Privacy policy

1. Who this covers

This policy applies to CourseSaga, Inc. ("CourseSaga", "we") and to the CourseSaga web application and website.

It covers two kinds of people: workspace members, who sign in to author and administer courses, and learners, who are assigned a course and take it. Where the two are treated differently, we say so.

2. What we collect

We keep this deliberately narrow.

• Account data — your email address, display name, and which workspace you belong to. Sign-in is by magic link, so we never hold a password.
• Source material — the documents, links and briefs you upload so a course can be generated from them, plus the text chunks they are parsed into.
• Course and learning data — the courses generated in your workspace, assignments, exam attempts and scores.
• Operational data — server logs, error reports, and basic request metadata needed to run and debug the service.
• Product analytics — only if enabled for your workspace, and never including the content of your source material.
• Billing data — handled by our payment processor. We see the plan, the amount and the status; we never receive your card number.

3. What we do with it

We use account data to authenticate you and to scope what you can see. We use source material to generate, verify and maintain your courses, and for nothing else. We use learning data to produce the completion and pass reporting your workspace administrators rely on. We use operational data to keep the service running and to investigate faults.

We do not sell personal data, and we do not share it with advertisers.

4. Your source material, specifically

This is the part most people are actually asking about, so it gets its own section.

• Your material is not used to train our models or anyone else's.
• It is not pooled across customers. A generation session is isolated to one workspace, and no other customer's material is ever in context with yours.
• It is sent to our model provider solely to generate and verify your course, under an agreement that prohibits training on it.
• It is retained while your workspace is open, because the Curator needs the original in order to detect that a source has changed. Delete a source and it stops being reachable immediately.
• Courses already generated keep their citations after a source is deleted, which means those citations will point at material you can no longer open. Delete deliberately.

5. Who processes it

We use a small number of subprocessors. Each is bound by a data processing agreement and receives only what it needs to do its job.

6. How long we keep things

• Account data — while your workspace is open, then 30 days.
• Source material — while your workspace is open, or until you delete the source. Purged within 30 days of either.
• Courses and learning records — while your workspace is open. Export them before you close it.
• Operational logs — 90 days.
• Billing records — as long as tax and accounting law requires, typically seven years.

7. Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to certain processing, and to complain to a supervisory authority.

Write to privacy@coursesaga.com and we will respond within 30 days. If you are a learner rather than a workspace member, your employer controls the course records about you, and we will route your request to them and help them fulfil it.

8. Security

Data is encrypted in transit and at rest. Access to production systems is limited to the people who need it and is logged. Sign-in uses single-use magic links rather than passwords, which removes an entire category of credential risk.

No system is perfectly secure, and we would rather say that than imply otherwise. If you find a vulnerability, write to security@coursesaga.com — we will acknowledge within one working day and we will not pursue researchers who report in good faith.

9. International transfers

Our infrastructure is in the United States. If you are in the UK, EEA or Switzerland, your data is transferred there under Standard Contractual Clauses. Data residency elsewhere is available on Company plans — ask before you sign, not after.

10. Cookies

We use a session cookie to keep you signed in and a preference cookie to remember your language. Both are strictly necessary and neither tracks you across other sites.

Product analytics, where a workspace has enabled it, sets its own cookie. It is off unless configured.

11. Children

CourseSaga is a workplace tool and is not directed at anyone under 16. We do not knowingly collect data about children. If you believe we have, write to us and we will delete it.

12. Changes

If we change this policy materially, we will email workspace owners before it takes effect rather than quietly updating the date. Past versions are available on request.

13. Contact

Privacy questions and rights requests: privacy@coursesaga.com. Security reports: security@coursesaga.com. Anything else: hello@coursesaga.com.