Privacy Policy of lern.one

This Privacy Policy (hereinafter: the “Policy”) sets out the rules for processing and protecting the personal data of Users of lern.one (hereinafter: the “Service”), available at https://lern.one.

Personal data is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (hereinafter: the “GDPR”), the Polish Act of 10 May 2018 on the protection of personal data, and other applicable provisions of Polish and EU law.

Capitalised terms not defined in this Policy have the meaning given to them in the Terms of Service.

The controller of personal data (hereinafter: the “Controller”) is:

Contact for matters concerning the protection of personal data: kontakt@lern.one.

The Controller has not appointed a Data Protection Officer (DPO) within the meaning of Art. 37 GDPR, as it is not obliged to do so under Art. 37 sec. 1 GDPR. All enquiries should be directed to the above e-mail address.

3.1. Data provided at registration and in the profile

• e-mail address (required to create an Account),
• password (stored solely as a cryptographic hash - bcrypt; the Controller has no access to the password in plain text),
• first and last name or pseudonym (optional),
• profile picture / avatar (optional),
• biography / profile description (optional),
• chosen role in the Service (Tutor / Student).

3.2. Data collected while using the Service

• educational activity history: sessions, solved tasks, results,
• history of interaction with the AI module: content of queries, answers, submitted images (details in §14),
• content created on the interactive Whiteboard (drawings, notes, graphic elements),
• ratings and reviews given to educational materials and Tutors,
• Subscription data: chosen tariff plan, payment status, Stripe customer identifier (without payment card numbers),
• login log: date, time, IP address, session identifier.

3.3. Technical and diagnostic data

• IP address (including in anonymised form for analytics),
• device and browser identifiers (user agent),
• operating system, type, version and language of the browser,
• referring page (referer) and navigation path within the Service,
• cookies and similar technologies - details in the Cookie Policy,
• performance metrics (TTFB, LCP, CLS).

3.4. Data specific to Tutors

• list of Students: names, contact details (phone, e-mail), legal guardians’ data,
• schedule of tutoring sessions: dates, times, duration,
• hourly rates and financial records (income, invoices, payments from Students),
• created teaching plans, lesson templates, homework,
• public profile data (description, subjects, location).

3.5. Data from integrations

When connecting an external account (Google Calendar, Stripe Connect), we collect only the scope necessary for the integration to work: access token (encrypted), account identifier, e-mail address associated with the service. The tokens are encrypted in the database (AES-256-GCM) and never reach the client bundle.

3.6. Sharing data via links

A Tutor may generate a unique, non-public link (e.g. for a Student's parent/guardian or a guest booking a lesson) granting access to a selected scope of data (schedule, progress, lesson history, Board content) without the need to create an Account in the Service. Anyone in possession of the link has access to the data shared in this way - the Administrator is not liable for its unauthorized disclosure to third parties by the Tutor or the link's recipient. Links may have a defined validity period and may be revoked by the Tutor at any time.

Providing the data necessary to create and run an Account (e-mail address, password or Google sign-in) and the data needed to issue an invoice is voluntary but required to conclude and perform the agreement; without it an Account cannot be created or an invoice issued. Providing other data (e.g. name, photo, profile description) is voluntary. Where consent is required, it is voluntary and may be withdrawn at any time.

The Controller entrusts the processing of personal data to the following entities (processors and sub-processors within the meaning of Art. 28 GDPR), solely to the extent necessary to provide the Services. The list is complete as of the date of the last update of this Policy:

The Controller has concluded a Data Processing Agreement with each of the above entities in accordance with Art. 28 GDPR. The Controller notifies Tutors (as controllers of Students' data) of any intended addition or replacement of a sub-processor by e-mail at least 14 days in advance, with the right to object described in §16. Data may also be disclosed to:

• state authorities (Police, Prosecutor’s Office, courts, President of the UODO) on the basis of applicable regulations,
• the accounting office serving the Controller,
• a law firm in the event of pursuing claims.
• Students, their guardians and guests, to the extent the Tutor shares it with them (student portal, parent links, bookings).

