Privacy Policy

Your privacy is critically important to us. This Privacy Policy applies to dataliteracy.ai (the “Website”) and to the online learning, assessment, and AI features (collectively, the “Service”) operated by Powered By Data, LLC d/b/a Data Literacy (“Data Literacy,” “we,” “us,” or “our”).

Who We Are

It is our policy to respect your privacy regarding any information we may collect while operating the Service. We have adopted this Privacy Policy to explain what information may be collected, how we use it, and under what circumstances we may disclose it to third parties. This Privacy Policy applies only to information we collect through the Service and does not apply to information collected from other sources. This Privacy Policy may be changed, updated, or modified by us at any time. If we make material changes, we will update the “Last Updated” date above and, where appropriate, notify you by email or in the Service.

This Privacy Policy, together with our Terms of Service, set forth the general rules and policies governing your use of the Service. Depending on your activities when visiting the Service, you may be required to agree to additional terms and conditions.

Information We Collect

Information You Provide Directly

When you create an account, subscribe, contact us, or otherwise interact with the Service, you may provide us with:

• Account information: name, email address, and password (stored as a one-way hash by our authentication provider).
• Billing information: for paid subscribers, your payment method (handled by Stripe — we receive a customer reference, the last four digits, card brand, and billing country, but never the full card number).
• Profile and learning data: course progress, lesson completion, quiz answers, self-assessment responses, and any preferences you set.
• Communications: messages you send via the contact form, support email, or other channels.
• AI conversation data: prompts you submit to the AI Coach, AI Tutor, or any other AI feature, the AI’s responses, and the context in which the conversation occurred (e.g., which course or lesson). See “AI Features and Data” below.

Information Collected Automatically

Like most online services, we automatically collect certain non-personally-identifying information that web browsers and servers typically make available, such as the browser type, language preference, referring site, and the date and time of each visit. Our purpose in collecting this information is to understand how visitors use the Service and to operate it reliably.

We also collect potentially personally-identifying information, such as Internet Protocol (IP) addresses for logged-in users. We only disclose this information under the same circumstances that we use and disclose personally-identifying information, as described below.

Categories of Personal Information

The categories of personal information we may collect include:

• Identifiers, such as name, email address, IP address, and account identifier.
• Commercial information, such as subscription tier, billing history, and payment-method metadata returned by Stripe.
• Internet or network activity information, such as device and browser type, pages viewed, and lesson and course interactions.
• Geolocation data inferred from IP address (approximate, e.g., country and region — we do not collect precise GPS location).
• Inferences drawn from your use of the Service, such as which topics you have studied or which competencies you have demonstrated.
• AI conversation content (prompts and responses), described further below.

How We Use Information

We use the information we collect to:

• Provide, operate, secure, and improve the Service;
• Process subscriptions, payments, and refunds through Stripe;
• Authenticate you and protect your account and our systems against fraud and abuse;
• Personalize your learning experience and track your progress;
• Provide the AI Features, including by sending your prompts and relevant context to our AI Providers for inference;
• Send you transactional emails (account verification, billing receipts, subscription lifecycle, and other Service-related notices);
• Respond to your support requests and feedback;
• Comply with legal obligations and enforce our Terms of Service; and
• Conduct aggregated, de-identified analysis to understand usage patterns and improve our courses, content, and AI features.

AI Features and Data

The Service includes features powered by third-party large language models, including the AI Coach, AI Tutor, and AI-generated explanations and feedback (collectively, the “AI Features”). This section describes specifically how we handle data when you use them.

What We Collect From AI Features

• The text of your prompts (questions, follow-ups, instructions);
• The AI’s responses;
• The context in which the conversation occurred (course, lesson, or feature), so we can show you your history and improve relevance;
• Token usage metadata, used for rate limiting and operating the Service; and
• Safety-related signals when our systems detect potentially abusive prompts or outputs.

How We Use AI Conversation Data

• To generate the responses you requested;
• To show you your own conversation history within the Service;
• For safety review, including detection of prompt injection, jailbreak attempts, abuse, and other policy violations;
• For quality assurance — we may sample conversations on a de-identified basis to improve prompt design, evaluate model performance, and debug user-reported issues;
• For aggregated analytics that do not identify individual users (e.g., common topics learners ask about); and
• To enforce our Terms of Service.

What We Do Not Do

• We do not sell AI conversation data, and we do not share it with advertisers or data brokers.
• We do not use AI conversation data to serve advertising.
• We do not consent on your behalf to have your AI conversation data used by our AI Providers to train their foundation models. Our API agreements with Anthropic and OpenAI do not grant them rights to train on customer data by default; should that change, we will update this Policy and notify you in advance.

AI Conversation Retention

We retain AI conversation data associated with your account for up to twenty-four (24) months after the conversation occurred, unless: (i) you delete a conversation or your account sooner, in which case we delete it on the schedule described below; (ii) we are required to retain it longer to comply with legal obligations, resolve disputes, or enforce our agreements; or (iii) it has been aggregated or de-identified in a way that no longer identifies you.

Your Controls

You can:

• View your AI conversation history from inside the Service;
• Delete individual conversations at any time from the Service;
• Request a copy or deletion of all your data by emailing contact@dataliteracy.com or via the request form at /contact; and
• Delete your account from your account settings, which will delete or de-identify your AI conversation data within thirty (30) days, subject to any legal retention obligations.

