Privacy Policy

1. The Data Controller

The controller of personal data is:

• Company name: GALIAN SOFTWARE DEVELOPMENT SRL
• Tax ID (CUI): RO45988048
• Trade Register No.: J12/2051/2022
• Registered office: Str. Tulcea 6, Postal Code 400594, Cluj-Napoca, Cluj County, Romania
• General email: contact@courses-ai.com

1.1 Data Protection Contact Point

For any requests, questions or complaints related to the processing of personal data, or to exercise the rights provided for by the GDPR (access, rectification, erasure, portability, objection, restriction), Users may contact our dedicated data protection contact point:

• GDPR contact email: contact@courses-ai.com (subject: "GDPR")
• Postal address: GALIAN SOFTWARE DEVELOPMENT SRL — Str. Tulcea 6, Postal Code 400594, Cluj-Napoca, Cluj County, Romania (marked "Attn: Data Protection Officer")
• Response time: a maximum of 30 calendar days from receipt of the request (Art. 12(3) GDPR)

Note: Under Art. 37 GDPR, GALIAN SOFTWARE DEVELOPMENT SRL is not required to designate a Data Protection Officer (DPO) — we are not a public authority, we do not process personal data on a large scale as a core activity, and we do not process special categories of data or data relating to criminal convictions. Nevertheless, we have voluntarily established a dedicated contact point to ensure prompt and specialised responses to GDPR requests.

1.2 The Supervisory Authority

If you have not received a satisfactory response to your request, you have the right to lodge a complaint with the supervisory authority:

• The National Supervisory Authority for Personal Data Processing (ANSPDCP) — the Romanian data protection authority
• B-dul G-ral. Gheorghe Magheru nr. 28-30, Sector 1, Postal Code 010336, Bucharest
• Phone: +40.318.059.211 / +40.318.059.212
• Email: anspdcp@dataprotection.ro
• Web: www.dataprotection.ro

The processing of personal data is carried out in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation — GDPR) and Law no. 190/2018 on measures implementing the GDPR in Romania.

2. Categories of Personal Data Collected

2.1. Data provided directly by the User

• Identification data: first name, last name, email address.
• Authentication data: password (stored exclusively in encrypted/hashed form).
• Billing data: information required for issuing invoices (processed through Stripe).
• Voluntary feedback: answers to the satisfaction surveys displayed on the Platform (NPS recommendation score, CSAT satisfaction score and the associated optional comments). Completing these surveys is always voluntary and may be declined without any consequence.
• Questions and suggestions on the blog: when you voluntarily submit a question or a suggestion on a blog article, we collect the display name, the email address and the content of the message, together with the confirmation of your consent to publication and its date. Submission is always voluntary. After approval by a moderator, only the display name and the content of the message are published publicly on the article page; the email address is never published and is used exclusively for contacting you in connection with the message and for preventing abuse.

2.2. Data collected automatically

• Technical data: IP address, browser type, operating system, screen resolution.
• Usage data: pages visited, courses accessed, course progress, results in quizzes and skill assessments, time spent on the platform.
• Product events (first-party analytics): interactions within the Platform (for example: starting or completing a lesson, completing a course, completing the welcome guide, using search, starting a skill assessment). These events are collected and stored exclusively on our servers, without third-party analytics tools, and do not contain directly identifying data (name, email) in the event content.
• Cookies and similar technologies: in accordance with the Cookie Policy.

3. Purposes and Legal Bases of the Processing

3.1 Booking a call with our team

When you book a call on a cursuri-ai.ro/programare/… page, we use, at your request, to prepare and hold the meeting (Art. 6(1)(b) GDPR): your name, email address, company and phone number, if you give them; your answers to the page's questions (for example, how many people are in your team, your role, what you want to see); the addresses of the colleagues you choose to invite, at most five, used only for this meeting (invite them only if they know about it); the time you chose, any moves and cancellations, with the reason if you write one, and when you confirmed you are coming. We also keep your browser's time zone, to show you the right time, and where you arrived from: the campaign parameters of the link (utm), only the name of the site that sent you and only the landing page, without the rest of the address, so we know which channels bring calls (legitimate interest, Art. 6(1)(f) GDPR). The data reaches the person from the Cursuri AI team you talk to and their manager, in our CRM; the meeting is created in Google Calendar, with the Google Meet link, and the confirmation and reminders are emailed through Amazon SES, the AWS email service (section 5). A reminder may also come on WhatsApp, only if you separately ticked the consent to WhatsApp messages next to your phone number. We keep them together with your CRM record and delete them with it; you can ask for access to them or for their deletion at any time (section 7).

