Legal

Privacy Policy

Last updated: June 10, 2026

walle.academy ("we", "us", "our") is committed to protecting your personal data. This Privacy Policy describes what data we collect, why we collect it, how we use it, and what rights you have. Please read it carefully.

1. Data Controller

The data controller responsible for your personal data is:
Walle Academy — operating as walle.academy
Registered address: [Address], Tbilisi, Georgia
Registration number: [Registration Number]
Contact: walle.academy.2026@gmail.com

2. Data We Collect

Account data: your name (display name), email address, and hashed password when you create an account.
Learning data: courses you are enrolled in, lesson progress, quiz answers and scores, XP points, daily streaks, badges earned, and spaced-repetition review history.
Communication data: messages you send to Walli (the AI tutor) during lessons. These are stored to support lesson continuity and personalisation.
Payment data: records of transactions (course purchased, amount, currency, date, and anonymised payment method type). We do not store full card numbers or CVV codes — these are handled entirely by our payment processor.
Technical data: IP address, browser type and version, device type, operating system, pages visited, and session duration, collected automatically for security and platform performance.
Anonymous guest data: progress data for users who have not created an account is stored locally on your device (localStorage) and associated with a temporary session identifier.

3. How We Use Your Data

To provide the Services: account management, course delivery, progress tracking, and certificate generation.
To personalise learning: driving the spaced-repetition system, recommending next steps, and adapting difficulty based on quiz performance.
To process payments: completing course purchases and managing refunds.
To communicate with you: transactional emails (purchase confirmation, password reset), and important service updates. We do not send marketing emails without your explicit consent.
To ensure security: detecting fraud, preventing unauthorised access, and maintaining platform integrity.
To improve the platform: aggregate, anonymised analysis of how users interact with lessons and content.
To comply with legal obligations: tax records, fraud prevention, and responses to lawful requests from authorities.

4. Legal Basis for Processing

Contract performance: processing necessary to deliver the Services you have purchased.
Legitimate interests: security, fraud prevention, and platform improvement — where these do not override your rights.
Legal obligation: retention of financial records as required by Georgian tax law.
Consent: for any optional communications or non-essential analytics, where we will ask for your consent separately.

5. Data Sharing and Third Parties

We do not sell, rent, or trade your personal data. We share data only with the following trusted processors, under binding data processing agreements:
Supabase (supabase.com) — our database and authentication provider. Your account, progress, and course data is stored on Supabase infrastructure. See supabase.com/privacy.
Anthropic (anthropic.com) — powers the Walli AI tutor via the Claude API. Lesson conversation content is transmitted to Anthropic for AI processing. Anthropic's data use is governed by its privacy policy at anthropic.com/privacy.
Resend (resend.com) — used to deliver transactional emails (e.g. purchase confirmation). Only your email address and relevant email content are shared.
Payment processor — processes card payments. They receive your payment details directly; we receive only a transaction confirmation and anonymised record.
Law enforcement or government authorities — when we are legally required to disclose data, or when necessary to protect the safety of our users or the public.
Business transfers — in the event of a merger, acquisition, or sale of assets, your data may be transferred to the successor entity with advance notice to you.

6. Children's Privacy

Our platform is designed for users of all ages, including children. We take children's privacy seriously.
Users under 13 may only use the platform under direct parental or guardian supervision. A parent or guardian must agree to these Terms and this Privacy Policy on the child's behalf.
We do not knowingly collect data from children under 13 without verifiable parental consent. If you believe a child has provided data without consent, contact us immediately at walle.academy.2026@gmail.com.
For child accounts, we do not use data for marketing, do not display advertising, and collect only the minimum data necessary to provide the educational service.
Parents and guardians may request to review, correct, or delete their child's data at any time by contacting us.

7. Data Retention

Account data: retained for as long as your account is active, plus 2 years after account deletion to handle any outstanding disputes or obligations.
Learning and progress data: retained for the duration of your account to support spaced repetition and progress history. Deleted when your account is deleted.
Payment records: retained for 7 years in accordance with Georgian tax and accounting law.
AI conversation logs: retained for 12 months, then deleted, unless you request earlier deletion.
Technical logs (IP, access logs): retained for 90 days for security purposes.
When you delete your account, we delete or anonymise your personal data within 30 days, subject to the above legal retention requirements.

8. Your Rights

Right of access: request a copy of the personal data we hold about you.
Right to rectification: request correction of inaccurate or incomplete data.
Right to erasure ("right to be forgotten"): request deletion of your data, subject to legal retention requirements.
Right to restriction: request that we limit how we process your data in certain circumstances.
Right to data portability: receive your data in a structured, machine-readable format (JSON) to transfer to another service.
Right to object: object to processing based on legitimate interests.
Right to withdraw consent: where processing is based on consent, withdraw it at any time without affecting prior processing.
To exercise any of these rights, email walle.academy.2026@gmail.com. We will respond within 30 days. We may ask for identity verification before processing your request.

9. Cookies and Tracking

Essential cookies: required for authentication, session management, and core platform functionality. Cannot be disabled without breaking the platform.
Preference cookies: remember your settings (e.g. language preference, theme). Can be cleared via browser settings.
Analytics: we use anonymised, aggregate analytics to understand platform usage. No personally identifiable information is shared with analytics providers.
We do not use advertising cookies, tracking pixels, or third-party retargeting.
You can control or delete cookies through your browser settings. Note that disabling essential cookies will prevent login and course access.

10. Data Security

We implement industry-standard security measures including: TLS encryption for all data in transit; hashed and salted passwords (never stored in plain text); row-level security on our database; access controls limiting who can access personal data.
We conduct regular security reviews and promptly address vulnerabilities.
In the event of a data breach that is likely to result in risk to your rights and freedoms, we will notify you and the relevant authority as required by applicable law.
No system is 100% secure. While we take all reasonable measures, we cannot guarantee absolute security of data transmitted over the internet.

11. International Data Transfers

Your data may be processed outside Georgia by our service providers (Supabase, Anthropic, Resend). These providers operate under their own privacy frameworks and data processing agreements.
We ensure that any international transfers are subject to adequate safeguards, including standard contractual clauses where applicable.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or by prominent notice on the platform, at least 14 days before changes take effect.
The "Last updated" date at the top of this page reflects the most recent revision.
Your continued use of the Services after changes constitutes acceptance of the updated policy.

13. Contact and Complaints

For any privacy questions, requests, or complaints, contact us at:
walle.academy — walle.academy.2026@gmail.com
Walle Academy, [Address], Tbilisi, Georgia
We take all privacy complaints seriously and will respond within 30 days.
If you are not satisfied with our response, you have the right to lodge a complaint with the Personal Data Protection Service of Georgia (pdp.gov.ge).

Privacy questions? Email walle.academy.2026@gmail.com — we respond within 30 days.