CourseSmith Privacy Policy

The short version

• We collect what you give us, such as your account details, files, voice samples and recordings, plus a small amount of technical data. We use it to make, store and deliver your courses and videos.
• We never sell your personal information, we do not show ads, and we do not use your content to train AI models.
• With your consent, we use PostHog analytics to see how the app is used and where people get stuck. It is off until you say yes, it never records what you type or your lesson content, and it never runs on your learners' or reviewers' pages (sections 3 and 9).
• To make your videos, we send parts of your content to AI and media providers. Some work for us under data processing terms (section 11.1). Others handle content under their own terms, and a few of those say they may use it to improve their services (section 11.2). Section 10 explains which features use which provider.
• Finished videos are stored at web addresses that are hard to guess but not password protected. Anyone with the address can watch the video.
• Your learners use your interactive lessons, and your clients comment on your review links. For both groups, we handle their data on your behalf. You are responsible for telling them about it and, for children, for getting the right consent.
• You can download a copy of your account data and delete your account yourself, in Settings → Data & privacy, or ask us by email (sections 13.1 and 15).
• Questions go to [email protected].

1. Who we are

CourseSmith (coursesmith.ai) is run by CourseSmith.AI, Inc., a Delaware corporation in the United States. In this policy, "we", "us" and "our" mean CourseSmith.AI, Inc..

When we decide why and how personal data is used, we are its controller. Indian law calls this a "data fiduciary".

• Privacy questions and requests: [email protected]
• General support: [email protected]
• Grievance officer for India: reachable at [email protected], subject line "Grievance Officer" (see section 15)

We have not appointed a data protection officer. Send privacy questions to [email protected].

2. Scope and our role

This policy covers:

• the coursesmith.ai website, the CourseSmith app and the Studio editor
• the public developer API
• the Cutaway Chrome extension
• our emails, and our support form

We act in two different roles.

We are the controller for personal data about:

• people who create a CourseSmith account ("creators" or "you")
• visitors to our website
• people who contact support, or who joined our earlier waitlist
• people who use the Cutaway extension with a CourseSmith account

We are a processor, or service provider, for creators when we handle:

• data about learners who open a creator's interactive lesson link (pages that start with /learn/)
• data about people who comment on a creator's review link (pages that start with /review/)
• personal data about other people inside files a creator uploads or records, such as names in a document, faces in a recording or a voice that is not the creator's own

For that data, the creator is the controller. We use it only to provide CourseSmith to the creator and on the creator's instructions. The terms for this work are in our Data Processing Addendum (coursesmith.ai/legal/dpa), which is part of our Terms of Service. Creators are responsible for:

• giving their learners, reviewers and anyone shown in their content a privacy notice
• having a lawful basis for using CourseSmith with that data
• getting consent where the law requires it

One limit matters here. The providers in section 11.2 are not our sub-processors. They handle content under their own terms, and some may use it for their own purposes. If you are a creator, do not send other people's personal data through the features that use those providers unless the people concerned have agreed to it.

If you are a learner or a reviewer, start with the creator who shared the link with you. You can also write to us, and we will pass your request to the creator.

This policy does not cover other companies' services that you reach through CourseSmith, such as the Stripe checkout or a HeyGen account you connect. Their own policies apply.

3. What we collect

This section is also our notice at collection under California law. It lists what we collect, where it comes from and why.

We never see or store payment card details (section 8). We do not ask for your date of birth, government ID numbers or precise location.

What you must give us. To create an account you must give an email address and a password, or sign in with Google. We cannot provide CourseSmith without them. Everything else, such as your full name, brand kit, voice samples or recordings, is optional. If you leave something out, only the feature that needs it is unavailable. No law requires you to give us personal data.

Please do not upload sensitive information, such as health details, about yourself or others. If a course genuinely needs it, upload it only when you are entitled to use it.

4. Voice samples, cloned voices and avatars

This section is our written policy for voice and likeness data. It explains why we collect it, who handles it, and when we destroy it.

