Privacy policy

1. Controller

The controller within the meaning of the GDPR and the Swiss FADP is Nico Jaroszewski, Schlosstalstrasse 202, 8408 Winterthur, Switzerland, info@agenticschool.dev. For any privacy matters you can reach us at this address at any time.

2. Scope

This policy applies to the website https://agenticschool.dev and all associated features. Depending on your place of residence, the GDPR (EU/EEA), the Swiss FADP or the CCPA/CPRA (California) additionally apply.

3. What data we process

Depending on your use, we process the following categories of personal data:

• Account and profile data (name, email, username, optional profile details) when you register via our auth service.
• Learning and usage data (saved lessons, likes, progress) - anonymous and local in your browser and synced after login.
• Community content (posts, comments) including reports for moderation.
• Newsletter data (email, optional name, time and version of your consent).
• Contact data (name, email, company, message) when you use the contact form.
• Consent and cookie data (your consent choices and the time given).
• Technical data (IP address, device/browser information, server logs) for provision and security.

4. Purposes and legal bases

We process data only where there is a legal basis (GDPR Art. 6 para. 1):

• Provision of account and platform as well as pre-contractual/contractual measures (lit. b).
• Newsletter, analytics and external media solely on the basis of your consent (lit. a), revocable at any time.
• Security, abuse prevention, reach and product improvement as a legitimate interest (lit. f).
• Fulfilment of statutory retention and disclosure obligations (lit. c).

5. Cookies and local storage

Necessary cookies and local storage are required for login, security, theme and saving your choices. Optional categories (analytics, external media, marketing) are only activated after your consent. You can find details and manage your choices under the cookie settings.

6. Reach measurement

With your consent we use Vercel Web Analytics and Speed Insights to understand usage and performance in a data-minimising way and without selling your data. According to the provider, Vercel Web Analytics works without cookies and stores aggregated measurement points. Without consent we do not load these analytics scripts.

7. Embedded content (YouTube)

Videos are only loaded after your consent via youtube-nocookie.com. Only then can data be transferred to Google/YouTube (also to the USA). Without consent no external content is loaded.

8. Processors and recipients

We use carefully selected service providers. Insofar as they process personal data on our behalf, this is done on the basis of the respective data processing agreements (Data Processing Addendum), including provisions on sub-processors and international transfers:

• Clerk - authentication, account management and session security.
• Convex - database, server functions, progress, community and form data.
• Vercel - hosting, delivery, technical logs as well as Vercel Web Analytics and Speed Insights after your consent.
• Google/YouTube - video delivery via youtube-nocookie.com after your consent.

9. Transfers to third countries

Some service providers process data in the USA or other third countries. Where necessary, the transfer is based on appropriate safeguards such as EU standard contractual clauses, applicable Data Privacy Framework certifications and the corresponding Swiss mechanisms.

10. Retention period

We store personal data only as long as necessary for the stated purposes or as long as statutory retention obligations exist. Account and profile data are anonymised on account deletion; newsletter data until revocation; server logs only short-term.

11. Your rights (GDPR / FADP)

Depending on the applicable law, you have the following rights:

• Access to the data stored about you.
• Rectification of inaccurate and completion of incomplete data.
• Erasure and restriction of processing.
• Data portability in a common format (directly exportable in your account).
• Objection to processing based on legitimate interests.
• Withdrawal of consent given with effect for the future.
• Complaint to a supervisory authority - in Switzerland to the FDPIC, in the EU to the competent data protection authority of your country.

12. Additional rights for California residents (CCPA/CPRA)

If you live in California, you additionally have the following rights. We do not sell personal data and do not share it for advertising purposes within the meaning of the CCPA/CPRA (No Sale / No Share):

• Right to know which categories of personal data we collect, use and disclose.
• Right to erasure and rectification of your data.
• Right to opt out of the sale or sharing ("Do Not Sell or Share My Personal Information") - not applicable to us, as no sale/share occurs.
• Right to limit the use of sensitive personal data.
• Right to non-discrimination when exercising these rights.
• Exercise via authorised agents is possible.

13. Global Privacy Control (GPC)

If your browser sends a Global Privacy Control signal, we automatically treat this as an opt-out against sale/sharing and disable all optional categories without you having to use the banner.

14. Data security

We protect your data through TLS encryption, access controls and data-minimising processing. However, complete security of data transmission on the internet cannot be guaranteed.

15. Children and minors

Our offering is not directed at children under 16. We do not knowingly collect data from children. If we become aware of such processing, we delete the data immediately.

16. No automated decision-making

There is no solely automated decision-making or profiling with legal effect within the meaning of Art. 22 GDPR.

17. Changes to this policy

We adapt this privacy policy when features, service providers or the legal situation change. The version published here with the update date stated above is authoritative.

18. Contact

For all privacy matters, exercise of rights and complaints you can reach us at info@agenticschool.dev.