Privacy Policy

1. Who we are

Expertise-to-Course ("we", "us", "our") operates the course creation platform at expertise-to-course.com. We are the data controller for personal data collected through the Service.

Contact: legal@orangesandstech.co.ke

2. What data we collect and why

3. AI processing disclosure

Your interview responses are sent to Anthropic (the maker of Claude AI) for processing as part of course content generation. Anthropic's use of data sent via the API is governed by Anthropic's Privacy Policy. We use the API under terms that prohibit Anthropic from training models on your data.

Your interview content is not used to train any AI model, including Claude, without your explicit consent.

4. How we store your data

All data is stored in Supabase (PostgreSQL), hosted on AWS infrastructure in the EU. Data is encrypted at rest and in transit (TLS 1.2+). Access is restricted to authenticated users via row-level security policies.

Interview transcripts and generated content are retained for as long as your account is active, plus 90 days after account deletion (to allow recovery in case of accidental deletion).

5. Who we share data with

We do not sell your data. We share data only with the following service providers, each bound by data processing agreements:

• Anthropic — AI content generation (interview transcripts sent for processing)
• Supabase — Database and authentication
• Paddle — Payment processing and merchant of record
• Vercel — Hosting and serverless functions
• Resend — Transactional email (email address only)

6. Your rights (GDPR)

If you are in the EEA, UK, or another jurisdiction with similar rights, you have the right to:

• Access — Request a copy of all personal data we hold about you
• Rectification — Correct any inaccurate personal data
• Erasure — Request deletion of all your personal data ("right to be forgotten")
• Portability — Receive your data in a structured, machine-readable format
• Objection — Object to processing based on legitimate interests
• Restriction — Request that we limit processing of your data

To exercise any of these rights, email legal@orangesandstech.co.ke. We will respond within 30 days. For erasure requests, we will delete all data within 30 days and confirm by email.

7. Data deletion

You can delete your account at any time from your account settings. Account deletion removes your email, interview transcripts, and generated content from our active database within 7 days. Backups are purged within 90 days. Payment records are retained for the legally required period (typically 7 years) for tax and accounting purposes.

8. Cookies

We use only essential cookies required for authentication (session management via Supabase). We do not use advertising or tracking cookies. We do not use Google Analytics or any third-party analytics that set cookies.

9. Children

The Service is not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

10. Changes to this Policy

We will notify you of material changes to this Policy by email at least 14 days before they take effect. Continued use of the Service after changes constitutes acceptance.

11. Contact and complaints

For any privacy questions or to exercise your rights: legal@orangesandstech.co.ke

If you are in the EEA and are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.