3.2 Calls to our phone number

When you call us on 0800 885 813, we use, to answer you and, if the call was missed or you called outside our hours, to call you back: the number you call from (unless it is withheld), the time and length of the call, whether someone answered and which colleague answered, and after the conversation its outcome and a short note by the colleague. The legal basis is Art. 6(1)(b) GDPR when you call us about your account, an order or a quote you ask for, and for other calls our legitimate interest in answering you (Art. 6(1)(f)). Calls are not recorded or transcribed. The call goes through Amazon Connect, the AWS phone system in the Frankfurt region (section 5), and appears in our CRM, where it is seen by the colleagues on the Cursuri AI team who answer the phone and their managers; if we already have a record of you or you ask us for a quote, the call is added to its history. Amazon Connect keeps the call data for 24 months, after which AWS deletes it; in the CRM, the call stays in the history of your record for as long as the record exists. You can ask at any time for access to this data or for its erasure (section 7).

4. Data Retention Periods

• Account data: for the lifetime of the account. After a deletion request, marketing communications stop immediately and the data is irreversibly anonymised after 30 days (grace period for cancelling the request); billing data is retained in accordance with the next point.
• Billing data: 5 years from 1 July of the year following the year in which they were drawn up, in accordance with art. 25 of the Romanian Accounting Law no. 82/1991, as amended by Law no. 36/2023, or a longer period where fiscal legislation so requires.
• Usage and progress data: for the lifetime of the account; anonymised upon account deletion.
• Product events (first-party analytics): for the lifetime of the account; upon account deletion, the link to the user is permanently removed and the data remains exclusively in anonymous, aggregated form.
• Voluntary feedback (NPS/CSAT): for the lifetime of the account; permanently deleted upon account deletion.
• Questions and suggestions on the blog: approved messages remain published for as long as the article is available or until the withdrawal of consent or a deletion request; rejected or unapproved messages are deleted within a maximum of 12 months. You may withdraw your consent or request the removal of your message at any time by writing to the contact address in Section 1.1.
• Log of emails sent: the metadata of every email sent by the Platform (recipient, email type, subject, date sent, delivery status and its events), including emails to people without an account, such as the customers and contact persons in our sales conversations (offer, confirmation code, pro forma invoice, booking) — 24 months from sending; the HTML content of the account's emails — 90 days, after which it is deleted automatically (for emails to people without an account, the content is not kept). Upon deletion of the account or of the data in our sales records, the recipient, subject, content and promotional codes in the log are anonymised (only aggregate figures remain). Details in section 7.1.
• Leads without an account (addresses left in the "send me the syllabus / the guide / new articles" forms and on the campaign pages with a material): if the address is not confirmed through the link in the verification email (double opt-in), it is deleted within 30 days; after unsubscribing, it is deleted within 12 months. Quote requests from companies are kept for the duration of the pre-contractual steps and, if no contract is concluded, for at most 12 months from the last exchange of messages.
• Technical data (logs): as a rule 30 days, a maximum of 12 months.
• Cookies: in accordance with the durations specified in the Cookie Policy.

4.bis The Affiliate Programme

The Platform runs its own affiliate programme (section 13.4 of the Terms and Conditions). The processing concerns two groups of people: the partners, and the people who reach the Platform through a partner's link.

4.bis.1 Partners' data

• Identification and contact data: name, email address and phone number;
• Billing data entered by the partner in Settings: the address (individuals) or the company name, tax ID (CUI), trade register number and address (companies);
• Payment data: IBAN, account holder name and bank;
• Invoices uploaded by companies for payout requests;
• The affiliate code and link, the custom name chosen for the link, the commissions calculated, the payout requests and the payments made.

Purposes and legal bases: managing the partner account, calculating and paying commissions and the related emails — Art. 6(1)(b) GDPR (performance of the affiliate contract); keeping the supporting documents for payments — Art. 6(1)(c) GDPR (accounting and tax obligations). Retention: for as long as the partner account exists; the supporting documents for payments, in line with section 4.

4.bis.2 What a partner learns about the people they refer

If you create an account after reaching the Platform through a partner's link (attribution is only possible if you accepted marketing cookies, see the Cookie Policy) or through the invitation of a company whose administrator is a partner, the partner sees in their account: your name, your partially hidden email address (for example, jo***@example.com), the date the account was created, whether you have made a payment and the commission due to them. They also receive an email with your name when you create your account and when your first payment generates a commission. For a gift or advertorial order paid through a partner's link, the partner sees the buyer's or the company's name and the commission.

