Privacy policy

1. Controller

The controller within the meaning of the GDPR, the UK GDPR and the Swiss FADP is Nico Jaroszewski, Schlosstalstrasse 202, 8408 Winterthur, Switzerland, info@agenticschool.dev. For any privacy matter, including exercising your rights, you can reach us at this address at any time. We have not appointed a data protection officer, as we are not required to.

2. Scope

This policy covers the website https://agenticschool.dev, the Agentic School learning platform, our emails and our paid subscriptions. Depending on where you live, the EU GDPR, the UK GDPR and Data Protection Act 2018, the Swiss FADP (revFADP), or US state privacy laws apply, in particular California (CCPA as amended by the CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Iowa (ICDPA), Texas (TDPSA), Montana (MCDPA), Oregon (OCPA), Delaware (DPDPA), New Hampshire (NHDPA), New Jersey (NJDPA) and Maryland (MODPA). We grant the rights described below to everyone, whether or not a specific law's thresholds apply to us.

3. What data we process

Depending on how you use our services, we process the following categories of personal data:

• Account and profile data: name, email address, username and optional profile details when you register through our authentication service.
• Learning and usage data: saved lessons, likes, progress and streaks; stored anonymously in your browser and synced to your account after login.
• Billing and subscription data: plan, billing interval, number of seats, subscription status, renewal, cancellation and payment dates, whether a payment succeeded or failed, and the customer and subscription IDs assigned by Stripe. Your card or bank details are entered directly at Stripe; we never see or store your full card number.
• Team data: the email addresses a Team owner assigns to seats.
• Newsletter and founding-member list data: email address, optional first name, language, plan interest, the form you used and the status of your subscription.
• Consent records: for every email opt-in, the version of the consent text you agreed to, the time of sign-up and of your confirmation click, language and source, plus unsubscribe events.
• Email delivery data: which emails we sent you, when, and the delivery status reported by our email provider (sent, delivered, delayed, bounced, spam complaint). We do not track email opens or link clicks with tracking pixels or redirect links; links in our emails only carry plain campaign parameters (utm) that show which email a visit came from.
• Community content: posts and comments, including reports for moderation.
• Contact data: name, email, company and message when you use the contact form.
• Consent and cookie data: your consent choices and when you made them.
• Usage and analytics data: pages viewed, clicks, referrer and campaign parameters, device and browser type, page speed and error reports; with your consent also a pseudonymous ID and session replays with masked inputs (see section 6).
• Technical data: IP address, device and browser information and server logs, for provision and security.

4. Purposes and legal bases

We only process personal data where a legal basis applies (Art. 6(1) GDPR and UK GDPR). Under the Swiss FADP we observe the principles of lawfulness, good faith, proportionality and purpose limitation:

• Account, learning platform and paid subscriptions, including checkout, billing, invoices, access control, Team seats and the service emails that belong to the contract (welcome, Pro access, payment problems, cancellation confirmation): performance of a contract and pre-contractual steps (Art. 6(1)(b)).
• Newsletter and founding-member updates: your consent (Art. 6(1)(a)), given through double opt-in. You can withdraw it at any time with one click, with effect for the future.
• Transactional emails you trigger outside a contract, such as the double opt-in confirmation: our legitimate interest (Art. 6(1)(f)) in reliable, secure communication about what you requested.
• Delivery monitoring and blocking of addresses that bounce or report spam: legitimate interest in deliverability and in not sending unwanted email.
• Keeping proof of your consent: legal obligation and legitimate interest (Art. 7(1), Art. 6(1)(c) and (f)).
• Analytics with cookies or local storage, session replay and external media: your consent (Art. 6(1)(a)), revocable at any time.
• Cookieless reach and performance measurement and server-side revenue events: legitimate interest in a working website and reliable reporting (Art. 6(1)(f)); you can object at any time.
• Security, abuse prevention (for example rate limits and spam traps on forms) and product improvement: legitimate interest (Art. 6(1)(f)).
• Retention of invoices and accounting records and other statutory duties: legal obligation (Art. 6(1)(c); Art. 958f Swiss Code of Obligations).

5. Cookies and local storage

Necessary cookies and local storage are required for login, security, theme and saving your choices. Optional categories (analytics, external media, marketing) are only activated after your consent. You can find details and manage your choices under the cookie settings.