Some of the Controller’s processors are based outside the EEA (mainly in the USA). In such cases, the transfer takes place on the basis of:

• Standard Contractual Clauses approved by the European Commission - Art. 46 sec. 2 lit. c GDPR.
• European Commission adequacy decisions on the level of data protection for the USA (Data Privacy Framework) - in respect of entities certified under the DPF.
• Additional safeguards such as encryption of data in transit (TLS 1.2+) and at rest (AES-256), anonymisation, pseudonymisation.

The User may obtain a copy of the safeguards applied by writing to kontakt@lern.one.

The map below shows where each category of data is physically located. Personal data of Students and Tutors is stored in the European Union; it leaves the EEA only in the cases described in §6 (in particular AI Assistant queries and error logs).

Important: data deleted from the Service may remain in backups for up to 30 days after deletion. Backups serve solely to restore the Service after a failure or attack; they are not used to restore individual data at a User's request or for any other purpose.

9.1. Self-service export

Without contacting the Controller, the User can download: invoices (PDF), a student's billing history (CSV), whiteboards (PNG, PDF), files from the Files module, homework content and results. A Tutor can also export Students' data to the extent visible in the student profile.

9.2. Full export and data portability

Upon request sent from the e-mail address assigned to the Account, the Controller prepares within 30 days a complete export of the Account data in JSON (structured data) and CSV (tables) together with files. The export also covers Students' data entered by the Tutor, so that it can be moved to another tool (Art. 20 GDPR and Art. 28(3)(g) GDPR).

9.3. Deleting individual data

The Tutor deletes or archives Students, whiteboards, files, AI Assistant conversations, sharing links, billing entries and messages (own messages, within 10 minutes of sending) on their own. Deleting a Student removes the related lessons, progress, homework and billing, except for data on issued invoices.

9.4. Account deletion

An account deletion request is submitted in Settings (Tutor) or by e-mail to kontakt@lern.one (Student, guardian, guest). The Controller verifies identity (the request must come from the Account's e-mail address) and executes the request manually within 30 days. Manual verification protects against accidental or malicious deletion of Students' data by a third party. Active Stripe subscriptions are cancelled and the Stripe Connect payment account is disconnected before deletion.

• Deleted permanently: profile, students, schedule, progress, whiteboards, files, messages, AI conversations, integrations, tokens.
• Retained as long as required by law: issued invoices and transaction records (5 years, Art. 86 of the Polish Tax Ordinance), data necessary to defend against claims (until the limitation period expires).
• Retained record of execution: e-mail address and date the request was executed (3 years), as proof of compliance.
• Backups: data disappears from them automatically within 30 days of deletion.

A Student with their own Account may be linked to several Tutors. Deleting a Tutor's Account removes only the Student data entered by that Tutor; the Student's Account and links to other Tutors remain.

Every person whose data is processed has the following rights:

• Right of access to data (Art. 15 GDPR) - to obtain information about the data processed and to receive a copy of it.
• Right to rectification (Art. 16 GDPR) - to request the correction of inaccurate or the completion of incomplete data.
• Right to erasure (“right to be forgotten”) (Art. 17 GDPR) - subject to the Controller’s legal obligations (e.g. invoice data).
• Right to restriction of processing (Art. 18 GDPR).
• Right to data portability (Art. 20 GDPR) - to receive the data in a structured, commonly used format (JSON) and transfer it to another controller.
• Right to object (Art. 21 GDPR) - to processing based on a legitimate interest (Art. 6 sec. 1 lit. f GDPR).
• Right to withdraw consent (Art. 7 sec. 3 GDPR) - for processing based on consent. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
• Right not to be subject to decisions based solely on automated processing (Art. 22 GDPR) - details in §19.
• Right to lodge a complaint with a supervisory authority - details in §21.

To exercise your rights, send a message to kontakt@lern.one describing the request and providing details enabling identification of your Account. We will reply within 30 days of receiving the request (Art. 12 sec. 3 GDPR). Exercising the rights is free of charge, unless the requests are manifestly unfounded or excessive (Art. 12 sec. 5 GDPR).

