Privacy Policy | Learnexai

This policy explains what personal data DIGITOK LTD collects when you use Learnexai, why, and your rights under the EU General Data Protection Regulation (GDPR) and Cyprus Law 125(I)/2018.

1. Controller

DIGITOK LTD, Voukourestiou 25, Neptune House, 1st floor, Flat/Office 11, Zakaki, 3045, Limassol, Cyprus, registration no. HE 471431, is the controller of your personal data. Privacy questions: [email protected].

2. Data we collect

Account data: name, email address, password (stored as a one-way hash), date of birth, country, account type, and for creators an optional headline and bio.
Billing data: name, email, billing address, optional phone, plan, amount, currency and payment status. Card details are entered on our payment provider's page; we receive only a transaction reference and status.
Learning data: lessons opened and completed, saved courses.
Creator content: courses, lessons, videos and files you upload.
Newsletter: if you subscribe, your email address, the time you gave consent and your IP address (as a record of consent).
Messages: what you send us through the contact form or email.
Technical data: IP address, browser type and server logs, used for security and troubleshooting.

3. Why we use it and our legal basis

To provide your account, courses and plan: performance of a contract.
To take payment, issue invoices and keep accounting records: contract and legal obligation.
To check you meet the minimum age of 18 years: legitimate interests and legal obligation.
To prevent fraud and keep the Service secure: legitimate interests.
To answer your messages: legitimate interests or contract.
To send service emails (receipts, password resets, important changes): contract. We do not send marketing emails without your consent.
To send the monthly newsletter if you subscribed: consent, which you can withdraw with the unsubscribe link in every email.

4. Who we share it with

Our card payment provider, to process payments and prevent fraud.
Our hosting and email providers, who process data on our instructions.
Video platforms (YouTube or Vimeo) when a creator links a lesson from them; those players load only when you open the lesson.
Professional advisers and authorities where the law requires it.

Creators see aggregate learner numbers for their courses, not your personal details. We do not sell personal data.

5. International transfers

Where a provider processes data outside the European Economic Area, we rely on an adequacy decision or the European Commission's standard contractual clauses.

6. How long we keep data

Account and learning data: while your account is open, and deleted or anonymised within 30 days after you delete it.
Payment and invoice records: 7 years, as required for tax and accounting.
Contact messages: up to 2 years.
Server logs: up to 90 days.

7. Your rights

You can ask to access, correct, delete or export your data, to restrict or object to processing, and to withdraw consent where we rely on it. Email [email protected]; we answer within one month. You can also complain to the Office of the Commissioner for Personal Data Protection in Cyprus (dataprotection.gov.cy) or your local supervisory authority.

8. Children

Learnexai is for adults aged 18 years or older. We do not knowingly collect data from anyone younger and will delete such accounts when we become aware of them.

9. Security

We use HTTPS throughout, hash passwords, restrict access to personal data to staff who need it and keep uploaded lesson files behind access checks.

10. Cookies

See our Cookie Policy.

11. Changes

We will post updates here and tell you by email about significant changes.