The partner does not see your payment details, the courses you take or any other data in your account.

Legal basis: Art. 6(1)(f) GDPR — the legitimate interest of the Operator and of the partner in calculating and verifying, transparently, the commission due for a referral. You can object to this processing (Art. 21 GDPR) by writing to the contact address in section 1.

4.ter Data of a Gift Recipient

The Platform allows a month of access to be bought as a gift for another person (the Gift page). In this case the buyer provides us with the data of a third party, and the processing has the particular features below.

4.ter.1 Data processed about the recipient

• The recipient's name (optional; it appears on the gift card);
• The recipient's email address (required only if the buyer chooses direct delivery; it is missing when the buyer prefers to hand the code over in person);
• The personal message written by the buyer, if there is one;
• The gift code, its status and, after redemption, the account on which it was redeemed.

4.ter.2 Purposes and legal bases

• Delivering the gift to the recipient (the email with the card and the code) — Art. 6(1)(b) GDPR in relation to the buyer (performance of the contract concluded by the buyer) and Art. 6(1)(f) GDPR in relation to the recipient (the legitimate interest in receiving a product bought for them);
• Reminders about a code that has not been redeemed — Art. 6(1)(f) GDPR; they are strictly limited in number and stop when the code is redeemed or expires;
• Informing the buyer that the gift has been redeemed — Art. 6(1)(b) GDPR.

4.ter.3 What we do NOT do with the recipient's address

The recipient's email address is not added to any marketing list and does not trigger any commercial sequence. The emails they receive on the basis of the gift — the delivery of the code, the reminders about it, the notice that the access is ending — are transactional. The recipient receives commercial communications (including the invitation to continue after the gifted month) only if they create an account on the Platform and give their own consent, in accordance with section 7.1; without that consent, we send them no commercial message.

4.ter.4 The recipient's rights

• They may ignore the gift: no account is created for them and nothing further is processed;
• They may request the erasure of their data related to the gift by writing to contact@courses-ai.com; we erase the name, the address and the message, keeping only the code and the accounting record of the buyer's order;
• The recipient's data is kept for as long as the code can be redeemed, plus the accounting retention periods applicable to the buyer's order (section 4).

4.quater Access through an Educational Institution

An educational institution (for example, a university) may use the Platform in its teaching and give access to its teaching staff and students. If your account is linked to such an institution — through an invitation received by email or through the link or code of a subject — the rules below apply in addition to the rest of this policy. They are also shown to you, in short, on the join page, before you enter a subject, in a versioned information notice; when the notice changes, the application shows it to you again so that you can confirm you have read it.

4.quater.1 Who is responsible for the data

• The institution decides to use the Platform for its subjects and follows the progress of its students. For that monitoring it is the controller, and GALIAN SOFTWARE DEVELOPMENT SRL processes the data on its behalf, as a processor (Art. 28 GDPR), under the contract concluded with the institution. The legal basis of this processing is determined by the institution.
• For your account — its creation, sign-in, security, your conversations with the AI Virtual Professor, service emails and our legal obligations — we remain the controller, as for any User, on the basis of Art. 6(1)(b) GDPR (the Terms you accept when the account is created).