The Controller applies technical and organisational measures ensuring protection of the processed data adequate to the risks and data categories:

• encryption of connections (TLS 1.2+) between the User and the Service,
• encryption of sensitive data at rest (AES-256-GCM for integration tokens),
• passwords stored solely as cryptographic hashes (bcrypt),
• multi-factor authentication for the Controller’s administration panels,
• access control based on the least-privilege policy and Row Level Security in the database,
• daily backups of the database and files in a separate location (EU region), encrypted, protected by a deletion lock, 30-day retention,
• security monitoring, anomaly detection, protection against DDoS attacks,
• regular security audits of the code and infrastructure,
• processing agreements with processors in accordance with Art. 28 GDPR.
• request-rate limits and blocking of devices used for abuse (mass registrations, spam),
• automatic masking of personal data (e-mail, tokens, passwords) in logs and diagnostic tools,
• overview of active sessions in Settings with the option to sign out other devices.

Two-factor authentication (2FA)

Password sign-in to the Service does not currently support a second factor (authenticator app code or hardware key). Introducing 2FA is planned; we will announce its availability in product updates.

Until then we recommend that Tutors: sign in with a Google account (a second factor configured in Google then also protects sign-in to the Service), use a unique, long password from a password manager, regularly review active sessions in Settings, and never share whiteboard or student-portal links with third parties. The Controller's administrative panels are protected by multi-factor authentication.

12.1. Scope and purpose of access. The Administrator's staff does not routinely review content created by Users (including Board content, files, messages). Access to such content is only possible: (a) in response to a bug report, a request for technical support, or a complaint submitted by the User, (b) to diagnose and fix a technical incident reported automatically by monitoring systems, (c) to detect and clarify a suspected violation of the Terms or a threat to the Service's security, (d) at the request of authorized state authorities.

12.2. Minimization and access logging. Elevated-privilege access (so-called service-role, bypassing standard Row Level Security access controls) is granted only to selected members of the Administrator's staff, limited to the scope necessary for the purpose referred to in point 12.1, and logged on each occasion together with the reason for access in an internal event log.

12.3. Confidentiality. Administrator staff with access to User content is obliged to maintain confidentiality and use the information obtained only for the purpose for which access was granted. The rules for blocking Accounts in the event of abuse (spam, fake Accounts, multiple registrations) are described in the Terms of Service.

The Service uses cookies and similar technologies (Local Storage, Session Storage, IndexedDB) - detailed rules are described in the separate Cookie Policy. The Cookie Policy supplements this Privacy Policy.

The AI Assistant module in the Service uses language models provided by Anthropic PBC. Using the AI module entails the following consequences for your data:

• The content of your query (prompt) is sent to the Anthropic API to generate a response. Anthropic does not use this data to train models (in accordance with the API policy).
• Queries and responses are saved in our database (EU region) as your Account’s conversation history. You can delete any conversation at any time.
• Images sent to the AI (e.g. photos of tasks) are passed to Anthropic for the duration of generating the response. They are not used beyond that purpose.
• All critical parameters (API key, tokens) are stored solely server-side - your browser never has access to them.

Do not enter into the AI Assistant any special categories of personal data (Art. 9 sec. 1 GDPR - health, ethnic origin, sexual orientation, biometric data) or data covered by professional secrecy.

A Tutor using the Service who collects data on their Students and their guardians (name, contact details, schedule, progress, grades, notes, billing) is a separate controller of personal data with respect to that data. Lern.one then acts as a processor under a data processing agreement pursuant to Art. 28 GDPR, the content of which is set out in §16 of this Policy together with §13.2 of the Terms of Service.

This means that:

• the Tutor decides on the purposes and means of processing the Students’ data,
• the Tutor is obliged to fulfil towards the Students the information obligations under Art. 13-14 GDPR,
• the Tutor is responsible for obtaining the required consents (e.g. from legal guardians of minor Students),
• Lern.one processes Students' data solely on the Tutor's documented instructions (using a Service feature constitutes such an instruction) and to the extent necessary to provide the Services,
• The Tutor decides what data about a Student is recorded. The data listed in §17 must not be entered.

