Privacy Policy

We collect only what we need to operate the Service:

• Account information. Name and email address you provide during sign-up. If you sign in with Google or Apple, we receive your verified email and basic profile fields from that provider.
• Content you create. Lessons, assignments, quizzes, submissions, comments, and homepage configuration you upload or generate, including files, profile photos, and source documents you choose to upload.
• Usage and device data. Standard server logs (IP address, user agent, timestamps), feature interactions, and error reports needed to keep the Service stable and secure.
• Billing data. If you subscribe, our payment processor handles your card details. We store the subscription identifiers and plan metadata they return — not full card numbers.
• AI prompts, source text, outputs, and usage metadata. When you use AI drafting features we process the prompt, any pasted or extracted source text, generated output, model usage metadata, and credit cost. Generated output is stored when you save, publish, or otherwise keep it in the Service.
• Support information. If you contact support, we process the message you send and any account, plan, page, or space context you choose to include.

• To provide, maintain, and secure the Service.
• To respond to support requests and to communicate important updates.
• To process payments and manage subscriptions.
• To run AI requests you start, enforce AI credit limits, and prevent abuse of upload or AI workflows.
• To diagnose problems, prevent abuse, and improve product quality.
• To meet legal obligations, enforce our Terms, and protect users from harm.

We use a small set of trusted providers to run LearnExpand. They process data on our behalf under written agreements:

• Authentication providers — account sign-in, sessions, and identity.
• Payment processors — subscriptions and AI credit top-ups.
• Cloud infrastructure providers — hosting, logs, database, and object storage if file uploads are enabled.
• Email delivery, email-routing, and support providers — transactional emails, support messages, invitations, and account notifications.
• AI model providers — drafting features. Where contracts allow, we opt out of using your prompts to train provider models.

We can provide the current subprocessor list on request and will keep this policy updated when a provider category materially changes.

Our service providers may process and store information in countries other than where you live. When we use providers outside New Zealand, we take reasonable steps to use reputable providers and contractual or technical safeguards appropriate to the type of information being processed.

We do not sell your personal information or your content. We share data only with the providers above to run the Service, with people you have explicitly invited into your space, when you direct us to (for example via integrations), or when we are legally required to do so.

We keep account and content data for as long as your account is active. When you delete a space or your account, we remove or anonymize the associated data within a reasonable period (target: 30 days), except where we must retain records for legal, tax, or fraud-prevention reasons.

Server logs and security telemetry are kept for a shorter period (target: 90 days) and then rotated.

Temporary AI source-document files are deleted after text extraction. Extracted source text is retained only for the short source-document window shown in the product, then purged by maintenance jobs and read-time expiry checks. Backups and billing, audit, fraud-prevention, or legal records may be retained longer where necessary.

Depending on where you live you may have rights to:

• Access the data we hold about you.
• Correct inaccurate data.
• Delete your account and associated data.
• Export your content in a portable format.
• Object to or restrict certain processing.

You can exercise most of these rights from your account settings. For anything not covered there, contact us at the email below and we will respond within a reasonable time and within any timeframe required by applicable law.

LearnExpand may be used in classroom settings that include minors. When learners under 13 are involved, the operating teacher or institution is responsible for obtaining the consents required by their jurisdiction (for example COPPA in the United States or local equivalents). LearnExpand acts as a service provider to that teacher or institution and processes student data only as instructed.

We use industry-standard practices to protect your data: encryption in transit (HTTPS/TLS), encryption at rest where supported by our providers, scoped access controls, audit logging on sensitive operations, and regular dependency reviews.

No system is perfectly secure. If we become aware of a privacy or security incident that creates a legally notifiable risk, we will notify affected users and regulators where required by law.

We use essential cookies and local storage to keep you signed in, remember your preferences (such as the current space, view mode, interface locale, sidebar state, read-aloud settings, and whether you have seen released quiz feedback), and protect against fraud and abuse. Local storage may include a signed-in user profile snapshot and space-navigation preferences, but not full card numbers. We do not use third-party advertising cookies. If we add product analytics in the future, we will update this policy and offer a clear opt-out where required by law.

We may update this policy from time to time. When we make material changes we will update the “Last updated” date and notify you in-product or by email. Continued use of the Service after the change takes effect means you accept the updated policy.