6. Analytics (PostHog EU) and reach measurement

We use PostHog, a product analytics service of PostHog, Inc., 2261 Market St., #4008, San Francisco, CA 94114, USA, as our processor under its Data Processing Agreement. Our PostHog project is hosted in PostHog's EU cloud in Frankfurt, Germany, and your browser only talks to our own domain (agenticschool.dev/ingest), which forwards the data to PostHog EU. How it works depends on your choice in the cookie settings:

• Without your consent (default, after "Necessary only", or with Global Privacy Control): cookieless measurement. Nothing is stored on or read from your device: no cookies, no local or session storage, no session replay, no profile, no link to your account. We record page views and leaves, referrer and campaign parameters (utm), approximate device and browser type, screen size, language, page speed (Core Web Vitals) and technical error reports. A visitor is counted with a hash that PostHog computes on its servers from IP address, browser data and a salt that rotates daily, so you cannot be recognised on the next day; IP addresses are not stored. Legal basis: our legitimate interest in a working, fast and secure website (Art. 6(1)(f)); you can object at any time.
• With your consent (category "Analytics"): PostHog additionally stores a random ID in a first-party cookie and in local storage (ph_..._posthog), its consent record (__ph_opt_in_out_...) and a per-tab ID in session storage, so visits can be linked over time. We then also record sessions as a replay to find usability problems: every input field is masked and specially marked areas are hidden, so what you type is never recorded. When you are logged in, events are linked to your account ID together with your language, plan and whether you have Pro; never your name or email address. We also keep your first landing page, referrer, campaign and language in local storage (ae_first_touch_v1) to measure which content leads to sign-ups. Our own Portfolio Analytics tracker also loads only with this consent: it keeps a session ID, the time of last activity and unsent events in local storage and your account ID in session storage; its events are stored in our database on Convex in the EU (Ireland), and the script is delivered by Vercel Inc. (USA). Legal basis: your consent (Art. 6(1)(a) GDPR, art. 5(3) ePrivacy Directive and its national implementations such as section 25 TDDDG and PECR).
• Server-side, without any access to your device: when you create an account or when a subscription is bought, cancelled or a payment fails, our server sends a pseudonymous event to PostHog with your account ID, plan, billing interval, seats and amount, never your name or email address. These events do not create an analytics profile on their own. Legal basis: our legitimate interest in reliable revenue reporting and in improving our offer (Art. 6(1)(f)); you can object at any time.
• Withdrawal: you can withdraw or change your consent at any time in the cookie settings. We then immediately stop the replay and delete the PostHog cookies and local storage entries, the first-touch entry and the Portfolio Analytics storage from your browser; measurement continues only in the cookieless mode described above.

7. Embedded content (YouTube)

Videos are only loaded after your consent via youtube-nocookie.com. Only then can data be transferred to Google/YouTube (also to the USA). Without consent no external content is loaded.

8. Payments with Stripe

Paid subscriptions are processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland, together with its affiliate Stripe, Inc. (USA). At checkout you enter your payment details directly on pages hosted by Stripe. Stripe acts as an independent controller for the payment data it needs for its own legal duties (for example anti-money-laundering checks, fraud prevention including automated fraud screening, and payment network rules), under its own privacy policy at https://stripe.com/privacy. For subscription management, invoices, receipts and the customer portal, Stripe processes data on our behalf under the Stripe Data Processing Agreement. From Stripe we receive the billing and subscription data listed in section 3. If tax calculation is enabled, Stripe also processes your billing address and, for businesses, your tax ID.

9. Email with Resend

We send all emails (double opt-in confirmations, newsletter, account and billing emails) through Resend (Plus Five Five, Inc., USA) as our processor under its Data Processing Addendum. Resend processes your email address, the content of the email and delivery events. Open and click tracking is switched off. Bounces and spam complaints are reported back to us so we can stop emailing that address.

10. Newsletter, founding list and double opt-in

When you subscribe to the newsletter or join the founding-member list, we first send you a confirmation email (double opt-in). Only after you click the link, which is valid for 7 days, are you added to the list. Unconfirmed sign-ups are deleted after 30 days. Every marketing email contains a one-click unsubscribe link, and supporting mail clients show an unsubscribe button (List-Unsubscribe). You can also manage all lists in your account settings or on our preference page. If you sign up while logged in with your verified account email, we skip the confirmation email, because that address is already verified. Service emails about an active subscription are not affected by an unsubscribe.

11. Processors and recipients

We use carefully selected service providers. Where they process personal data on our behalf, they do so under data processing agreements (Data Processing Addendum), including rules on sub-processors and international transfers:

• Clerk: authentication, account management and session security.
• Convex: database, server functions, progress, community, form, subscription and email-log data.
• Hostinger International Limited, 61 Lordou Vironos str., 6023 Larnaca, Cyprus: hosting of our website on a virtual private server, including technical server logs.
• PostHog, Inc. (USA), hosting in the EU (Frankfurt, Germany): product analytics, error tracking, web vitals and, with your consent, session replay (see section 6).
• Vercel: delivery of the Portfolio Analytics script, only after your analytics consent (see section 6). Vercel does not host our website.
• Stripe: payments, subscriptions, invoices and the customer portal (partly as independent controller, see section 8).
• Resend: sending emails and reporting delivery events (see section 9).
• Google/YouTube: video delivery via youtube-nocookie.com after your consent.