4.quater.2 Additional data processed

• your membership of the institution and your role (student, professor or administrator); for professors, the academic title shown to students;
• the subjects you are enrolled in, the date and route of enrolment (code, invitation or added by the professor), your group or series, if you or the professor fill it in, the version of the information notice shown to you and the moment you acknowledged it;
• the questions you send to the professor from lessons, and the professor's replies. If the professor asks for a suggested reply, the text of the question (with the earlier messages of the thread), the lesson title and its content, with passages from the subject's books, go to the AI provider (Anthropic, as for the Virtual AI Professor), without your name or email address; the suggestion is not sent to you: the professor reads, adapts and sends the reply under their own name;
• the assignments you submit in a subject (the text and the files), the moment of submission, the score and the professor's comments;
• your attempts at the online tests of the subject: when you started and finished them, what you answered and the score obtained;
• the grades entered by the professor in the gradebook of the subject, each with its session (regular, resit or grade improvement), and the final grade;
• for a grade component that ended before you enrolled, the decision of those who teach the subject: recognition (a grade carried over from your previous academic record, with their comment, which you see too) or exemption (the component does not count towards your grade, and the other components are weighted on the rest; the reason they note is seen only by those who teach), with the name of the person who decided and the moment of the decision;
• the appeals you file against a published grade: your text, the appealed grade, the moment of filing and the lead professor's answer (upheld, with the new grade, or rejected, with their reason);
• the attendance recorded by the professor at the meetings of the subject (lecture, seminar, laboratory);
• in the live room of a lecture: the attendance you record yourself with the code or the QR code shown by the professor on the screen goes into the attendance sheet of the meeting, as above, with the time you recorded it; so that one phone records the attendance of a single student per meeting, we keep a fingerprint of the phone (a random number from the UNIVERSITY_DEVICE cookie, without the model, phone number or location), and an attempt from a phone on which a classmate has already checked in is refused and shown to the professor, with both names; the fingerprint and the attempts are deleted together with the room, at most 30 days after the lecture; your answers to the quick questions put to the class are not graded, the professor sees only how many chose each option, and the answers are kept for at most 30 days after the lecture ends;
• any deadline extension the professor gives you for an assignment or a test, with the reason they note (seen only by those who teach the subject);
• the messages you write in the discussions of the subject;
• in-app notifications about what happened for you (a grade published, an assignment graded, a deadline extended, a reply to one of your messages or appeals, a new assignment or test, a changed deadline, a meeting moved or cancelled), kept for 90 days;
• if you turn on phone notifications (only at your request, from the bell or from your profile, and only with the permission given by your browser): for each device, the address given by the browser’s notification service, the keys with which the message is encrypted for it, the short name of the device (for example “iPhone · Safari”), the date it was turned on, the moment of the last notification received and the number of failed deliveries in a row;
• if you create your personal calendar link (from Calendar, so that your calendar app, for example Google Calendar, Apple Calendar or Outlook, reads your timetable on its own): we keep only a fingerprint of the link, not the link itself, the moment it was created and the moment it was last read. The link is shown only once. Anyone who has it sees through it, without signing in, your calendar from the application: for a student, the meetings of their group and the deadlines addressed to them, only what is published; for those who teach, those of their subjects, without drafts; for each, the title, the subject, the time and the place, without grades, without attendance and without the names of students. The calendar app you choose reads it from its own servers. You can replace it at any time with a new one (the old one stops working) or turn it off;
• the fact that you completed the evaluation of a subject, not what you answered: the answers are kept with no link to you;
• the email address to which a professor or an administrator of the institution sent you an invitation; the address is provided to us by the institution, and the invitation is valid for 14 days;
• if the institution organises its students by faculties, programmes and series: your row in the series list, as sent by the institution's registry (email address, name, group and, if the registry sends it, your student ID number, which the institution's administrator can correct), together with the study programme, year of study and academic year of the series; only the institution's administrator sees the list. Those who teach your subjects see the name of the series, in the subject header, and your student ID number next to your name (in the student list, in the gradebook, on the attendance sheet, on your record and in the files they download), and you see your student ID number in your profile, without being able to change it. The list does not enrol you in anything: based on it, the administrator may enrol you in the subjects of the year (if you already have a student account at the institution, with a confirmed email address) or send you invitations (also when your student account has an unconfirmed address; if you confirm your address while the invitations are valid, you join their subjects);
• if you teach a subject: the error reports you send to our team about a lesson of one of the institution's own courses (your text, the section of the lesson and the selected passage, if any, with your name, academic title and email address, the subject, the moment it was sent and the status of the report: new or resolved). They are seen by our team, in the platform administration and in the email it receives, to which it can reply at your address; the institution's administration log keeps only the fact that you sent a report (the lesson, the section, the subject), without its text;
• if you teach a subject and the institution uses the Library (the subject’s books, which the Virtual AI Professor, the AI patients, the exam question generator and the question generator for the professor’s bank use and quote, with their source): for each book you upload, your name as the person who uploaded it and declared the basis of the rights in it, the basis chosen, the time of the declaration and the version of its text. The book is kept in the institution’s private storage space, in the European Union; scanned pages are read by the AI provider (Anthropic, as for the Virtual AI Professor), without your name. Your searches in “Try a question” are not saved. The declaration data stay while the book is in the library; after it is removed we keep only a trace, without the book’s content (the title, the basis, who declared it and when, the time and reason of the removal), for as long as a rights holder can bring a claim, so that we can show on what basis we processed the book (our legitimate interest, Art. 6(1)(f) GDPR);
• if you teach a subject and the institution uses AI patients: what you give the clinical case generator (the diagnosis, the setting, the level, the objectives, the pitfalls and, if you choose, anonymised details from a real case) is sent to the AI provider (Anthropic, as for the Virtual AI Professor) to generate a case with a fictional patient, without your name or email address. Details from a real case are sent only at the first step of the generation and deleted after it (only the fact that you gave them is kept); a text with a national identification number (CNP), a phone number, an email address or a full calendar date is refused. Do not enter anything that could identify a real patient. The rest of what you gave the generator stays with the case, with the cost of the generation, for as long as the case exists, and is seen by those who teach the subject and by the institution’s administrators;
• the messages you send us with "Report a problem" from the account menu: your text, with your name and email address, the institution, your role in it, the version of the application, the browser and, if you choose to include it, the page you were on (without data about other students), plus the reference number and the status of the message. They are read by our team, in the platform administration and in the email it receives, to which it can reply at your address; the institution does not see them;
• if the institution uses AI patients (simulated clinical consultations) and your subject has cases: your consultations with the simulated patient — a fictional patient played by an AI model —, that is what you said to the patient and what they answered, the systems examined, the tests ordered and the results received, the interventions, the simulated time, your notes and the conclusion you submitted (diagnosis, differential diagnosis, reasoning and management), with the concordance and the comment given by the professor. Your questions to the patient (with the earlier lines of the consultation) are sent to the AI provider (Anthropic, as for the AI Virtual Professor) to generate the patient's answer; we do not send it your name or email address. The examination, the test results and the course of the illness come from the case written by its author, without AI. Do not enter data about real patients in a consultation. Consultations are deleted together with your enrolment in the subject;
• if the institution uses the clinical simulation: the results of your practice in Human Atlas (the anatomical identification tests, visible only to the member): for each test, its type and level, the systems chosen, the time, the duration and, for each question, the structure asked, whether you answered correctly, in how many tries and how long it took. The latest 300 tests are kept, until you delete them from the progress panel, leave the institution or delete your account;
• the administration log of the institution: who invited, enrolled, removed or suspended whom, and when.

