1. Introduction
CourseLabz ("we", "us", "our") is a global marketplace of online courses. This Privacy Policy explains what personal data we collect, how we use it, and your rights under applicable data protection laws including the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).
2. Data we collect
2.1 Account data
- Name and email address (required for account creation)
- Password (stored as a salted bcrypt hash, never in plain text)
- Profile photo (optional)
- Provider ID and avatar when you sign in via Google, Facebook or GitHub
2.2 Learning data
- Courses you enroll in, lessons you complete and quiz results
- Time spent on lessons and progress timestamps
- Certificates issued to you
2.3 Payment data
When you buy a paid course or certificate, payment is processed by Stripe. We never store your full card number on our servers; we only keep a tokenized payment method reference and the last 4 digits for invoicing.
2.4 Technical data
- IP address, browser, operating system, device type
- Referrer URL, pages visited, timestamps
- With your analytics consent: aggregated traffic and campaign measurement data from approved analytics providers
- Cookies and similar technologies (see our Cookie Policy)
3. How we use your data
- To deliver the courses you signed up for and track your progress
- To issue certificates of completion
- To send service emails (purchase confirmation, course updates, password resets)
- To send marketing emails only if you opt in (you can unsubscribe at any time)
- To detect fraud, abuse and security incidents
- To comply with legal obligations
4. Legal basis (GDPR)
- Contract - to provide the service you signed up for
- Legitimate interest - to keep the service secure and improve it
- Consent - for marketing emails, non-essential cookies and optional features
- Legal obligation - to keep tax invoices for the period required by law
5. Sharing your data
We share data only with processors that help us run CourseLabz:
- Stripe (payments)
- Cloud hosting and email infrastructure
- Analytics (with your consent)
We do not sell your personal data.
6. International transfers
Data may be processed outside the EU/EEA, including in the United States. Such transfers are protected by Standard Contractual Clauses approved by the European Commission.
7. Retention
- Account data: while your account is active, plus 30 days after deletion (for backup recovery)
- Tax invoices: 5 years (legal requirement)
- Logs and analytics: 13 months
- Masked UX telemetry snapshots: up to 30 days
8. Your rights
Under GDPR you have the right to access, rectify, erase, restrict, port and object to the processing of your data, and to lodge a complaint with a supervisory authority. To exercise these rights, see our GDPR Rights page or email privacy@courselabz.com.
9. Contact
For privacy questions, contact privacy@courselabz.com.