LearnSuite

Privacy policy

Last updated: 2026-10-15.

1. Data controller

Codelabs Studio, S.L. (Tax ID B88708797), Pasaje Federico García Lorca, 6, 3º E, 29130 Alhaurín de la Torre, Málaga, España. Registro Mercantil de Málaga, hoja MA-198508, inscripción 1ª. [email protected]. https://learnsuite.pro

2. Contact

For anything about your data write to [email protected].

3. What we process and why

  • Account: name, email, password (encrypted at the identity provider), language. Purpose: providing the service. Basis: contract.
  • Progress and assessment: lessons watched, quiz answers, certificates issued. Basis: contract.
  • Purchase and territorial licence: IP country and VPN/proxy signals, card and billing country, verified phone prefix, device identifier and time zone, playback sessions. Purpose: setting your zone price, enforcing the territorial licence, preventing fraud and resale. Basis: contract and legitimate interest in protecting the content. Kept for the life of the licence plus twelve months.
  • Phone: number verified by SMS, for travel passes and account protection. Basis: contract.
  • Identity verification (only for courses that require it): document and selfie processed by Stripe Identity; we keep only the result and the verified name. Basis: contract and legal obligation where applicable.
  • Conversational tutor: your questions and its answers, to provide the service and improve the syllabus. Basis: contract. Never used to train third-party models.
  • Website assistant chat: the public website has a chat with an artificial intelligence assistant that runs on AgenteUno, another Codelabs Studio product, acting as processor. Until you open it, it stores nothing on your device. When you open it and write, we keep a session identifier in your browser's session storage and, on AgenteUno's servers, the text of your messages, the replies and the date and time of the conversation, to answer you and improve our support. To generate the replies, the conversation text is sent to Cerebras Systems Inc. (U.S.), the language-model provider AgenteUno uses for this chat, acting as processor. Cerebras Systems Inc. is not on the EU-U.S. Data Privacy Framework (DPF) list: the transfer relies on the standard contractual clauses (Commission Implementing Decision (EU) 2021/914) incorporated into its data processing agreement. If you use the voice of the assistant, the audio and its transcript are processed by Google LLC (Gemini Live, U.S.), which is certified under the EU-U.S. Data Privacy Framework (DPF). Message text is deleted automatically after 730 days and the conversation record, by then without text, after 3 years; you can ask us to delete it sooner at [email protected]. Please do not type data you do not want us to keep (for example health data or other people's data). Chat usage statistics are measured only if you accept the matching category in the cookie banner. Basis: legitimate interest in answering your enquiry.
  • Recorded 1:1 sessions: only if the learner and the instructor both accept it in the room; the date of each consent and the version of the accepted text are recorded. The recording is stored in the European Union (Cloudflare R2) and transcribed on our own servers. If the academy switches it on, a Google language model (Gemini) prepares a summary. With the instructor's approval, a few general teaching points without personal data may be added to the tutor of the academy's learners; never the recording, the transcript or the summary. Only the learner and the academy can see the recording, the transcript and the summary. Either of them can revoke consent at any time and erase, from their own area, the recording, the transcript, the summary and those tutor points. Basis: consent (Article 6(1)(a) GDPR). Kept until either of them revokes it.
  • Watermark: your name and part of your email are shown over the video during playback. Basis: legitimate interest in protecting the content.
  • Communications: transactional emails (verification, invoices, confirmations). Basis: contract.
  • Instructor voice and likeness (biometric data): we clone the instructor's voice, as part of the work we do for their academy, for a single purpose: dubbing their own courses into other languages with the mouth synced over their original video. Legal basis: their explicit written consent (Articles 6(1)(a) and 9(2)(a) GDPR), documented in writing. It is not used for any other purpose, sold or shared. The voice provider (ElevenLabs, Inc., United States) acts as a sub-processor under standard contractual clauses. To synchronise the lips, KIE (Singapore) and Volcengine (China) receive the video of the instructor's face and the audio dubbed in their voice, also as sub-processors under standard contractual clauses (Article 46(2)(c) GDPR). The instructor can withdraw consent at any time, as easily as it was given, by writing to [email protected]; on withdrawal their voice stops being used and the voice model is destroyed, without affecting earlier processing.

4. Retention

For as long as the account exists and afterwards as long as legal obligations require (five years for invoicing data). You can request account deletion; we erase data at the identity provider, the video storage and the tutor indexes. The instructor's voice model is kept only while their consent and their relationship with the academy last, and is destroyed on withdrawal or when the service ends.

5. Recipients and transfers

The providers listed on the Sub-processors page, under processing agreements and, outside the EEA, the European Commission's standard contractual clauses. Data is hosted in the European Union (Germany).

6. Your rights

Access, rectification, erasure, objection, restriction, portability and not being subject to automated decisions. Write to [email protected]. You may also complain to the Spanish Data Protection Agency (www.aepd.es) or your local authority.

7. Automated decisions

The price zone and the territorial licence are decided automatically from the signals in section 3. If the outcome looks wrong, ask for human review at [email protected]: an order marked "under review" is decided by a person.

8. Country annexes

  • Brazil (LGPD): legal bases equivalent to GDPR; the controller above answers as data controller; rights before the ANPD.
  • United States (CCPA/CPRA, California): we do not sell or share personal data for advertising; rights of access, deletion and correction through the same channel.
  • India (DPDP Act 2023): verifiable consent for the stated purposes; rights of correction, erasure and complaint before the Data Protection Board.
  • United Kingdom (UK GDPR): same rights; transfers under the IDTA or the UK addendum to the standard clauses.
  • Argentina (Law 25.326), Mexico (LFPDPPP), Paraguay (Law 6534/2020) and the rest of Latin America: ARCO rights through the same channel; the controller is the one in section 1.