mentor responses (Claude API, primary) |
| OpenAI | USA | Voice input transcription (Whisper), RAG retrieval, AI Mentor fallback |
| ElevenLabs | USA | Voice synthesis for AI Mentor audio replies |
| Render | USA | Bot server hosting |
| Resend, Inc. | USA | Transactional and course emails (name, email address) |
| Google Analytics 4 | USA | Website analytics (with your consent only) |
| Kinescope | EU / [verify] | Lecture video hosting and playback |
| Notion Labs, Inc. | USA | Course material references (no student PII) |
| MailerLite | EU | Optional lead-magnet subscriber sync |
International data transfers
Some providers process data in the United States. The transfer mechanism differs by provider:
- EU-US Data Privacy Framework (self-certified): Google, Render, ElevenLabs, Resend.
- Standard Contractual Clauses (SCC, Art. 46 GDPR): OpenAI, Supabase, and others where DPF certification is not held.
- Anthropic and Lemon Squeezy: [verify current basis - DPF and/or SCC per their DPA].
Where a provider relies on SCCs we also apply supplementary measures where appropriate. Copies of the relevant safeguards are available on request.
4. AI Mentor and your data
When you ask the AI Mentor a question, your message is sent to the Anthropic Claude API to generate a response. If you send a voice message, it is first transcribed by OpenAI Whisper. If the AI Mentor replies with audio, the text is synthesized into voice by ElevenLabs. These requests are anonymized - no personal data (name, email, payment details) is attached to the API call. Only the text or audio of your question and relevant course context are sent.
Anthropic, OpenAI, and ElevenLabs each operate under their own API data usage policies. As of this writing, none of them use API inputs to train their models by default.
4b. Telegram Mini App
When you use our Telegram Mini App, Telegram provides us with your user ID, first name, and language preference via the WebApp initData. This data is used to personalize your learning experience.
4c. Referral program data
If you join our referral program or use a referral link, we process: your generated referral code, the fact and count of referred purchases, and reward status. If you arrive via a referral link we store a first-party referral code (in localStorage and a 30-day same-site cookie) to attribute your visit; it carries only the referral code, no personal data.
To the person who referred you we show only aggregate counts (visits, conversions, rewards earned). We never reveal to a referrer the identity or email of the people they referred. Referral records are retained for [12 months] after the reward is settled, then anonymized; anti-abuse aggregates may be kept longer in non-identifiable form. Referral attribution and payouts are processed together with Lemon Squeezy (affiliate program). See our Referral Program Terms.
5. Your rights under GDPR
As an EU-based business, we respect your rights under the General Data Protection Regulation. You can exercise any of these by emailing ai.tester.course@gmail.com:
- Access - request a copy of all personal data we hold about you
- Rectification - correct any inaccurate data
- Erasure - ask us to delete your personal data ("right to be forgotten")
- Portability - receive your data in a machine-readable format
- Restriction - request restriction of processing of your personal data (Art. 18)
- Object - object to processing of your data for certain purposes
- Withdraw consent - withdraw consent at any time where processing is based on consent
We will respond to any valid request without undue delay and in any event within one month.
6. How long we keep your data
| Data type | Retention period |
|---|---|
| Account data (name, email, progress) | Active account + 12 months after last activity |
| Payment records | 7 years (legal/tax requirement) |
| Server logs | 14 days |
| AI Mentor conversations | 90 days |
| Business inquiries (team/B2B leads) | 12 months from submission or last contact, then anonymized. Aggregate non-identifiable counts retained for funnel analytics. |
| DSAR audit log (subject access request records) | 3 years (Art. 5(2) accountability evidence) |
After retention periods expire, data is permanently deleted or anonymized.
Self-serve data export: available in-app at any time via the "Export my data" button. We send a confirmation link to your registered email; click within 15 minutes to receive a JSON download (valid for 24 hours). Manual rights requests handled within one month via ai.tester.course@gmail.com.
7. Cookies and analytics
Essential cookies. Our web application uses strictly necessary cookies for login sessions and CSRF protection. These do not require consent.
Analytics cookies. With your consent, we use Google Analytics 4 to understand how our pages are used. GA4 sets analytics cookies (for example _ga). We run Google Consent Mode v2 in default-deny mode, so no analytics cookies are set until you accept them in our cookie banner. You can decline, and you can change your choice at any time by clearing site data or using the banner. We do not use advertising or cross-site tracking cookies, and we do not share analytics data with advertising networks.
Referral cookie. If you arrive via a referral link, we store a first-party referral code (in localStorage and a 30-day same-site cookie) solely to attribute your visit to the person who referred you. It carries only the referral code, no personal data.
8. Children
This course is designed for professionals and is not intended for anyone under 16 years old. We do not knowingly collect data from children. If you believe a child under 16 has provided us with personal data, contact us and we will delete it.
9. Complaints
If you believe we are handling your data incorrectly, please contact us first at ai.tester.course@gmail.com - we want to fix it.
You also have the right to lodge a complaint with the Polish Data Protection Authority (UODO):
- Website: uodo.gov.pl
- Urząd Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland
10. Changes to this policy
If we make significant changes, we will notify you by email. Minor updates (clarifications, formatting) may happen without notice. The "last updated" date at the top always reflects the current version.