On the page for joining with the link or code of a subject we ask for your email address in order to send you a confirmation link, valid for 48 hours. The address does not enter the records of the subject until you open the link and finish joining.

4.quater.3 What the professor sees and does not see

The professor of a subject sees, about the students enrolled in it and only for the courses of the subject:

• the name and email address, the group or series (if filled in), the student ID number (if the registry sent it), the date and route of enrolment;
• the lessons opened and completed, including progress made in those courses before joining;
• the time spent on each lesson, your quiz results (per lesson and their average) and the date of the last activity;
• the questions sent from the lessons of those courses;
• the assignments you submitted (the text and the files), your attempts at the online tests with their score, the grades in the gradebook (by session), recognitions and exemptions and your appeals against them, the attendance recorded at meetings and any deadline extensions you received;
• your consultations with the AI patients of the subject, in full (the dialogue with the simulated patient, the actions, the results and the conclusion), with how much of the case's key tests and history you covered. The concordance of the diagnosis is first set by a fixed rule of the case (it compares your diagnosis with the accepted wordings written by the case's author, with no AI) and the professor can change it; you see it, with their comment, once the true scenario is shown to you.

The same data is seen by those who teach the subject alongside its lead professor (for example, seminar or laboratory assistants). The score of an online test is calculated from the answer key written by the professor; grades and comments are given by the professor, not by an automated system.

The discussions of the subject are visible to everyone enrolled in it: the messages you write there appear, with your name, to your fellow students too, not only to those who teach. The evaluation of the subject by students is anonymous: the professor and the administrators of the institution see only aggregated results, and only from five answers upwards.

The files you submit are kept in a private storage space and checked automatically for malicious software before the professor can download them.

The professor can download this data as a file (a table or, for grades, the grade sheet to be signed, as a PDF). The administrators of the institution see the same data, for all its subjects. Our team has access to it only for technical support, security and the handling of notices about content.

Neither the professor nor the administrators of the institution see your conversations with the AI Virtual Professor, your notes, bookmarks and flashcards, your activity in courses outside the subject, or your account password.

4.quater.4 Emails

The emails related to this access — the invitation, the link confirming your address, the notice of a new question (to the professor) and of a reply (to the student), the announcements and the reminder that the professor of a subject can send you about it, the news that an assignment has been graded or that grades have been published, the reminder before the deadline of an assignment or a test, the news that a meeting of the subject was cancelled, or that it was moved less than 48 hours before it, the notice to the administrators of the institution that the access term is approaching and, after the institution is deleted from the platform, the message to its administrators stating what was deleted (in figures), how long the data remains in the backup copies and how they can delete their own account — are service emails (section 7.1). The invitation is sent to an address given by the institution, on the basis of its and our legitimate interest in delivering it (Art. 6(1)(f) GDPR); if you ignore it, no account is created for you. An account opened through an institution is not subscribed to commercial communications (these require your separate consent, as described in section 7.1), and the offers addressed to people without a subscription are not sent to members of an institution.

