LearnSuite

Privacy policy

Last updated: 2026-09-03.

1. Data controller

Codelabs Studio, S.L. (Tax ID B88708797), Málaga, España. [email protected]. https://learnsuite.pro

2. Contact

For anything about your data write to [email protected].

3. What we process and why

  • Account: name, email, password (encrypted at the identity provider), language. Purpose: providing the service. Basis: contract.
  • Progress and assessment: lessons watched, quiz answers, certificates issued. Basis: contract.
  • Purchase and territorial licence: IP country and VPN/proxy signals, card and billing country, verified phone prefix, device identifier and time zone, playback sessions. Purpose: setting your zone price, enforcing the territorial licence, preventing fraud and resale. Basis: contract and legitimate interest in protecting the content. Kept for the life of the licence plus twelve months.
  • Phone: number verified by SMS, for travel passes and account protection. Basis: contract.
  • Identity verification (only for courses that require it): document and selfie processed by Stripe Identity; we keep only the result and the verified name. Basis: contract and legal obligation where applicable.
  • Conversational tutor: your questions and its answers, to provide the service and improve the syllabus. Basis: contract. Never used to train third-party models.
  • Watermark: your name and part of your email are shown over the video during playback. Basis: legitimate interest in protecting the content.
  • Communications: transactional emails (verification, invoices, confirmations). Basis: contract.
  • Instructor biometrics: the instructor's voice and likeness are cloned only with explicit written consent, revocable at any time; on revocation the model is destroyed.

4. Retention

For as long as the account exists and afterwards as long as legal obligations require (five years for invoicing data). You can request account deletion; we erase data at the identity provider, the video storage and the tutor indexes.

5. Recipients and transfers

The providers listed on the Sub-processors page, under processing agreements and, outside the EEA, the European Commission's standard contractual clauses. Data is hosted in the European Union (Germany).

6. Your rights

Access, rectification, erasure, objection, restriction, portability and not being subject to automated decisions. Write to [email protected]. You may also complain to the Spanish Data Protection Agency (www.aepd.es) or your local authority.

7. Automated decisions

The price zone and the territorial licence are decided automatically from the signals in section 3. If the outcome looks wrong, ask for human review at [email protected]: an order marked "under review" is decided by a person.

8. Country annexes

  • Brazil (LGPD): legal bases equivalent to GDPR; the controller above answers as data controller; rights before the ANPD.
  • United States (CCPA/CPRA, California): we do not sell or share personal data for advertising; rights of access, deletion and correction through the same channel.
  • India (DPDP Act 2023): verifiable consent for the stated purposes; rights of correction, erasure and complaint before the Data Protection Board.
  • United Kingdom (UK GDPR): same rights; transfers under the IDTA or the UK addendum to the standard clauses.
  • Argentina (Law 25.326), Mexico (LFPDPPP), Paraguay (Law 6534/2020) and the rest of Latin America: ARCO rights through the same channel; the controller is the one in section 1.