What it is. On paid plans you can clone a voice. You record or upload 1 to 3 short clips, and we create a synthetic voice to narrate your videos. Where we have switched the feature on, you can also enroll a photo or short video to make a presenter avatar.

Whose voice or face you may use. CourseSmith accounts are for adults. You may clone only:

• your own voice, or
• the voice of an adult who has given you written permission to clone it for this purpose.

Presenter avatars follow the same rule: use your own face and body, or those of an adult who has given you written permission. Never clone a child's voice or create an avatar of a child.

Some laws, including those of Illinois and Texas, require a written release from the person before their voice or face is collected. Get that release before you upload, keep it, and show it to us if we ask. Before you clone a voice or enroll an avatar, the app asks you to confirm whose voice or face it is, and we keep a record of that confirmation. When the voice or face is not yours, you are the controller of that person's data (section 2), and their permission must also cover what Fish Audio may do with it (below).

Why we use it. We use voice samples, voice models and avatar media only to produce narration in that voice or clips of that presenter, for your account. We do not use them to identify or verify anyone. We never sell, lease or trade them, and we make no other profit from them. We share them only with the providers that create and run the voice or avatar (section 11), or when the law requires it.

How voice cloning works.

• We keep voice samples in a private storage area that shareable links cannot reach.
• We send the samples to Fish Audio. Fish Audio transcribes them and builds a private voice model that only your account uses.
• When you narrate with that voice, we send the narration text to Fish Audio.
• Fish Audio's terms let it use content it processes to develop and improve its own models (section 10).
• Voices cloned before 29 April 2026 were created with Alibaba Cloud's Qwen voice service. That service is no longer connected to CourseSmith, but Alibaba Cloud may still hold the voice models created then.

When we destroy voice data.

• You delete a voice. We delete its samples and our record of it straight away. Two things are not yet removed automatically: the short preview clip, and the voice model held by Fish Audio. Email [email protected] and we will delete the preview and ask Fish Audio to delete the model. We will do the same, on request, for a voice created with Alibaba Cloud before 29 April 2026.
• Your account is erased. We delete all of your voice data and ask Fish Audio, and Alibaba Cloud for older voices, to delete your voice models (section 13.1).
• You stop using CourseSmith. At least once a year we review voices and delete those on accounts with no activity for three years, including asking the voice provider to delete the model.

Presenter avatars.

• You enroll a photo, and optionally a short video, of yourself.
• We store these files where our video providers can fetch them by a link that is hard to guess but does not expire.
• To make each clip, we send them with the narration audio to fal or RunPod.
• Deleting an avatar removes its files and our record of it.

HeyGen. You can connect your own HeyGen account.

• We store your HeyGen API key encrypted, and we show only its last four characters.
• To make a clip, we send HeyGen your avatar ID and a link to the narration audio. HeyGen charges your HeyGen account.
• HeyGen handles this data under your own agreement with HeyGen.
• Disconnecting HeyGen removes the key and your synced HeyGen avatars from CourseSmith.

5. Your uploads and generated content

Your content belongs to you. Our Terms of Service explain the rights you keep. This section explains how we handle the content.

Where it is stored. Our database runs on Railway in the United States. Files are stored in Amazon Web Services (AWS) S3 in the United States. The pictures and videos on our public website (tutorial videos, example lessons and previews) are stored with Cloudflare in North America.

Who can reach your files. Different files are protected in different ways:

• Uploaded documents and voice samples sit in private storage, reached through links that expire within an hour. Images we extract from your documents and web sources for your lessons are reached through links that last up to 7 days, and those links are saved in your lesson content.
• Support attachments sit in private storage and are also emailed to our support mailbox (Google Workspace), either attached directly or as download links that work for 7 days. They stay in that mailbox (section 13).
• Most other media is served through links that are hard to guess but do not expire and are not password protected. This includes narration audio, images, thumbnails, Studio recordings, Cutaway captures, avatar files and editor uploads.
• Finished videos made by our rendering service are stored in our rendering storage (AWS S3) at a public web address that is hard to guess. Anyone who has the address can watch the video. The scene media we copy into rendering storage to make the video is kept the same way.

