Privacy Policy

1.1 Account Information. When you register, we collect your name, email address, and password (stored securely as a hash). If you sign up via Google or Apple OAuth, we receive your name and email from those providers.

1.2 Usage Data. We collect information about how you interact with the Platform, including courses viewed, lessons completed, quiz results, AI tutor queries, and progress data. This is used to personalise your learning experience.

1.3 Payment Information. Payments are processed by Stripe. We do not store your full card details. We retain a record of transactions including amounts, dates, and course identifiers.

1.4 Referral Data. We record referral relationships (who referred whom) to calculate and distribute referral commissions. Your referral code is associated with your account.

1.5 Communications. If you contact us via email or through our support system, we retain those communications to resolve your enquiry and improve our services.

We use your information to: provide and operate the Platform and its features; personalise your learning experience and AI tutor responses; process payments and distribute earnings and referral commissions via Tipalti; send transactional emails (account confirmation, payment receipts, payout notifications); respond to support requests; monitor for fraud, abuse, or violations of our terms; and improve the Platform through aggregate analytics.

We do not sell your personal data to third parties for marketing purposes.

3.1 Payment Processing. We share necessary payment data with Stripe to process course purchases.

3.2 Payout Processing. We share your name, payment details, and earnings data with Tipalti to process payouts for authors and referral earners.

3.3 AI Services. Course content generation uses OpenAI APIs. Your uploaded book content and AI tutor queries are processed by OpenAI subject to their data processing terms. We do not intentionally share your personal account data with OpenAI.

3.4 Infrastructure. We use cloud hosting providers (including AWS) for data storage and processing. These providers are bound by data processing agreements.

3.5 Legal Requirements. We may disclose your information if required to do so by law, regulation, or valid legal process.

We retain your account and usage data for as long as your account is active. Upon account deletion, we will delete or anonymise your personal data within 90 days, except where retention is required by law (for example, financial transaction records which may be retained for up to 7 years).

Depending on your jurisdiction, you may have rights including: the right to access the personal data we hold about you; the right to correct inaccurate data; the right to request deletion of your data (subject to legal retention requirements); the right to object to or restrict certain processing; and the right to data portability.

To exercise any of these rights, contact us at support@cavua.ai. We will respond within 30 days.

We use a session authentication cookie (auth_token) to keep you logged in. We do not use third-party advertising cookies or tracking pixels. We may use anonymised analytics to understand platform usage at an aggregate level.

We implement industry-standard security measures including encrypted data transmission (TLS), hashed password storage, authentication token management, and access controls on our systems. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by a prominent notice on the Platform. Continued use of the Platform after changes take effect constitutes your acceptance of the revised policy.