Important: What Not to Include in Prompts

You should not include in any prompt: personally identifiable information about other people; protected health information; non-public financial account numbers; classified information; confidential business or employer information; or any content you do not have the right to submit. AI Features are intended for general education and are not a secure channel for sensitive personal data.

Subprocessors

We use the following third-party service providers (“Subprocessors”) to operate the Service. Each Subprocessor is bound by a written agreement that requires it to protect your information consistent with this Privacy Policy and applicable law.

• Supabase — database, authentication, and file storage.
• Vercel — application hosting, edge network, and serverless compute.
• Stripe — payment processing for paid subscriptions and billing.
• Resend — transactional email delivery (account verification, billing notices, contact form notifications).
• Anthropic, PBC — AI inference for the AI Coach, AI Tutor, and AI-generated content. Anthropic does not use customer API inputs or outputs to train its models by default.
• OpenAI, OpenCorp — text embeddings used by our retrieval-augmented generation pipeline and selected AI features. OpenAI does not use API inputs or outputs to train its models by default.

We update this list as our infrastructure evolves. Some Subprocessors may store or process data outside your home country. By using the Service, you consent to the transfer of your information to those Subprocessors for the purposes described in this Policy.

How We Share Information

We do not sell your personal information. We share your information only:

• With Subprocessors, as described above, to provide the Service;
• With your employer or team administrator, if you access the Service through an organizational subscription (in which case progress and completion data may be visible to the administrator);
• In response to a subpoena, court order, or other legal process; or when we believe in good faith that disclosure is reasonably necessary to protect the safety, rights, or property of any person; and
• In connection with a merger, acquisition, financing, or sale of business assets, in which case we will provide notice before your information becomes subject to a different privacy policy.

Cookies and Similar Technologies

A “cookie” is a small piece of information that a website stores on your device. We use cookies that are strictly necessary to operate the Service, including:

• Authentication session cookies set by our authentication provider (Supabase) so you can stay logged in;
• A checkout session cookie set by Stripe during a payment flow; and
• A small number of first-party cookies used for security and to remember non-essential preferences (e.g., dismissing informational banners).

We do not use advertising cookies, and we do not currently load third-party advertising or behavioral tracking pixels on the Service. You can configure your browser to refuse cookies or to alert you when cookies are being sent; if you disable essential cookies, some features (most notably the ability to stay signed in) will not work.

Security

The security of your personal information is important to us, but no method of transmission over the Internet or method of electronic storage is 100% secure. We use commercially reasonable administrative, technical, and physical safeguards to protect your information, including encryption in transit, access controls, and row-level database security. We cannot guarantee absolute security and you use the Service at your own risk.

Aggregated and De-Identified Information

We may aggregate or de-identify information so that it can no longer reasonably be associated with you, and we may use and disclose such aggregated or de-identified information for any lawful purpose, including improving the Service, publishing research, and reporting industry trends.

Children’s Privacy

The Service is intended for users aged 16 and older. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, please contact us at contact@dataliteracy.com and we will delete it.

Your State Privacy Rights

Depending on your state of residence, you may have specific rights under applicable U.S. state privacy laws, including the California Consumer Privacy Act (“CCPA”), the Virginia Consumer Data Protection Act (“VCDPA”), the Colorado Privacy Act (“CPA”), and similar laws in other states. These rights may include:

• The right to know what categories of personal information we have collected about you and how we use it;
• The right to request a copy of the personal information we hold about you;
• The right to request that we correct inaccurate personal information;
• The right to request that we delete personal information we have collected about you, subject to certain exceptions; and
• The right not to receive discriminatory treatment for exercising any of these rights.

We do not sell personal information and we do not share personal information for cross-context behavioral advertising. To exercise any of these rights, contact us at contact@dataliteracy.com or via the request form at /contact. We may need to verify your identity before responding. You may also authorize an agent to make a request on your behalf, subject to verification.

International Users

The Service is operated from the United States. If you access the Service from outside the United States, your information will be transferred to, processed, and stored in the United States and other jurisdictions where our Subprocessors operate. By using the Service, you consent to this transfer.

Retention

We retain personal information for as long as your account is active, as needed to provide the Service, and as required to comply with legal obligations, resolve disputes, and enforce our agreements. AI conversation data is retained for up to twenty-four (24) months as described above. When you delete your account, we delete or de-identify your personal information within thirty (30) days, except where we are required to retain it longer by law (for example, tax records retained for billing transactions).

Links to External Sites

The Service may contain links to external sites that are not operated by us. If you click on a third-party link, you will be directed to that third party’s site. We have no control over, and assume no responsibility for, the content, privacy policies, or practices of any third-party sites, products, or services. We strongly advise you to review the privacy policy and terms of every site you visit.

Changes to This Privacy Policy

We may change this Privacy Policy from time to time. When we do, we will update the “Last Updated” date above. For material changes, we will provide additional notice (such as a banner in the Service or an email). Your continued use of the Service after the changes take effect constitutes acceptance of the updated Policy.

Contact

If you have any questions, requests, or concerns about this Privacy Policy or our handling of your information, please contact us at contact@dataliteracy.com or by phone at (844) 974-3282, or by mail at: