In short
- Individual Entrepreneur Axel Elearning, based in Georgia, is the controller of your account data. The GDPR applies to you if you are in the European Union.
- We collect what we need to run the service: your account, the documents and course content you work with, usage records, support emails and server logs.
- To generate your course, your prompts and document text go to OpenAI and Anthropic, never your name or email address, under their API terms, which do not allow using API data to train models by default. Payments are handled by Paddle, our Merchant of Record.
- This website sets no cookies and runs no analytics. The application uses one strictly necessary session cookie.
- Uploaded documents are deleted 30 days after upload, exported packages and backups 30 days after creation, and account data when you close your account. Ask for a copy or deletion at any time.
Who is responsible for your data
The controller of personal data processed through Course AI Builder and this website is:
Individual Entrepreneur Axel ElearningUniversity st. 17a, floor 10
Vake, Tbilisi
Georgia
Email: support@courseaibuilder.com
We are established in Georgia, outside the European Union. Because we offer the service to people in the European Union, the EU General Data Protection Regulation (GDPR) applies to our processing of their personal data; the UK GDPR applies in the same way to people in the United Kingdom.
The name and contact details of our representative in the European Union under Article 27 GDPR will be published here. Until then, write to support@courseaibuilder.com for any privacy request.
When a business customer puts personal data of other people into the service, for example names in an uploaded document, that customer is the controller of that data and we process it on its behalf under our Data Processing Terms.
What we collect
Account data. Your name, email address, username, password (stored only as a cryptographic hash), language and account settings, and the date you confirmed your email address.
Purchase data. The packs you bought, the courses remaining in your balance and the courses you have used.
Your inputs. Topics and instructions you write, and documents you upload (PDF, DOCX, PPTX) with the text extracted from them.
Generated content. Course outlines, lesson pages, quizzes, illustrations and the packages and backups you export.
Brand kit. After a purchase, if you use it: your organisation name, brand colour and the logo you upload. Location and other hidden data are removed from logos when they are stored.
Preview links. For each link you create: when it was created, when it expires, whether it is active, and how many times it was opened. We do not record who opened it. Visitors of a preview link get no cookie.
Usage records. For each generation request: what was generated, the model used, the size of the request and response, the time and the result. We use these to count the courses you use, to control costs and to fix problems.
Billing identifiers. From Paddle we receive customer and transaction identifiers, the pack you bought and the order status. Paddle collects your payment and billing details as an independent controller; see its privacy notice.
Support messages. What you write to support@courseaibuilder.com and our replies.
Server and security logs. IP address, browser user agent, requested addresses, times, sign-in events, actions in the application and error reports.
Sign-up protection. We block sign-ups from disposable email domains and limit sign-ups per network, using the IP address of the request.
This website. It sets no cookies, uses no analytics and loads nothing from other websites. Our hosting provider records standard server logs (IP address, requested address, time, user agent) for security.
Why we use it, and the legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Creating and running your account, generating, storing and exporting your courses | Account, purchase data, inputs, generated content | Contract (Art. 6(1)(b)) |
| Sending inputs to AI providers to generate content you ask for | Inputs, generated content | Contract (Art. 6(1)(b)) |
| Recording your purchases and remaining courses with the reseller | Purchase data, usage, billing identifiers | Contract (Art. 6(1)(b)) |
| Keeping tax and accounting records | Billing identifiers, invoices | Legal obligation (Art. 6(1)(c)) |
| Service emails: account confirmation, password reset, purchase and security notices, changes to terms | Account data | Contract (Art. 6(1)(b)) |
| Answering support requests | Support messages, account data | Contract, or our legitimate interest in helping you (Art. 6(1)(f)) |
| Security, abuse and fraud prevention, sign-up protection, cost limits | Logs, usage records, IP address | Legitimate interests (Art. 6(1)(f)) |
| Understanding how the service is used, from aggregated usage records, to improve it | Usage records | Legitimate interests (Art. 6(1)(f)) |
We do not send marketing emails unless you ask for them, and you can stop them at any time. We do not sell personal data, use it for advertising, or use your content to train AI models. We make no decisions about you based solely on automated processing that have legal or similarly significant effects.
AI providers
We use AI model providers, OpenAI and Anthropic, to generate content from your prompts and documents. To generate an outline, a lesson page or an illustration, we send the provider the topic, your instructions, the extracted document text and the course content the request needs. We do not send your name, email address or account details.
The providers process this data as our processors under their API terms, which do not allow using API data to train models by default. We do not opt in to any such use. Some providers keep inputs and outputs for a limited period, typically up to 30 days, to detect abuse, and then delete them.
Do not upload personal data of other people unless you have a lawful basis and it is needed for the course. Where you can, remove names and other identifiers from documents first.
Who receives your data
- Paddle (Paddle.com Market Limited), our reseller and Merchant of Record, for orders, payments, tax, invoices and refunds. Paddle acts as an independent controller under its own privacy notice.
- Processors that run parts of the service for us and may use the data only on our instructions:
| Processor | Purpose | Data | Location |
|---|---|---|---|
| Hetzner Online GmbH | Hosting of the application, its database, file storage and backups | All service data | Germany |
| Sendinblue SAS (Brevo) | Email delivery (account confirmation, password reset, service notices) | Name, email address, message content | France |
| OpenAI, L.L.C. | AI generation of course text and module illustrations from your prompts and documents | Course topic, instructions, extracted document text, course content; no name or email address | United States |
| Anthropic, PBC | AI generation of course text from your prompts and documents | Course topic, instructions, extracted document text, course content; no name or email address | United States |
The same list is kept up to date on the subprocessors page.
- Authorities, where the law requires us to disclose data.
- A successor to our business, if it is transferred, under the same protections.
International transfers
We process personal data in Georgia, and some processors process it in other countries, including the United States. Georgia does not have an adequacy decision from the European Commission. Where personal data from the European Union or the United Kingdom is transferred to us or onwards to a processor in a country without an adequacy decision, we use the European Commission’s Standard Contractual Clauses (and the UK addendum), or rely on the recipient’s participation in the EU-US Data Privacy Framework where it applies, together with supplementary measures such as encryption in transit and limiting the data sent to what each request needs. You can ask us for a copy of the safeguards at support@courseaibuilder.com.
How long we keep it
| Data | Kept for |
|---|---|
| Uploaded documents | Deleted 30 days after upload, or earlier when you delete the course |
| Exported SCORM packages and full course backup files | Deleted 30 days after they were created; you can export again at any time |
| Account data, courses, purchases and remaining courses | While your account exists; deleted when you close it |
| Server and application logs | 90 days |
| Our system backups | 30 days, then overwritten |
| Support emails | Two years after the conversation ends |
| Billing records | Kept by us and the reseller for as long as tax and accounting law requires |
Your rights
If the GDPR or the UK GDPR applies to you, you have the right to:
- access the personal data we hold about you and receive a copy;
- have incorrect data corrected;
- have your data deleted;
- restrict or object to processing based on our legitimate interests;
- receive the data you gave us in a portable format;
- withdraw consent where we rely on it, without affecting earlier processing;
- complain to a data protection supervisory authority, in particular in the EU country where you live or work.
To use these rights, use the account page in the application: ask for a copy of your data there, or close your account, which deletes your courses, exports, brand kit and remaining courses, normally within an hour, and asks us to delete your profile and sign-in details after a short review. You can also write to support@courseaibuilder.com. We answer within one month, and may ask you to confirm the request from your account email address so that we do not disclose data to someone else.
Security
- All traffic to the website and the application is encrypted with TLS.
- Passwords are stored only as hashes.
- Each workspace’s courses and files are separated from other workspaces, and every request is checked against the workspace it belongs to.
- Access to production systems is limited to the people who run the service and is logged.
- Backups are kept for 30 days with restricted access.
- Exported packages contain no tracking; a package makes no network requests when a learner opens it.
- Payment card details are handled by Paddle and never reach us.
No system is completely secure. If a personal data breach puts your rights at risk, we will tell you and the competent authorities as the law requires.
Cookies
This website sets no cookies and uses no analytics or tracking technology, so it shows no cookie banner.
The application uses one strictly necessary session cookie to keep you signed in. It contains a random identifier, expires when you sign out or after a period of inactivity, and is never used for tracking or advertising. Because it is strictly necessary, it does not require consent.
Children
The service is for adults who create courses. It is not directed to children, and you must not create an account for a child. Learners who take your courses in your LMS do not interact with us.
Changes to this policy
We may update this policy. We will tell account holders about material changes by email or in the application before they take effect. The date at the top shows when it last changed.
Contact
Write to support@courseaibuilder.com for any question or request about personal data.