Privacy Policy

TODO — legal name of the operator
TODO — street and number, TODO — postal code, city, Germany
Email: privacy@autopilotlessons.com

We have not appointed a data protection officer, as we are not required to do so under Art. 37 GDPR. Privacy requests are handled at the address above.

Where a tutor uses Autopilot to process data about their own students, that tutor is the controller for those records and we act as their processor under Art. 28 GDPR. We only process such data on the tutor's instructions.

• Interest registration (name, email, optional phone/WhatsApp number, role, number of students, subjects, message). Purpose: to contact you about beta access and the first-month discount. Legal basis: your consent, Art. 6(1)(a) GDPR. We store the exact consent wording and its timestamp as proof under Art. 7(1).
• Account data (email, password hash, display name, tutor settings). Purpose: to create and secure your account. Legal basis: performance of a contract, Art. 6(1)(b) GDPR.
• Teaching content (students, lessons, curricula, worksheets, vocabulary, answers, progress, invoices) that you enter or upload. Purpose: to provide the service. Legal basis: Art. 6(1)(b) GDPR; for student records the tutor's instruction under Art. 28 GDPR.
• Student portal accounts. Students receive a generated @edubridge.me login address so that no private email address is required. Legal basis: Art. 6(1)(b) GDPR and the tutor's instruction.
• Messages and notifications sent to parents or students by email or WhatsApp at your request. Legal basis: Art. 6(1)(b) and (f) GDPR; the recipient's consent where required by local marketing law.
• Technical log data (IP address, timestamp, requested URL, user agent) processed transiently to deliver the site, to detect abuse and to rate-limit public forms. Legal basis: legitimate interest in a secure service, Art. 6(1)(f) GDPR.

We do not use advertising cookies, analytics cookies or third-party trackers, so no cookie banner is required. We store one strictly necessary item in your browser: your login session, kept in local storage so you stay signed in. It is deleted when you sign out.

“I agree that Autopilot may store the details I provided and contact me by email, phone or WhatsApp about beta access and my first-month discount. I can withdraw this consent at any time by emailing privacy@autopilotlessons.com.”

You may withdraw consent at any time with effect for the future, without affecting the lawfulness of processing carried out before withdrawal (Art. 7(3) GDPR).

We share data only with providers who process it on our behalf under a data processing agreement (Art. 28 GDPR):

• Supabase — database, authentication and file storage (hosted in the EU).
• Cloudflare — application hosting, delivery and abuse protection.
• AI model providers (via our AI gateway, e.g. Google Gemini) — used to generate lesson plans, worksheets and exercises from the material you submit. Content is sent for the purpose of generating that output and is not used by us to train models.
• Twilio — delivery of WhatsApp and SMS notifications, only when you enable them.
• Email delivery provider — sending transactional and notification email.

We do not sell personal data and we do not share it for cross-context behavioural advertising.

Some providers may process data outside the European Economic Area, in particular in the United States. Such transfers take place on the basis of the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR), the EU–US Data Privacy Framework where the provider is certified, and supplementary measures such as encryption in transit and at rest. A copy of the relevant safeguards is available on request.

• Interest registrations: until you withdraw consent, and in any case no longer than 24 months after the last contact.
• Account and teaching data: for the life of the account, then deleted within 90 days of account closure unless a statutory retention period applies.
• Invoices and billing records: retained for as long as tax law requires (in Germany, generally 10 years under § 147 AO).
• Technical logs: kept for a short period for security purposes and then deleted.

Under the GDPR you have the right to:

• access your data (Art. 15)
• have inaccurate data corrected (Art. 16)
• have your data erased (Art. 17)
• restrict processing (Art. 18)
• receive your data in a portable format (Art. 20)
• object to processing based on legitimate interests (Art. 21)
• withdraw consent at any time (Art. 7(3))
• lodge a complaint with a supervisory authority (Art. 77) — in Germany, the data protection authority of your federal state

To exercise any of these rights, email privacy@autopilotlessons.com. We respond within one month.

Autopilot is sold to tutors and institutions, not to children. Student records are created by the tutor, who is responsible for obtaining any parental consent or school authorisation required in their jurisdiction before entering a child's data. Student accounts have no advertising, no public profiles and no messaging outside their own tutor.

Access to data is enforced at database level: every record is bound to its owner and read or written only through authenticated, authorised requests. Traffic is encrypted with TLS, passwords are stored only as salted hashes and checked against known-breached password lists, registration is invite-gated, and public forms are rate limited. We notify you and the competent authority of a personal data breach as required by Art. 33 and 34 GDPR.

We use AI to generate teaching material and study suggestions. These outputs are proposals for the tutor and are always reviewable and editable; no decision with legal or similarly significant effect is made about a person solely by automated means (Art. 22 GDPR).

We may update this notice as the service evolves. Material changes will be announced in the app or by email before they take effect.