Phone notifications are sent only to the devices on which you turned them on, on the basis of your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time: on one device or everywhere, from the bell or from your profile, or from your browser settings. They briefly repeat the news in the bell, without grades and without the names of other students, and announce the live class of your group; between 22:00 and 07:00 (Romanian time) only the live class announcement is sent. The message passes through the notification service of your browser’s maker (for example Google, Apple, Mozilla or Microsoft), chosen by the browser, not by us, which may also operate outside the European Union; the content is end-to-end encrypted, so the service sees the device address, the time and the size of the message, not its text. The professor and the administrators of the institution do not see whether you turned notifications on.

4.quater.5 How long we keep the data and how you leave

• You can leave a subject at any time, from the application; the professor or an administrator of the institution can also remove you. From that moment the professor no longer sees your progress. Once you are in no subject, the link between your account and the institution is deleted; the account remains yours, under the conditions of section 4. If the institution has suspended your access, the link stays, with your enrolments, until you are reactivated or an administrator removes you from the institution; while you are suspended you receive no notifications (neither in the application nor on your phone) and your personal calendar link does not work, but the devices with notifications and the link are kept until then.
• The questions sent to the professor remain in the records of the subject until it or your account is deleted; we delete them earlier at your request.
• Submitted assignments, test attempts, grades (with their appeals, recognitions and exemptions) and attendance remain in the records of the subject until you are removed from it, or until it or your account is deleted. While you have such recorded work you cannot leave the subject on your own: the professor withdraws you, and deleting your account remains available to you at any time. A deleted file may remain for at most 30 days in the backup copies of the storage space.
• Invitations that were not accepted are deleted 90 days after they expired or were cancelled.
• Error reports about lessons are kept until your account, the lesson or the institution is deleted.
• Messages sent with "Report a problem" are deleted 12 months after the last exchange of messages, like those sent through the contact form (section 4). When your account is deleted, only the trace of the request remains (the reference number, the status and the timestamps), without your name, address and text.
• Your row in the list of a series remains until the institution's administrator removes you from the list (or replaces it with one without you), or until the series, its programme or its faculty is deleted. If your address does not lead to an account at the institution, the row is deleted automatically 60 days after the end of the academic year of the series (30 September); at the same time, your address is also removed from the result of the series enrolment, if it was refused there (for example, because it belongs to another institution).
• The data of a device with phone notifications is deleted when you turn notifications off on it or everywhere, when you sign out on that device, when the notification service tells us the address no longer exists (for example, after you blocked notifications in the browser), after 10 failed deliveries in a row, or when you leave the institution or delete your account.
• The personal calendar link (its fingerprint and the two moments) is deleted when you turn it off, when you leave the institution or when you delete your account; when you replace it with a new one, only the new one remains.
• When your account is deleted, your membership, enrolments, questions, invitations, error reports about lessons and rows in series lists are deleted (and your address is removed from those refused in a series enrolment), together with your submitted assignments, test attempts, grades, recognitions and exemptions, appeals and attendance; your messages in the discussions of the subjects stay in their thread without your name and without your text, and your name in the administration log (also after you have left the institution) and in the notifications received by others (for example, the news of a reply of yours in a discussion) is replaced with the mention “Cont șters” (account deleted). If you have not confirmed your email address, what concerns only the address (the invitations sent to it, its row in a series list, its refusals in a series enrolment and the log entries that mention it but were neither written by your account nor name it) is not deleted with the account, because it may belong to the owner of the address; invitations and rows without an account are deleted anyway at the terms above.
• When the collaboration with the institution ends, the data processed on its behalf is deleted or handed over to it, in accordance with the contract with the institution. For the handover, the institution's administrator can request from the application an archive with the institution's data, in several parts (the tables with the enrolments, grades, attendance and the other data above, with the materials and the submitted assignments; from the subject evaluation, only the combined results, as shown in the application, never who answered or what; the in-app and phone notifications, the personal calendar link, the answers to the quick questions in the live room and the fingerprints of the phones used to check in there are not included and are deleted without being handed over); only the person who requested it and our team, from the platform's administration, can download the archive. It can be downloaded for 7 days; it is deleted at the next daily clean-up, and the backup copy of the storage space is kept for at most 30 more days. The institution is deleted from the platform only after its access has been stopped; at that point all the data above is deleted and, together with the institution's own courses, so are your progress, quizzes, conversations with the AI Virtual Professor, notes, bookmarks, flashcards and usage data from the lessons of those courses. Your account remains, without the link to the institution, and any certificates of completion already issued remain in their authenticity register. The records of emails already sent (invitations, announcements, notifications) are kept as described in section 7.1.3.

