Privacy Policy

1. Who is responsible and what this notice covers

Develastic, s. r. o., with its registered office at Tallerova 2/4, 811 02 Bratislava - mestská časť Staré Mesto, Slovakia, operates LessonsForge. Company identification number (IČO): 54530725. Registered in the Commercial Register of Mestský súd Bratislava III, Section Sro, Entry 160099/B. The company is the controller for personal information processed for its own account administration, security, billing, support and website purposes. For privacy requests, contact the company at [email protected].

Tax identification number (DIČ): 2121715299. VAT identification number (IČ DPH): SK2121715299, registered under §7a of the Slovak VAT Act since 11 March 2024.

This notice covers website visitors, account users and people communicating with us. Where an organization supplies personal data for processing on its behalf and determines the purpose, it may be the controller and we may act as its processor under the applicable arrangement. Its own notices and instructions also matter; this notice is not a substitute for a required data-processing agreement.

The information processed depends on the features you actually use. Passkey, payment and automated-support descriptions apply where those features are enabled. A description here does not mean an unavailable feature is already operating.

2. Information and its sources

• From you: contact email, display name, profile details, preferences, project instructions, uploaded files and messages. A contact supplied during independent signup is not confirmed by an enrollment email.
• From Google when used: provider account identifier, authentication claims, email and its verification status, name and profile image when supplied. A provider-verified email and a separately entered contact may have different verification status.
• For passkeys where available: credential identifier, public key, account binding, device or authenticator metadata, labels, creation and use information, and revocation records. The passkey private key and the device’s biometric template are not sent to us. Any backup recovery code is retained only as a one-way verifier and lifecycle metadata, not a recoverable secret.
• From account activity and infrastructure: IP address, user agent, request path, referrer where provided, timestamps, session and security events, error diagnostics, approximate region where derived, and relevant device or request characteristics.
• For content production: project context, prompts, knowledge excerpts, lesson materials, generated text and images, translations, revisions, research sources, exports and related metadata. These can contain personal information when users include it.
• For billing and grants: order and transaction references, selected plan, invoice details, payment status and limited payment-method metadata supplied by the processor, credit entries, usage and cost records, and grant eligibility events. Do not send full card numbers or card security codes to us through support.
• For support and recovery: your messages, answers about account history, relevant pre-existing account metadata, evidence you provide, verification outcomes and decisions. Authorized colleagues or an organization administrator may also supply membership or account-management information.

3. Why we process information and our legal bases

Where the GDPR applies, the legal basis depends on the purpose and relationship. Accepting the user agreement is not blanket consent to every use of personal information.

• Contract or steps you request before a contract: opening and operating your account, carrying out requested generation and exports, delivering purchased services and handling contractual support when you are the contracting person.
• Legitimate interests: securing accounts and systems, preventing fraud and free-credit harvesting, investigating incidents, maintaining reliable services, enforcing lawful restrictions, defending claims and communicating with organizational users. We assess necessity and the effects on individuals; these purposes do not authorize unlimited data collection.
• Legal obligations: required accounting and tax records, statutory complaints and refunds, privacy requests, legally required notices and binding lawful requests.
• Consent where required: optional activities that cannot rely on another appropriate basis, such as non-essential tracking if ever introduced. Refusing or withdrawing optional consent does not by itself remove access to unrelated core services.

4. Required information and contact verification

Some information is necessary for the requested account, service, purchase or security check. Without it, we may be unable to provide that feature or verify a recovery request. Optional profile details are not required merely because a field is available.

For independent signup, we check supported contact format and domain information without sending a verification email. Those checks do not prove a mailbox exists or belongs to you. We may verify control later during a support or legal request. Correct a mistaken contact promptly.

A matching email does not automatically link accounts or authorize access to projects, payments or administrative functions. Contact, authentication and billing data serve distinct purposes.

5. AI processing and support automation

To perform an AI feature, we send the content and context needed for that operation to the selected AI providers or gateway services. This can include your instructions, relevant files or excerpts, previously generated materials and images. We also process request, response and operational records for billing, quality checks, troubleshooting and security.

Where an AI support assistant is used, it is identified as automated support. It may process the conversation and narrowly relevant account metadata to ask questions or assist with a support case. Do not enter passwords, backup recovery codes, full card details or unnecessary sensitive information into the conversation.

Provider arrangements, data locations and retention can differ by feature and provider. We do not represent that every provider has identical retention, that all processing stays in your country or that selecting a model itself guarantees a particular data-protection arrangement. You may request information about the providers and safeguards applicable to your use.

Review uploaded material and prefer fictional or de-identified examples. Do not submit learner or other third-party personal data unless you have authority and a lawful basis, including any necessary organizational processing arrangement.

6. Eligibility, security controls and recovery decisions

We may use automated controls considering relevant account, usage, request, payment and security information to detect abuse, restrict suspicious activity or determine whether to offer discretionary free benefits. They may be inaccurate. A decision not to provide further free credits is different from deleting an account or cancelling a paid entitlement.

Support-history questions are corroborating evidence, not a promise of restoration or an authorization to disclose another person’s information. Access recovery follows controlled account procedures; the support model’s conversational response is not itself permission to replace credentials.

Where a solely automated decision has legal or similarly significant effects and applicable law gives you safeguards, you may contact [email protected] to exercise the applicable rights, including human intervention, expressing your position or contesting the decision. Discretion over free gifts does not remove those safeguards.

We may limit disclosure of technical detection details to protect security and other people, without withholding information that the law requires us to provide.

7. Recipients and sharing

We do not sell personal information. We disclose it only for the purposes described here, your authorized instructions or a lawful requirement.

• Hosting, storage, network, security and other infrastructure providers operating the service.
• Authentication providers, including Google when you choose that sign-in method, and AI providers or gateways used for your requested features.
• Payment processors, including Stripe where enabled, and accounting or tax services needed for the transaction. A payment provider may also process information for its own legal and fraud-prevention responsibilities under its notice.
• Authorized collaborators and workspace administrators within the private access you or the relevant organization grants. The first release does not offer public or unlisted online publication of project materials. Any previously accepted Open Education release remains subject to its existing audience and license terms; private processing alone does not publish content.
• Authorized support personnel, professional advisers and competent authorities where necessary and lawful. A business transfer may involve relevant records subject to applicable safeguards and notices; it is not permission to use them for unrelated purposes.

8. International processing

Some service providers may process data outside the European Economic Area or your country. Where transfer restrictions apply, the relevant transfer must use an applicable legal mechanism, such as an adequacy decision or appropriate contractual safeguards, with additional measures where required.

Contact [email protected] for information about applicable processing locations, recipients and how to obtain a copy of relevant transfer safeguards, subject to lawful protections for confidential information. Worldwide product availability does not mean personal data can be transferred without safeguards.

9. Cookies and browser storage

We do not use analytics or advertising cookies, cross-site advertising pixels or behavioral advertising on the public website. We do not sell public-site browsing data. Infrastructure may still process request logs and security information.

Signed-in areas use session and security storage necessary for authentication and protection. Browser storage may also hold preferences and draft interface state. Necessity is assessed by purpose; not every preference or future analytics feature is automatically a strictly necessary cookie.

Any non-essential tracking introduced in the future requires the notices and consent controls applicable to it before activation. Browser settings can restrict or remove storage, but disabling necessary session storage can prevent sign-in or cause loss of local unsaved state.

10. Retention and deletion

We retain information for the relevant purpose rather than treating every account record as permanently necessary. Criteria include whether the account or project remains active, the accepted service and storage conditions, the status of a support case, limitation periods, applicable accounting requirements and a documented security need.

• Account and project records: while needed for the requested service and any applicable export or closure process, followed by deletion or de-identification under the relevant retention procedure.
• Authentication challenges, sessions and recovery records: for their validity, revocation, investigation and proportionate security purposes; a used recovery code is not retained as a usable credential.
• Payment and accounting records: for required statutory periods and legitimate dispute handling, independently of whether ordinary project content is deleted.
• Support, AI diagnostics and security records: for resolution, reliability, investigation and legal defense where necessary, with access restrictions and review of continued need. Abuse prevention is not a justification for indefinite retention of all uploaded content.
• Backups and legal holds: deletion from active systems may precede expiry of protected backup copies. Backups follow their retention cycle and are not an ordinary access archive. A specific legal obligation or hold may delay deletion of the affected records.

Contact us about retention or deletion

11. Security and confidentiality

We use technical and organizational measures appropriate to the service, including controlled access, secure sessions, audit records and isolation for higher-risk processing. Access to recovery evidence is limited to authorized purposes. No internet service can guarantee absolute security.

Protect your own devices and authentication or recovery methods. Notify us when you suspect unauthorized access. We handle personal-data breaches and required notifications under applicable law; a generic service disclaimer does not remove those obligations.

12. Your rights and requests

Subject to applicable conditions, you may request access, correction, deletion, restriction and portability of your personal data. You may object to processing based on legitimate interests, and to direct marketing where applicable. You may withdraw consent for consent-based processing without affecting its prior lawfulness.

Send requests to [email protected]. We may request proportionate evidence of identity or authority, particularly if account access is lost. We do not require a purchase or restoration of free-credit eligibility to exercise a privacy right. We do not disclose another person’s account information merely because an email or project name matches.

For GDPR requests, we normally respond within one month. Where the law permits an extension because of complexity or number of requests, we explain the extension within that first month. If a request cannot be fulfilled, we give the information and remedies required by law.

You may complain to the Office for Personal Data Protection of the Slovak Republic or another competent supervisory authority, including where you habitually reside, work or consider an infringement occurred. You do not have to waive that right or first purchase support.

Office for Personal Data Protection of the Slovak Republic

13. Children and educational contexts

The service is designed for people producing educational materials; a course intended for children does not require uploading identifiable information about children. Account access by a minor and processing of learner data require the legal authority, notices and any consents applicable to that situation.

Organizations remain responsible for lawful instructions and appropriate handling of learner information. Avoid unnecessary names, contact details, health information and other sensitive records in prompts, uploaded examples and support conversations. Contact us if you believe information about a child was supplied without the required authority.

14. Updates and contact

We identify revisions to this notice and communicate material changes using appropriate channels and any notice required by law. A new notice does not itself supply consent for a new purpose that requires consent. The absence of an enrollment verification message does not prevent necessary security, transactional or legal correspondence.

Questions about personal information, service providers, transfers, retention or this notice can be sent to Develastic, s. r. o. at [email protected].

Email Develastic

User Agreement and Terms of Service