Privacy Policy

LessonAI (“we”, “the service”) is a tool that helps teachers create interactive English lessons, including by generating exercises with artificial intelligence from photos or PDF pages of your teaching materials. We respect your privacy. This policy explains what data we process, why, and what rights you have.

1. Who is responsible for your data

LessonAI is the data controller for your account data. For the materials you upload and process, we act as a processor on your behalf. Contact us at privacy@lessonai.app.

2. What data we collect

• Account data: email, (optionally) name, CEFR levels, and your chosen plan.
• Lesson content: the titles and content of your lessons and the exercises you create.
• Uploaded sources: the photos or PDF pages you upload and the text recognized from them.
• Usage data: the number of AI generations, technical logs, and IP address (for security and rate limiting).

3. Why we use it and on what legal basis

• providing and operating the service — performance of a contract;
• generating exercises at your request — performance of a contract / consent;
• security, abuse prevention, and rate limiting — legitimate interest;
• service emails (email confirmation, password reset) — performance of a contract.

4. AI processing

To generate exercises, the content of your source (text and/or image/PDF) is sent to AI providers (Anthropic Claude and/or Microsoft Azure OpenAI). They process the data only to fulfil the request and, under their API terms, do not use it to train their models. Generated content also passes an automated safety check before it is shown.

5. Who we share data with (sub-processors)

We work with trusted providers who process data only on our instructions:

6. Where data is stored and international transfers

Primary data is stored in the EU (Supabase, Frankfurt region). Some sub-processors may process data outside the EU — in that case, the transfer is based on Standard Contractual Clauses (SCCs) or other lawful mechanisms.

7. How long we keep data

• uploaded photos/PDFs — deleted automatically after 30 days;
• account data and lessons — for as long as your account exists; after account deletion, they are deleted or anonymized within a reasonable period.

8. Student and children’s data

LessonAI is intended for teachers. If the materials you upload contain students’ personal data (including children’s), you are responsible for having a lawful basis or parental/guardian consent. Please do not upload unnecessary personal data about students. We process such content solely as a processor on your behalf.

9. Your rights (GDPR)

You have the right to: access your data, rectification, erasure, restriction of processing, data portability, objection to processing, withdrawal of consent, and to lodge a complaint with a supervisory authority. To exercise these rights, email privacy@lessonai.app. You can also delete your account yourself at any time in Settings → Account. Deletion is scheduled 30 days ahead and we email you a link to cancel it; after that date the data is erased permanently.

10. Cookies and local storage

We use only strictly necessary local storage / cookies to keep you signed in. There are no advertising or third-party tracking cookies.

11. Security

Data is encrypted in transit; row-level access is isolated (each user sees only their own data); service access is restricted. No system is 100% secure, but we apply reasonable technical and organizational measures.

12. Changes to this policy

We may update this policy. We will notify you of material changes. The date at the top of the page reflects the latest revision.

13. Contact

For privacy questions: privacy@lessonai.app.