Privacy Policy

Worlex Academy ("we", "us") provides an online platform for learning French. This policy explains what personal data we collect, why, and your rights. We comply with the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

1. Data we collect

Account data: first name, last name, email, password (hashed), French level you self-report.
Learning data: reading progress, vocabulary you save, quiz results.
Technical data: IP address (used for rate limiting and bot protection), browser type, device, pages visited.
Cookies: only essential cookies are set by default. Analytics or marketing cookies are loaded only with your consent.

2. Why we process it

To create and operate your account (legal basis: contract).
To deliver the course and personalize learning (legal basis: contract).
To prevent abuse, fraud, and bots (legal basis: legitimate interest — Cloudflare Turnstile, Upstash rate limiting).
To send transactional emails (account confirmation, password reset). Marketing emails require your separate opt-in.

3. Who we share data with

We use the following sub-processors, each bound by a Data Processing Agreement and operating under appropriate safeguards (Standard Contractual Clauses where applicable):

Supabase — database and authentication (US, EU regions).
Vercel — hosting and edge network (global).
Cloudflare — DNS, bot protection (Turnstile), edge security.
Upstash — Redis for rate limiting.
Resend (planned) — transactional email delivery.

We do not sell your personal data. We never have. We never will.

4. Retention

We keep your account data for as long as your account is active. If you delete your account, we erase your personal data within 30 days, except where retention is required by law (e.g., billing records).

5. Your rights

Under GDPR, CCPA, and similar laws, you have the right to: access your data, correct it, delete it, port it to another service, and object to processing. To exercise any of these rights, email hello@worlex.academy. We respond within 30 days. If you are unsatisfied, you may lodge a complaint with your local data protection authority.

6. Children

Worlex Academy is not directed at children under 13 (or under 16 in the EU). We do not knowingly collect data from children. If you believe a child has provided us data, contact us and we will delete it.

7. Changes

When we update this policy, we revise the "Last updated" date above and, for material changes, notify you by email or in-app banner.

8. Contact

Data controller: Worlex Academy. Email hello@worlex.academy for any privacy question.