Share links and video addresses with care. You can ask us at any time to remove a file you no longer want online.

AI processing. To make your course, we send the relevant parts of your content to the AI providers listed in section 11. For example:

• we extract the text of your documents and send it to a writing model
• we send images and screenshots to a vision model

YouTube sources. For a YouTube video you give us, our own service fetches the captions, and Google Gemini summarises them. If a video has no captions, we send its audio to Google Gemini to transcribe it. The result is saved in your library and reused if you add the same video again. Use only videos you have the right to build on.

Public code repositories. We analyse public GitHub repositories only. The analysis and a copy of the code are cached and may be reused when another user analyses the same public repository. Do not point us at a repository that contains personal data.

Jira and Confluence (Enterprise). You can connect your own Atlassian site.

• We store your site address, Atlassian email and API token encrypted, and we show only the token's last four characters. Disconnecting deletes the token and keeps the site address and email so you can reconnect; removing the connection deletes those too.
• When you choose an issue, an epic or a page, we read it with the account you connected: its text, comments, change history, child items, the issues and pages it links to (one step out) and its image attachments. We read nothing your account cannot see, and we never write to your workspace.
• What we read is saved in your library as a source for your lessons, and its text is sent to the AI providers in section 11.1 to write and check scripts. You choose whether people appear by name, by role, or anonymously in that source; we never store their email addresses.
• Only point us at work you have the right to use this way.

Websites. For a website address you give us, we visit the page, take screenshots and read its colours and fonts.

No marketing use. We do not use your content or videos in our marketing, showcase or examples without your permission.

Staff access. Authorised staff can see your projects and account records when they need to for one of these reasons:

• to give you support
• to investigate a problem or abuse
• to meet a legal duty

Our administrators can also take actions on an account for these same reasons.

6. Learners and reviewers

This section explains what we handle for creators when they share interactive lessons and review links. For this data, we act for the creator (section 2).

Interactive lessons (/learn links)

• No sign-up. A learner does not log in or give an email address, and we do not ask their age.
• Learner ID. The learner's browser makes a random learner ID and keeps it, with the learner's progress, in browser storage. We use the learner ID only to run the lesson: to save and restore progress, to keep one record per learner, and to keep the service secure. We do not use it to contact the learner, to build a profile, or for advertising.
• What we store. For each lesson link and each learner, we store the learner ID, an optional name, answers, scores and progress.
• The name field. The page invites a name so the creator can see progress. It is optional. A first name, a nickname or initials is enough. Learners should never enter a full name.
• Grading and reporting. Answers are graded in the learner's browser. The creator sees a table of learners with their names, progress and scores.
• IP addresses. We use the learner's IP address for a few minutes, to limit how many requests one device can send. Like every request to CourseSmith, lesson page requests may also appear in our server logs, which we keep for up to 90 days.
• Third-party services. Lesson pages load fonts from Google, so the learner's browser shares its IP address with Google (section 9). Lesson pages load no affiliate, advertising or analytics trackers.
• How long we keep it. When a creator deletes a course or revokes a link, the link stops working straight away, but the learner records behind it are not erased at that moment. We erase learner records when the creator asks us to, when the creator's account is erased, and in any case once a record has had no activity for 12 months. We run that clean-up at least every three months, so a record can last up to 15 months after the learner's last visit. A learner, or a parent, can ask us to erase a record sooner.

Review links (/review links)

• A commenter gives a name, which their browser remembers for next time, and writes comments tied to points in the video.
• We email the creator a notice that includes the commenter's name and comment.
• We use IP addresses for a few minutes for rate limits. They may also appear in our server logs, which we keep for up to 90 days.
• Comments are deleted when the creator deletes the video, or sooner on request.

What creators must do

• Tell your learners and reviewers how their data is used, and link to your own privacy notice.
• Have a lawful basis for sharing lessons and links, and get consent where the law requires it, especially for children (section 16).
• Pass on or answer requests from your learners and reviewers. We will help you.

7. The Cutaway browser extension

This section is our full privacy notice for Cutaway. Cutaway also has a short notice at coursesmith.ai/legal/cutaway-privacy.