4.quater.6 Your rights

You exercise the rights in section 7 by writing to us at contact@courses-ai.com or by contacting the institution. The export of your account data includes your membership, enrolments and questions, your work in the subjects, your rows in series lists (with your student ID number and the refusals of your address in a series enrolment, if any) the devices with phone notifications (without their encryption keys), the error reports about lessons you sent, the messages sent with "Report a problem", the rows of the administration log that concern you, the replies received to your questions, the personal calendar link (only the moment it was created and last read, without the link) and the results of your Human Atlas practice. What concerns only your email address (the invitations sent to it, its row in a series list, its refusals) is included in the export once you have confirmed your address. Requests that concern the processing carried out by the institution (for example, an objection to the professor following your progress) are forwarded to it, and the institution answers as the controller.

5. Recipients of the Data

Personal data may be transmitted to the following categories of recipients:

Until October 2026, emails were sent through Brevo (Sendinblue SAS, France); after the account is closed, the data kept by Brevo is deleted under the contract concluded with it.

We do not sell, rent or exchange Users' personal data with third parties for marketing purposes.

6. International Data Transfers

In the case of data transfers outside the European Economic Area (EEA), we ensure that appropriate safeguards are in place, including:

• Standard contractual clauses approved by the European Commission (Art. 46(2)(c) GDPR).
• Adequacy decisions of the European Commission, where available.

7. Rights of Data Subjects

In accordance with the GDPR, Users have the following rights:

• The right of access (Art. 15) — the right to obtain confirmation of the processing and a copy of the data.
• The right to rectification (Art. 16) — the right to correct inaccurate or incomplete data.
• The right to erasure ("the right to be forgotten") (Art. 17) — the right to request the deletion of the data, subject to certain legal exceptions.
• The right to restriction of processing (Art. 18) — the right to limit the processing in certain circumstances.
• The right to data portability (Art. 20) — the right to receive the data in a structured, commonly used and machine-readable format.
• The right to object (Art. 21) — the right to object to processing based on legitimate interest.
• The right not to be subject to an automated decision (Art. 22) — the right not to be subject to a decision based solely on automated processing.

To exercise these rights, the User may send a request to contact@courses-ai.com. We will respond within 30 days of receiving the request.

7.0 Processing through Artificial Intelligence Systems

The Platform uses artificial intelligence ("AI") systems to provide the Virtual AI Professor feature (text chat, synthetic voice, summaries, adaptive quizzes). These systems process:

• The content of your requests (text questions or transcribed audio, together with the earlier messages of the same conversation) — for the purpose of generating an answer relevant to the accessed lesson.
• The lesson context (title, educational content) — so that the AI answers based on the exact content of the course.
• Passages from the subject’s bibliography, only in the lessons of an educational institution’s own courses, where the institution uses the Library (section 4.quater.2): your question (with the previous one, if it is a short follow-up, and with the lesson title) is turned into a search vector by Amazon Web Services (Amazon Bedrock, in the European Union), which we use to search the subject’s books; the passages found reach the AI provider together with your question, and the answer quotes them, with their source. The search is not saved separately: only the conversation remains, with the sources quoted (section 7.0.1). A temporary cache, not linked to your account, keeps the question’s vector for at most 7 days and the search result for at most 24 hours, so that a repeated question is answered faster.
• A summary of your progress, with every message sent to the Virtual AI Professor: how many of the course's lessons you have completed, whether you have already finished the current lesson, your approximate average quiz score in the course and the titles of at most five lessons where you scored below 70% in your last ten quiz attempts (in any course). For an adaptive quiz generated on the spot, only these titles are sent. The purpose: an answer suited to your level, which discreetly returns to the lessons that are harder for you.
• Internal identifiers (the user's ID, the lesson's ID) — for accounting for usage and preventing abuse (fair use). They stay with us.

To the AI providers (section 7.0.2) we send only the content described above; we do not send them your name, your email address or your user ID.

7.0.1 Storage of Conversations in Our Database

In order to give you access to the history of your conversations with the Virtual AI Professor and for the continuity of your learning experience, we store the conversations (questions + answers) in our database on our servers in the European Union. Conversations are associated with your account and the lesson in which they were initiated.

