The service processes only information needed for the features a person chooses to use. Exact fields depend on the journey and configuration.

• Account and contact information
• Learning plans, submissions, progress, and AI interaction history
• Parent or learner relationship information
• Uploads and support communications
• Order, transaction, promotion, entitlement, and payment-evidence records
• Security, audit, device, and service-reliability events

Information is used to provide the requested learning or account journey, protect the service, support users, reconcile payments, and meet applicable obligations. Access is limited by role and purpose; synthetic Developer Studio identities do not authorize access to real records.

Users under 13 may not create an account. Users aged 13–19 require separately recorded guardian authorization before ordinary learner-data processing; self-service activation for this age group remains unavailable until that lifecycle is implemented. Self-service accounts are currently limited to users age 20 or older.

Active account/profile and learning data are retained while the account is active, then removed or irreversibly anonymized within 30 days after verified deletion unless law requires longer retention. Security/authentication events may be retained up to 180 days, transactional email delivery data up to 90 days, and minimized admin/security audit records up to 365 days. Deleted data may remain in encrypted backups for normal rotation, targeted at no more than 90 days. Consent and policy-acceptance evidence is retained only as long as reasonably necessary to demonstrate the applicable relationship or meet legal obligations.

Privacy, access, correction, withdrawal and verified deletion requests may be sent to the published Privacy contact. Normal verified deletion requests are completed within 30 days; backup residuals rotate out within 90 days. Some minimized records may remain for security, disputes, legal claims, suppression obligations or applicable law.

The platform uses layered technical and organizational safeguards, but no online service can promise absolute security. Service providers are used only when the related feature is configured; this overview does not claim that every optional provider is active.