When it is active. Cutaway works on pages you choose to record. It is active only while you are recording steps, or while you record a take on the Cutaway page or in the Studio recorder.

What it records while active:

• screenshots before and after each step
• the page address and title
• the name and role of each element you click, and nearby text
• the click position
• the Enter, Escape and Tab keys
• a cursor log, about 30 times a second: movement, clicks, scrolling, and when you are typing (but not which keys)
• when you record a take, a video of your screen and, if you turn it on, your microphone

What it hides. Cutaway does not store what you type into fields. Before taking a step screenshot, it hides:

• password fields
• fields that look like card numbers, bank account numbers, social security or passport numbers, or dates of birth

Screen videos are not masked. Hiding applies only to step screenshots. In a screen video, anything visible on screen appears in the recording, including text as you type it. Close or cover sensitive information before you record a take.

Where captures go.

• Captures are sent to our servers and storage.
• Screenshots and video frames go to Google Gemini, which writes the narration.
• Recording audio is transcribed by Fish Audio. If that fails, our own transcription software on RunPod servers does it instead. Fish Audio handles this audio under its own terms (section 11.2), so do not record other people speaking unless they have agreed to it.

Other details.

• The extension keeps its sign-in token, and any captures not yet uploaded, on your device.
• Captures are limited in length by plan: Cutaway is not part of the free plan, Creator allows up to 10 minutes per recording, and the Try pass, Pro and above up to 30 minutes.
• Deleting a capture removes its files. The remaining record (page addresses, titles, element labels, nearby text and the cursor log) stays until your account is erased or you ask us to remove it.

8. Payments

CourseSmith.AI, Inc. sells you your subscription or credit pack. Stripe is our payment processor. That means Stripe:

• runs the checkout page and the billing portal, and charges your card or other payment method
• stores your payment details, sends receipts and invoices on our behalf, calculates tax at checkout where we collect it, and handles disputes with the card networks

You enter your payment details on Stripe's checkout page, not on ours, so we never see or store your card number. Stripe uses your payment data as an independent controller under its own privacy policy at stripe.com/privacy. The checkout page shows CourseSmith.AI, Inc. as the company selling to you.

What we send Stripe: your email, your name and your CourseSmith account ID, so the checkout is filled in and the purchase is linked to your account.

What we receive from Stripe: your Stripe customer ID, subscription ID, checkout and invoice IDs, the plan or pack you bought, your subscription status, payment and renewal events, and the email address on the order. We use these to apply your plan and add your credits. We do not receive your card number.

Other details.

• "Manage subscription" opens Stripe's billing portal.
• If we cannot match a payment to an account, we record the payer's email in our logs so we can sort it out.
• We do not use affiliate tracking scripts.

9. Cookies and browser storage

We do not use advertising cookies. We use one third-party analytics tool, PostHog, and only after you agree in the banner the first time you visit. You can change your choice at any time with Cookie settings in the website footer. These are the cookies, browser storage and third-party scripts the app uses.

All of these are needed to run the service, except PostHog, which runs only if you allow analytics. You can block third-party scripts and cookies in your browser settings. The app will still work, apart from Sign in with Google. You can also clear CourseSmith's storage at any time by clearing your browser data for coursesmith.ai.

Error reporting. The app sends error reports only to our own servers (see section 3). Product analytics goes to PostHog only with your consent, and never from the pages your learners and reviewers use (interactive lessons and review links).

Do Not Track and Global Privacy Control. We do not track you across other sites for advertising, so a Do Not Track signal does not change what we do. If your browser sends a Global Privacy Control signal, we treat it as your instruction to opt out of the sale or sharing of your personal information, and as declining analytics: PostHog does not load unless you turn it on yourself in Cookie settings. We do not sell or share your personal information in the first place.