12. International transfers

Some providers (Clerk, Convex, Vercel, Stripe, Resend, Google, and PostHog as a US company with EU hosting) process data in the USA or other countries outside Switzerland, the EU/EEA and the UK. Where no adequacy decision covers the transfer, it relies on the EU Standard Contractual Clauses, with the UK International Data Transfer Addendum and the adjustments recognised by the Swiss FDPIC, and on the EU-US, UK-US and Swiss-US Data Privacy Framework where a provider is certified. You can request a copy of the relevant safeguards from us. Our website itself is hosted by Hostinger, a provider based in the EU (Cyprus).

13. Retention periods

We keep personal data only as long as needed for the purposes above or required by law:

• Account and profile data: until you delete your account; it is then anonymised.
• Subscription data: for the duration of the subscription, then as long as needed for accounting and possible claims.
• Invoices, receipts and accounting records: 10 years from the end of the financial year, as required by Swiss commercial law (Art. 958f Code of Obligations) and comparable EU rules. This also applies to the records kept by Stripe.
• Newsletter and founding list: until you unsubscribe. We keep the proof of consent (consent records and the unsubscribe event) for up to 3 years after you unsubscribe, so we can prove we were allowed to email you, and then delete it.
• Unconfirmed sign-ups: deleted after 30 days.
• Email delivery logs: 13 months.
• Blocked addresses after a hard bounce or spam complaint: as long as needed so we do not email them again.
• Server logs: short term only.
• Analytics events (PostHog): at most 7 years, the maximum retention of our PostHog plan; session replays: 30 days.
• Analytics cookies and local storage in your browser (only with consent): up to 12 months, or until you withdraw consent.

14. Your rights (GDPR, UK GDPR, FADP)

Depending on the applicable law, you have the following rights:

• Access to the data we hold about you.
• Rectification of inaccurate and completion of incomplete data.
• Erasure and restriction of processing.
• Data portability in a common format (directly exportable in your account).
• Objection to processing based on legitimate interests, and to direct marketing at any time.
• Withdrawal of consent with effect for the future: one click in any marketing email, on our preference page or in your account settings.
• Complaint to a supervisory authority: in Switzerland the FDPIC, in the UK the ICO, in the EU the data protection authority of your country.

15. Additional information for US residents

If you live in a US state with a comprehensive privacy law, you have the following rights. We do not sell personal data, do not share it for cross-context behavioral advertising, do not use it for targeted advertising and do not profile you in ways that produce legal or similarly significant effects. We do not process sensitive personal data. Stripe, Resend and PostHog act as our service providers or processors; analytics data is not sold or shared.

• Right to know and access the categories and specific pieces of personal data we collect, use and disclose (see section 3) and the purposes (see section 4).
• Right to delete and right to correct your data.
• Right to data portability.
• Right to opt out of sale, sharing, targeted advertising and profiling: not applicable, because none of this takes place.
• Right to limit the use of sensitive personal data: not applicable, because we do not process any.
• Right to appeal: if we decline your request, reply to our decision within 60 days; if we uphold it, you may contact your state attorney general. Requests: info@agenticschool.dev.
• Right to non-discrimination for exercising these rights. You may also use an authorised agent.

16. Global Privacy Control (GPC)

If your browser sends a Global Privacy Control signal, we automatically treat it as an opt-out from sale and sharing and switch off all optional categories, without you having to use the banner.

17. Data security

We protect your data with TLS encryption, access controls and data-minimising processing. Payment details never reach our servers, webhooks from Stripe and Resend are signature-verified, and confirmation links are stored only as cryptographic hashes. No transmission over the internet can be guaranteed to be completely secure.

18. Children and minors

Our offering is not directed at children under 16. We do not knowingly collect data from children. If we become aware of such processing, we delete the data immediately.

19. Automated decision-making

We do not make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects (Art. 22 GDPR). Stripe may screen payments for fraud automatically under its own responsibility; if a payment is declined, contact us or Stripe and a human will review it.

20. Changes to this policy

We update this privacy policy when features, service providers or the law change. The version published here, with the date shown above, applies.

21. Contact

For all privacy matters, requests and complaints: info@agenticschool.dev, or by post to Schlosstalstrasse 202, 8408 Winterthur, Switzerland.