Privacy Policy

1. Who we are

learnfeed ("we", "us") is a platform that lets independent instructors and teaching centers ("academies") run their own online academy: student enrollment, attendance, manual payment tracking, quizzes, session recordings, and certificates. The data controller for this website and for academy (instructor) accounts is: Abdelrahman Elsharkawi, UNI Campus H3.01.12, 66123 Saarbrücken, Germany — learnfeed.support@gmail.com. See also our Impressum at /impressum.

2. The two roles we play (important)

For instructor accounts and this marketing site, we are the data controller. For student data inside an academy (names, emails, phone numbers, attendance, quiz results, manually recorded payments, certificates), the academy is the data controller and we process that data on the academy's behalf as a processor under Art. 28 GDPR. Students should direct privacy requests about their course data to their academy first; we support academies in fulfilling them.

3. What we process

• Instructor account data — name, email, password (hashed by our auth provider), academy name, branding, billing status.
• Student data (processed for academies) — name, email, phone (optional), cohort membership, attendance, quiz attempts and scores, submitted coursework (the text and any links a student submits for a task), manually recorded payment entries (amount, method, status — never card numbers), issued certificates.
• Billing data — platform subscriptions (what an academy pays to learnfeed) are paid by direct bank or wallet transfer and confirmed manually by us; there is no live card or payment-processor checkout. For each payment request we store the plan, the billing term (3, 6, or 12 months), the amount and currency, a short payment reference you quote in your transfer (e.g. LF-7K3M2A), the request status (pending, confirmed, or rejected), an optional transfer receipt you upload, and who confirmed the payment and when. We never see or store card numbers, bank or wallet credentials, or payment-processor tokens.
• Connected meeting accounts (optional) — if an instructor connects Google or Zoom to create class meeting links, the account's email address, the access tokens that let us create meetings in it, and — for Google Meet — the Drive link of a class session's recording. See section 8.
• Technical data — server logs (IP address, timestamps, requested URLs) for security and abuse prevention, e.g. rate limiting.

4. Legal bases

• Performance of a contract (Art. 6(1)(b) GDPR) — providing the platform, billing, support.
• Legitimate interests (Art. 6(1)(f) GDPR) — securing the service, preventing abuse and fraud.
• Legal obligations (Art. 6(1)(c) GDPR) — tax and commercial record-keeping.

Academies are responsible for having a lawful basis for the student data they enter or collect through their academy pages, including where students are minors (parental consent where required by local law).

5. Cookies

We use only strictly necessary cookies: authentication/session cookies and a language preference. We do not use advertising or third-party analytics cookies, which is why you don't see a cookie consent banner.

6. Processors and recipients

We use the following service providers (processors) to run the platform:

• Supabase — database, authentication, and file storage (including transfer receipts).
• Cloudflare (R2) — storage for uploaded session recordings and other large media. Files are served through short-lived signed links rather than a public URL.
• Vercel — application hosting and content delivery.
• Resend — transactional email (invites, password resets).
• Upstash — rate limiting (short-lived technical keys).
• Vercel AI Gateway — routes our AI requests to the model provider that serves them (currently including Google, OpenAI, Anthropic and Moonshot AI), where an academy uses an AI feature. Which providers may receive an academy's content depends on a setting the academy controls. See section 7.

Where instructors publish session recordings, videos are embedded from YouTube or Google Drive; opening such a page transmits your IP address to Google. Some providers process data outside the EU/EEA; transfers rely on EU Standard Contractual Clauses or an adequacy decision.

7. AI features (Hudhud, draft feedback, generated content)

Several features send text to an AI model: the assistant (Hudhud), draft grades and comments on submitted coursework, quiz generation from your own materials, session summaries, and generated page copy. These run only when someone in the academy actively uses them — nothing is sent in the background.

What we send. Depending on the feature: course, cohort and session titles, task titles and instructions, the student's name, the coursework a student submitted (its text and any link), the text of materials the academy uploaded, and the instructor's own message to the assistant. We do not send student email addresses, phone numbers, payment records, transfer receipts, or data belonging to any other academy.

Who receives it. Requests go through the Vercel AI Gateway, which forwards them to a model provider. Each academy chooses between two routes in Settings → Data & privacy:

• "Use our strongest models" (on by default) — we route to the strongest and most cost-effective models available. Some of these providers reserve the right, under their own published terms, to retain submitted content and use it to improve or train their models. We have no contractual control over that, which is why this page names it plainly rather than burying it.
• Switched off — we route only to a restricted list of providers whose published policy is that submitted content is not used for training. These endpoints cost us several times more per request, so an academy on this setting uses up its monthly AI allowance faster; the price of the plan does not change. We additionally mark these requests as requiring no training on prompt data and zero data retention. That marking is now enforced by refusal: if no provider meeting both conditions can serve the request, it fails rather than being routed to one that does not.