10. How we use information

We use personal data to:

• provide CourseSmith: generate scripts, storyboards, narration, images, animations and videos, render and store them, and deliver your shared links and API results
• run billing, credits and plan limits
• send service emails, such as script or render started, ready or failed, and new review comments. These emails are part of the service. We do not currently send marketing emails. If we start, we will ask for your consent where the law requires it, and every marketing email will have an unsubscribe link.
• answer support requests
• keep CourseSmith secure, enforce rate limits, and prevent fraud and abuse
• find and fix errors, and track how much we spend on AI providers
• with your consent, understand how CourseSmith is used, where people get stuck and which features help, so we can improve it (product analytics with PostHog)
• meet legal duties and enforce our Terms

We never sell your personal information. We do not show ads or build advertising profiles. We do not use your content, voice samples, recordings, videos or learner data to train AI models.

AI processing by our providers

To generate your content, we send relevant parts of it to AI providers. They process it to send results back to us. The help assistant (Smithy) answers most questions from answers we wrote; a question those do not cover is sent, with the relevant help text, to the same Google provider our other text features use. What else they may do with it depends on their terms. Some screens let you choose which AI model to use.

Providers that work for us under data processing terms and say they do not train on API content. Anthropic, Google Cloud (Vertex AI) and xAI each state in their business terms that they do not use content sent through their APIs to train their models without permission. xAI keeps requests for up to 30 days to check for abuse. Vercel AI Gateway passes some requests to TypeSafe AI, which also says it does not train on that content.

Providers whose terms let them use content to improve their services. These handle content under their own terms, not as our sub-processors (section 11.2):

• Fish Audio: voice cloning, premium and cloned-voice narration, and transcription of voice samples and Cutaway recording audio.
• Sarvam AI: Indian-language voices and translation. Sarvam says it keeps content for 30 days by default and uses it to improve its models unless the customer opts out.
• Google Gemini Developer API: some features call Google through the Gemini Developer API rather than Vertex AI. These include reading uploaded documents, adding and rewriting scenes, preparing storyboards for Studio, YouTube summaries and transcripts, AI video clips (Veo and Omni), music beds, and the chart analysis behind trading-subject lessons. Google's terms for this API let Google use prompts and responses from unpaid-tier projects to improve its products, and let people review them. Content from paid-tier projects is not used this way. Until all of these features run on Vertex AI or a confirmed paid-tier project, assume Google may use this content.
• Moonshot AI: Kimi models. Used only when a Kimi model is chosen for a task, either by you in a model picker or by us in our model settings.

Providers whose terms do not clearly say. These also handle content under their own terms:

• fal (AI video) and Pollinations (AI images) receive prompts written from your lesson, and AI-made images. They do not receive your uploaded files, except that fal receives avatar photos and narration audio when presenter avatars are on.
• Microsoft: standard narration voices use Microsoft's public online read-aloud speech service. The narration text goes to Microsoft. We use this service under Microsoft's general terms, not under a data processing agreement.
• mermaid.ink: a public service we use as a backup to draw diagrams when our own renderer fails. It receives diagram text written from your lesson.

Infrastructure only. RunPod rents us the computers that run our own transcription, audio clean-up and avatar software. RunPod does not use that content for itself.

How to limit what reaches these providers:

• choose a writing model other than Kimi
• skip voice cloning and premium voices to keep content away from Fish Audio
• record Cutaway takes without audio to keep audio away from Fish Audio
• skip Indian-language narration and translation to keep content away from Sarvam
• keep personal details out of lesson text that becomes image, video or diagram prompts

When you use a feature that runs on one of these providers, you are directing us to send the content to that provider.

11. Sharing and recipients

We share personal data only in these cases:

• Service providers. With the sub-processors in section 11.1, under data processing terms that limit how they use the data.
• Providers under their own terms. With the providers in section 11.2, when you use a feature that runs on them (section 10).
• Payments. With Stripe as our payment processor (section 8).
• Things you choose. With services you connect or send data to: HeyGen, the webhook addresses you set up, the people you give review or lesson links to, and anyone you send a file link or video address to.
• Creators. Learner and reviewer data goes to the creator whose lesson or video it relates to.
• Public sources you ask us to use. YouTube, GitHub and the websites you name. The public media libraries we search (NASA, Wikimedia Commons, Internet Archive) receive only search terms.
• Legal reasons. When the law requires it, or to protect people's rights and safety and to stop fraud or abuse.
• Business changes. In a merger, acquisition, financing or sale of assets. This policy would keep protecting your data, and we would tell you before your data becomes subject to a different policy.