This section, together with §15 and §13.2 of the Terms of Service, constitutes the data processing agreement concluded between the Tutor (controller) and Lern.one (processor). The agreement is concluded when the first Student or guardian data is entered into the Service and remains in force until the Tutor's Account is deleted. On request we provide its content as a separate document ready for signature; simply write to kontakt@lern.one.

16.1. Subject matter, nature and purpose of processing

Storing, organising, displaying, sharing with persons designated by the Tutor (Student, guardian), sending notifications, handling billing and payments, processing by the AI Assistant on the Tutor's explicit instruction, and creating backups, in order to enable the Tutor to run and organise tutoring.

16.2. Categories of data subjects and data

Data subjects: Students (including minors), their parents and legal guardians, persons booking a slot. Data: identification (name), contact (e-mail, phone), schedule and attendance, progress, grades and learning notes, whiteboard and homework content, messages, billing (rates, receivables, payments), invoice data.

16.3. Obligations of Lern.one

• processing data solely on the Tutor's documented instructions, unless required by law (in which case we inform the Tutor, where the law allows),
• ensuring that staff with access to data are bound by confidentiality and that access follows the rules in §12,
• applying the technical and organisational measures described in §11,
• using the sub-processors listed in §5; we notify any intended change by e-mail at least 14 days in advance, and the Tutor may object, in which case they have the right to terminate the agreement and delete the Account before the change takes effect,
• assisting in fulfilling data subjects' rights (Art. 12–22 GDPR): the Tutor handles them with the Service's tools, and otherwise on request sent to kontakt@lern.one,
• assisting in complying with Art. 32–36 GDPR (security, breaches, impact assessment), taking into account the nature of processing and the information available,
• notifying the Tutor of personal data breaches concerning their Students without undue delay and no later than 48 hours after becoming aware of the breach, together with the information needed to notify the supervisory authority,
• deleting the data after the Services end (Account deletion) in accordance with §9, unless the law requires further retention,
• making available the information necessary to demonstrate compliance with Art. 28 GDPR and allowing audits: once a year, at a date agreed at least 30 days in advance, in a manner that does not disrupt the Service, at the Tutor's expense; primarily in the form of answers to questions and provision of documentation.

16.4. Obligations of the Tutor

The Tutor is responsible for the lawfulness of the data entered (legal basis, information duties towards Students and guardians, consents of guardians of minors), for its adequacy and for not entering the data listed in §17. The Tutor protects their own Account (§11) and manages sharing links responsibly.

16.5. Transfers outside the EEA

The Tutor authorises Lern.one to use sub-processors established outside the EEA under the conditions described in §6 (standard contractual clauses, Data Privacy Framework).

The Service is designed for organising tutoring: schedule, materials, learning progress and billing. It is not designed to process special categories of data (Art. 9 GDPR) or other data requiring heightened protection. In free-text fields (student notes, lesson descriptions, messages, whiteboard, homework, AI Assistant, files) please do not record:

• health data: diagnoses, disability certificates, opinions of psychological and educational counselling centres (dyslexia, ADHD, autism spectrum), information about medication, therapy or mental state. If a Student needs an accommodation, record the accommodation itself ("more time for tasks", "larger font", "shorter work blocks"), not its cause;
• racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sexual orientation or sex life, genetic and biometric data;
• PESEL numbers, ID card and passport numbers, scans of identity documents and Students' school IDs (a name and address are sufficient for an invoice; a tax ID only for businesses);
• information about convictions, court proceedings, family conflicts and custody arrangements beyond who the contact guardian is;
• financial data of Students and guardians beyond the amount and status of a settlement: card numbers, online banking credentials, guardians' account numbers (payments are handled by Stripe, which does not pass card numbers to us);
• passwords and login details for any services (school registers, exam platforms, e-mail);
• data of third parties unrelated to learning (siblings, friends, school teachers named in evaluative comments);
• assessments of a Student's character, behaviour or family in progress notes. Notes should concern learning: what has been mastered, what needs revision, what the plan is.