The limit of what we can promise. In both modes we are relying on providers' published policies and on the Gateway's routing. We can choose which providers may receive your content and we do; we cannot audit what they do with it once received. An academy that does not want its students' coursework processed by a third-party model at all should not use the AI features — that remains the only complete answer, and it costs nothing else in the product.

Human review. Generated feedback is stored as a draft for the instructor to review, edit, or discard; by default nothing generated this way reaches the student until a human approves it. An academy can switch on automatic publishing, in which case the generated grade and comment are released to the student without prior review — that is the academy's decision as controller, and students can ask their academy for a human review of any grade.

8. Connecting Google or Zoom for meeting links

Instructors can optionally connect their own Google or Zoom account so that learnfeed can create the meeting link for a class session ("Generate Google Meet link" / "Generate Zoom link" in the session form). Nothing is connected unless the instructor chooses to, and students never connect anything.

• What we receive. From Google: your email address and permission to create Google Meet meeting spaces (meetings.space.created), which also lets us see the meetings we created for you — when they took place and the Google Drive link of their recordings. From Zoom: your email address and permission to create Zoom meetings. We do not read your calendar, contacts, email, Drive files or any other meetings in your account, and we never download or copy your recordings.
• What we use it for. To create a meeting when you click the button, and to show which account is connected. The meeting link is put into the session form; it is saved only when you save the session, like a link you paste yourself. For Google Meet, after a class session ends we look up only that session's meeting and, if it was recorded, save the recording's Drive link to the session as an unpublished draft; students see it only after the instructor publishes it, and can only open it if the instructor shares it in their Drive.
• How it is stored. The access and refresh tokens are encrypted (AES-256-GCM) before they are stored, can only be read by our servers, and are never sent to your browser. We do not sell this data, use it for advertising, share it with third parties, or use it to train AI models.
• Disconnecting. Click "Disconnect" under Account → Connected accounts, and we revoke our access at Google or Zoom and delete the stored tokens immediately. Meetings already created stay in your Google or Zoom account. You can also revoke access at any time from your Google Account (Security → Your connections to third-party apps & services) or in Zoom (App Marketplace → Manage → Added Apps). Deleting your learnfeed account deletes the connection too.

learnfeed's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. How we protect this data is described in section 9.

9. How we protect your data

We treat the access tokens of connected Google and Zoom accounts, student records, and payment receipts as sensitive data, and protect them with the following measures:

• Encryption in transit. All traffic to learnfeed and between learnfeed and its providers (Supabase, Google, Zoom) uses HTTPS/TLS. Browsers are told to refuse unencrypted connections to learnfeed (HTTP Strict Transport Security).
• Encryption at rest. Our database and file storage (Supabase, Cloudflare R2) are encrypted at rest by those providers. On top of that, Google and Zoom access and refresh tokens are encrypted by our own servers with AES-256-GCM before they are written to the database. The encryption key is kept in our hosting provider's encrypted environment settings, separate from the database, so a copy of the database alone does not reveal any token.
• Access control. Every table that holds academy or student data is protected by database row-level security, so each signed-in user can reach only the academies they belong to, with the permissions of their role. The table of connected meeting accounts has no access for any signed-in user at all: only our server code can read it, the tokens are never sent to a browser, and they are used only to make the requests described in section 8.
• Least privilege. We ask Google and Zoom only for the permissions the meeting feature needs (section 8) and nothing broader. Staff access to production systems is limited to the people who operate learnfeed.
• Deletion. Tokens are deleted the moment you disconnect, when Zoom tells us you removed the app, when Google or Zoom reports that access was revoked, and when your learnfeed account is deleted.
• Abuse protection and monitoring. Sign-in and other sensitive endpoints are rate limited, passwords are stored only as salted hashes by our authentication provider, and server errors are logged and reviewed.
• Incidents. If a breach affects personal data, we notify the competent supervisory authority within 72 hours where required (Art. 33 GDPR) and inform affected users and academies without undue delay.

10. Certificate verification

When an academy issues a certificate, its verification page (reachable via the certificate's link or code) shows the student's name, the course, and the issue date so third parties can verify authenticity. Academies can revoke certificates, which disables verification.

11. Public student profiles

Public student profiles are no longer available. Existing profile records and their reserved slugs remain stored, but profile pages, printable cards and profile QR codes are not served.

12. Retention

Account and academy data are kept for as long as the account exists. Academies can export their data (CSV) at any time and can edit or delete student records. When an account is deleted, associated data is deleted except where statutory retention duties (e.g. invoices under German tax law: up to 10 years) require keeping it. Technical logs are kept only as long as needed for security.

13. Your rights

Under the GDPR you have the right to access, rectification, erasure, restriction, data portability, and to object to processing based on legitimate interests. You can also lodge a complaint with a supervisory authority — in Germany, the data protection authority of your federal state. To exercise your rights, contact us via the details in the Impressum. If your request concerns your data inside a specific academy, we may refer you to that academy as the controller, and we will assist them in responding.

14. Changes

We will update this policy as the product evolves and note the date above. Material changes will be announced to account holders by email or in-app notice.