11.1 Our sub-processors

These providers process personal data for us, on our instructions, under data processing terms.

11.2 Providers that handle content under their own terms

These providers are not our sub-processors. We use them under their published terms, and we do not have a data processing agreement with them. The last column shows whether their terms let them use content to improve their own services.

Your browser also contacts Google (Sign-In and Fonts) directly, as described in section 9, and Stripe when you open a checkout or the billing portal (section 8).

11.3 Changes to these lists

Before a new provider starts handling personal data, we update these tables and the date at the top of this policy. For personal data we process for creators, we notify account holders by email or in the app at least 30 days before a new sub-processor starts, or before a feature starts sending creators' data to a provider listed in section 11.2, and creators can object as set out in our Data Processing Addendum.

12. International transfers

We are based in the United States. Our main servers and file storage are in the United States. Some providers work in other countries, including India (Sarvam) and Singapore (Moonshot, and Alibaba Cloud for older voices). Some providers, including Fish Audio and Moonshot, do not say exactly where they process data, and some Google requests use a global endpoint without a fixed region. Your data may therefore be processed outside the country where you live.

Sub-processors (section 11.1). Where EU or UK law requires a safeguard for a transfer to these providers, we rely on the safeguard shown in the table:

• an adequacy decision, including the EU-US Data Privacy Framework where the provider is certified
• the European Commission's Standard Contractual Clauses
• the UK International Data Transfer Agreement or UK Addendum

To get a copy of the safeguard for a particular transfer, email [email protected].

Providers under their own terms (section 11.2). We have no data processing agreement with these providers, so no EU or UK transfer safeguard of the kinds above is in place for them. This includes Sarvam AI in India, which the European Commission has not found adequate, and Moonshot AI in Singapore. Data reaches these providers when you use the features that run on them (section 10). Users in the EU and UK can limit what reaches them with the steps in section 10.

India. For personal data covered by Indian law, we do not transfer data to any country the Government of India has restricted.

13. How long we keep data

We keep personal data only as long as we need it for the purposes in this policy, or as long as the law requires.

In some places, deleting an item in the app only hides it. In those cases, we remove the underlying record when your account is erased, or sooner if you ask.

13.1 Erasing your account

Yourself, in the app. Go to Settings → Data & privacy → Delete your account. We email you a confirmation link, valid for 1 hour. When you open it and confirm, your account closes straight away. Download anything you want to keep first.

When you confirm, we immediately:

• cancel any subscription you have
• delete your courses, lessons, scripts, storyboards, video projects, voices, avatars, characters, documents, codebase and YouTube analyses, saved animations, agent access tokens, and your help assistant questions, feedback, feature requests and refused messages from our database. Your review links and lesson links, with the comments and learner records behind them, go with your courses, so those links stop working for everyone.
• remove your name, email address, password, Google sign-in link and profile picture from your account record
• remove your name and email address from your analytics profile in PostHog

Then, within 30 days, our team finishes the erasure:

• deletes your files from our storage and from rendering storage: uploads, voice samples, recordings, captures, narration audio, generated media, avatar files and finished videos
• asks Fish Audio, and Alibaba Cloud for older voices, to delete your voice models
• deletes your analytics profile, with its events and session recordings, in PostHog
• deletes your AI request logs and job error records

We email you when your account is closed.

By email. You can also email [email protected] from the email address on your account. After you confirm, your account stays open for up to 30 days so you can download your work, or less if you ask. When we close it, we remove everything listed above within 30 days, together with your AI request logs and job error records, and we email you when the erasure is complete.

We keep only what the table above says survives erasure: billing and credit records without your name, AI usage records without the link to your account, support emails while we still need them, a waitlist entry unless you ask us to remove it, and copies in backups and logs until they expire.