Exceptions, handled in separate and additionally protected flows: the Tutor's student ID uploaded to obtain a discount (separate private bucket, access only for verifying staff, deleted after the decision) and the Tutor's identity verification data in Stripe Connect (processed by Stripe as an independent controller, never stored in our database).

If the Controller learns (e.g. while handling a ticket) that data from the list above is present in the Service, it will ask the Tutor to delete it and, in flagrant cases, delete it itself after informing the Tutor. The AI Assistant is not intended for processing such data (§14).

The Service is not directed at children and does not allow persons under 16 to register on their own. Minors aged 16 or over may create an Account with the consent of a legal representative. A Student Account for a person under 16 may be created only at the invitation of a Tutor and with the consent of a parent or legal guardian; a parent or guardian may at any time request access to the child's data and its deletion (kontakt@lern.one).

Where a Tutor enters data of a minor Student into the Service (e.g. to keep a lesson record), the Tutor is responsible for obtaining the legal guardian's consent and fulfilling the information obligations (§15). The scope of data about a minor Student should be kept to a minimum: first name, guardian's contact details, schedule, learning progress (§17).

If we learn that the personal data of a minor has been entered into the Service without the consent of a legal guardian, we will delete it without delay.

The Controller does not make towards Users decisions based solely on automated processing (including profiling) that would produce legal effects or similarly significantly affect the User (Art. 22 sec. 1 GDPR).

Automation elements are used in the Service, but solely to the following extent:

• generating suggestions for tasks and educational materials matched to the Student’s progress,
• automatic grading of closed tasks (multiple choice, true/false),
• detecting abuse, fraud attempts, and attacks on the infrastructure.

None of the above decisions is final - the User may at any time request a review of the decision by a human.

In the event of a personal data breach, the Controller:

• reports the breach to the President of the UODO without undue delay, no later than within 72 hours of becoming aware of the breach (Art. 33 GDPR),
• if the breach may result in a high risk to the rights or freedoms of natural persons, notifies the Users without undue delay (Art. 34 GDPR),
• keeps an internal register of breaches together with the remedial actions taken.

The User has the right to lodge a complaint with the supervisory authority - the President of the Personal Data Protection Office:

Before lodging a complaint, we encourage you to contact the Controller at kontakt@lern.one - we resolve most matters quickly and directly.

We send commercial and marketing information (newsletter, offers, promotions, information about plans and prices, messages encouraging a purchase or a return to the Service) only on the basis of a separate, voluntary consent of the User (Art. 6(1)(a) GDPR and Art. 10 of the Polish Act of 18 July 2002 on the provision of services by electronic means, and the provisions of the Electronic Communications Law). Consent is not a condition for creating an Account or using the Service.

Consent can be given at registration (an unticked checkbox), during Account setup and in Account settings. We record the date, source and wording of the consent in order to be able to demonstrate that it was given (Art. 7(1) GDPR). Consent may be withdrawn at any time: by clicking the “Unsubscribe” link in the footer of any message, in Account settings, or by sending a request to kontakt@lern.one. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

Transactional messages (registration confirmations, invoices, lesson notifications) are sent on the basis of performance of the contract (Art. 6 sec. 1 lit. b GDPR) - they do not require separate consent and cannot be unsubscribed from without deleting the Account.

Service messages related to the Account. Regardless of marketing consent, we may send informational messages related to your Account and the services you already use, e.g. a reminder about unfinished Account setup, about the approaching end of a trial period, or about changes in the Service that affect your Account. Such messages contain no sales offers or encouragement to buy a higher plan and are sent on the basis of performance of the contract (Art. 6(1)(b) GDPR).

Messages displayed inside the Service (e.g. banners and information windows in the app) are part of how the Service works and are not messages sent to an external e-mail inbox.

The Controller reserves the right to update this Policy in the event of: changes in the law, introduction of new Services or features, change of processors or data recipients, recommendations of supervisory authorities.

The Controller will inform Users of material changes by e-mail or by a notice in the Service at least 14 days in advance. Continued use of the Service after the changes take effect means their acceptance. The date at the beginning of the document indicates the date of the last update.