14. Security

What we do to protect your data:

• Passwords are hashed with bcrypt and never stored in plain text.
• Sign-in tokens are signed and expire. Refresh tokens change every time they are used, and old ones are blocked.
• The refresh cookie is HTTP-only and limited to our site.
• Keys and link tokens. API keys and review-link tokens are stored only as one-way hashes. Lesson-link tokens are stored as a hash plus an encrypted copy, so you can copy your link again later. A new API key is shown to you only once.
• Encrypted secrets. HeyGen keys, webhook signing secrets and the encrypted copies of lesson-link tokens are protected with a key kept outside the database.
• Storage. Files in our AWS storage are encrypted at rest. Documents and voice samples are in private storage and reached through links that expire within an hour (images extracted from documents: up to 7 days). Most other media is served through links that are hard to guess, do not expire and are not password protected; they pass you to a storage link valid for one hour. Finished videos sit at public addresses that are hard to guess (section 5).
• Rate limits protect the review, lesson, support, waitlist, error-reporting and API endpoints, the help assistant and the boxes where you give instructions to AI. Those boxes also refuse attempts to change the AI's instructions or to obtain keys and other secrets.
• Payment messages from Stripe are checked against a signature before we act on them.
• Voice models are created as private at the voice provider.
• Cutaway hides sensitive fields before it takes step screenshots.
• Staff access to production systems is limited to authorised staff.
• Connections between your browser and CourseSmith use HTTPS.

No system is perfectly secure. Our media links and video addresses do not expire, so treat them like passwords. Your sign-in token is kept in your browser, so sign out on shared computers.

If a breach affects your personal data, we will tell you without undue delay, and we will notify regulators where the law requires. If a breach affects data we process for a creator, we will tell the creator without undue delay so they can meet their own duties.

15. Your rights

Rights for everyone

Wherever you live, you can ask us to:

• tell you what personal data we hold about you
• give you a copy of it
• correct it
• delete it

You can also withdraw any consent you have given us at any time. Deleting a cloned voice, for example, ends our use of that voice.

To get a copy of your data, go to Settings → Data & privacy → Download export. You get a JSON file with your account details, your courses and lessons, your scripts, your videos with their links, your credit history and your support requests. For anything it does not include, email us and we will send it in a common format. You can download your own videos and exports from the app at any time. To correct your data, edit it in the app (for example your name in Settings) or email us.

European Economic Area and United Kingdom

You have the rights of access, rectification, erasure, restriction and data portability. You can also ask us to explain how we have weighed our legitimate interests.

Your right to object. Where we rely on legitimate interests, you can object at any time, on grounds relating to your situation. We will stop unless our reasons for continuing clearly outweigh your interests, or we need the data for a legal claim. You can always object to direct marketing, and we will stop.

California and other US states

Categories of data. Over the past 12 months, CourseSmith collected personal information in the categories below. The last column names the kinds of recipient each category went to.

Some of these recipients are the providers in section 11.2. Content reaches them only when you use a feature that runs on them, which means you have directed us to send it there.

We do not create inferences or profiles about you.

Sale and sharing. We never sell your personal information. We do not share it for cross-context behavioural advertising. We have no actual knowledge of selling or sharing the personal information of anyone under 16. We use sensitive personal information only to provide the service.

Your rights. You can ask to know, delete or correct the personal information we have about you. California law also lets you stop a business from selling or sharing your information and limit how it uses sensitive information; we already do neither. Using any of these rights will not change the price, plan or service you get from us.

Authorised agents. An authorised agent can make a request for you with your signed permission.

Other US states. If you live in another US state with a privacy law, you can use the same process. If we refuse your request, you can appeal by replying to our decision. We will answer the appeal in the time your state's law sets. If we deny your appeal, we will tell you how to contact your state's Attorney General to complain.

India

Under the Digital Personal Data Protection Act, you can:

• get a summary of your personal data, how we process it, and who we have shared it with
• have your data corrected, completed, updated or erased
• withdraw consent
• nominate another person to act for you if you die or become unable to act
• have your grievances resolved

Our grievance officer is reachable at [email protected] (subject line "Grievance Officer"). We will respond within the period Indian law sets, and no later than 90 days. If you are not satisfied after we have answered, you can complain to the Data Protection Board of India through its online complaint system.

This policy is available in English. If you would like it in a language listed in the Eighth Schedule to the Constitution of India, email us and we will provide it.

How to make a request

Email [email protected] from the email address on your account.

• Checking it is you. We may ask you to confirm your identity, for example by replying from your account email or signing in. We ask only for what we need to confirm it.
• Learners and reviewers. We will usually involve the creator who shared the link. We may ask for details that only you would have, such as your learner ID or the name you used.
• Cost. Requests are free. We may refuse, or charge a reasonable fee for, requests that are clearly unfounded or excessive, where the law allows.

Response times:

• EU and UK: within one month. For complex requests we can extend by two more months, and we will tell you if we do.
• California: we confirm receipt within 10 business days and answer within 45 days. We can extend by 45 more days, and we will tell you if we do.
• India: within 90 days.

Complaints

You can always complain to us first at [email protected]. In the UK, we will acknowledge your complaint within 30 days and tell you the outcome without undue delay.

You can also go to a regulator:

• EU: the data protection authority in the country where you live or work, or where the issue happened
• UK: the Information Commissioner's Office (ico.org.uk)
• California: the California Privacy Protection Agency
• India: the Data Protection Board of India

16. Children

Accounts. CourseSmith accounts are only for adults aged 18 or over, and we do not knowingly let anyone younger create one. If we learn that someone under 18 has an account, we will close it and erase its data.

Learners in creators' lessons may be children. Creators can make lessons for young learners, including Kindergarten to Grade 5. When they share those lessons through /learn links, we handle the learners' data for the creator. If you share lessons with children, you are responsible for:

• getting the consent the law requires before children use your lesson links, such as verifiable parental consent, or a school's authorisation where the law allows it for purely educational use. This includes consent required in the United States for children under 13, in India for anyone under 18, and in other countries at their own ages.
• telling learners and parents how the lesson works and what is collected, including that lesson pages load fonts from Google (section 9)
• asking learners to use a first name, a nickname or initials, or no name, since the name field is optional
• never using a child's voice or likeness for cloning or avatars

What we do and do not do with learner data:

• We collect only what section 6 describes.
• We use the learner ID only to run the lesson (section 6).
• We do not use learner data for ads, behavioural tracking or profiling.
• We do not use learner data to train AI models.
• We do not share learner data except as this policy describes.
• We erase learner records as section 6 explains: on request, when the creator's account is erased, and after 12 months without activity.

If you are a parent. You can ask the creator, or us at [email protected], to see or delete your child's learner record, or to stop further collection.

If we learn that we hold a child's data without the consent the law requires, we will tell the creator and delete that data.

For learners, in simple words

• You do not need an account to watch a lesson.
• Your browser remembers where you got to, so you can carry on later.
• Your teacher can see your answers and your score.
• You do not have to type your name. If you do, use just your first name or a nickname.
• If you want your answers deleted, ask your teacher or a parent to email us.

17. Automated decision-making

We do not make decisions about you, based only on automated processing, that have legal or similarly significant effects.

Our software does make some automatic choices:

• choices about content, such as which scene style, AI model or stock clip to use
• applying plan limits and credit balances

Interactive lesson answers are graded automatically in the learner's browser, and the scores are shown to the creator. The creator decides what, if anything, to do with the scores. Creators should not rely on them alone for decisions about a learner.

18. Changes to this policy

When this policy changes, the new version goes up on this page with a new date at the top. Where a change significantly alters the way your personal data is used, you will hear about it by email or in the app before it applies. Where the law requires your consent for a change, we will ask for it. Earlier versions are available on request.

19. Contact us

• Privacy questions and requests: [email protected]
• General support: [email protected]
• Company: CourseSmith.AI, Inc., a Delaware corporation, United States
• Postal address: 1177 Chantry Place, Lake Mary, FL 32746, United States
• Grievance officer for India: [email protected]

If you are a learner or a reviewer, please contact the creator who shared the link with you first. We will help where we can.