• What we store: your text questions, the AI-generated answers, the lesson ID, the time of the conversation, the number of messages exchanged.
• What we do NOT store in our database: raw audio recordings (they are processed in real time and deleted immediately after transcription), voice biometric data.
• Legal basis: performance of the contract (Art. 6(1)(b) GDPR) — access to the conversation history is part of the Virtual AI Professor service included in the subscription.
• Storage duration: conversations remain stored for the lifetime of your account, with one exception: those from the lessons of an educational institution's own courses are deleted together with the institution (section 4.quater.5). Upon account deletion (section 7 — The right to erasure), conversations are permanently removed from our database within a maximum of 30 days.
• Access to your conversations: only you (from your account) and our technical staff strictly necessary for troubleshooting (under a confidentiality clause). They are not visible to other users.
• Selective deletion: you can delete an individual conversation at any time from the Virtual AI Professor interface, without affecting your account.

This storage is distinct from the processing at the AI providers (Anthropic / OpenAI) described below. The processing at the providers is ephemeral (a maximum of 30 days at the provider); the storage with us lasts for the lifetime of the account, in order to give you access to the history.

7.0.2 AI Providers and International Transfers

AI providers used: artificial intelligence models provided by Anthropic (USA, text models) and OpenAI (USA, synthetic voice and transcription); for searching an educational institution’s books, models run by Amazon Web Services (Amazon Bedrock, in the EU), where the model providers have no access to the requests. Data transfers outside the EEA are covered by standard contractual clauses approved by the European Commission (Art. 46(2)(c) GDPR).

Your content is NOT used for training the models. We have DPA agreements with the providers that exclude use for training. Conversational content is automatically deleted at the provider within a maximum of 30 days.

7.0.3 Logging of AI Operations (Audit Trail)

We keep a technical log ("audit log") of each AI operation performed on the platform, in line with the transparency principles of Regulation (EU) 2024/1689 (the AI Act, Art. 50). It contains metadata only — it does NOT contain the text of the questions or of the answers:

• The type of operation (chat, summary, quiz, flashcards, voice, transcription)
• The identifier of the AI model used and its provider (Anthropic / OpenAI)
• The number of tokens consumed and the estimated cost
• The status (success / failure) and the duration of the operation
• The internal user ID and the lesson ID (without direct personal data)

Purpose: technical investigations, troubleshooting, monitoring of the cost and quality of the service, abuse prevention. Legal basis: the Operator's legitimate interest (Art. 6(1)(f) GDPR) — monitoring the cost, quality and security of the service. Retention period: 24 months from the date of the operation, after which the logs are automatically deleted.

7.0.4 AI Transparency (Art. 50 AI Act)

In accordance with Art. 50 of Regulation (EU) 2024/1689 (the AI Act), we explicitly inform you that you are interacting with an AI system, that the answers may contain errors, and that the audio played is a synthetic voice. See the Terms and Conditions, section 10.1, for full details.

7.1 Email Communications, Marketing and the Right to Unsubscribe

7.1.1 Service emails and marketing emails

The Platform sends two categories of emails, on different legal bases:

• Service emails — necessary for the performance of the contract (Art. 6(1)(b) GDPR): the order confirmation on a durable medium, successful or failed payments, cancellation or end of access, the issuing of the certificate of completion, progress in the courses you purchased, invitations and notifications within company accounts, the automatic acknowledgement of messages sent through the contact form, and legal notices (DSA, changes to the Terms). These cannot be switched off while the account is active, because without them we cannot perform the contract; they contain no offers and no unsubscribe links.
• Marketing emails — automated sequences (welcome, first-course nudges, abandoned checkout, re-engagement, win-back), one-off campaigns and offers. You can stop them at any time, with a single click (section 7.1.4).

7.1.2 Legal basis of marketing emails

• Consent (Art. 6(1)(a) and Art. 7 GDPR; art. 12(1) of Romanian Law no. 506/2004 on the processing of personal data and the protection of privacy in the electronic communications sector, transposing Art. 13 of Directive 2002/58/EC) — given through the optional, separate checkbox at registration or in the account settings. Without that checkbox we do not send commercial communications. Consent can be withdrawn at any time, without affecting the lawfulness of prior processing.
• Existing customers (art. 12(2) of Law no. 506/2004) — Users who have purchased a subscription may receive, at the email address obtained at the time of purchase, communications about similar products or services of Cursuri AI, with the possibility to object, simply and free of charge, both when the address is collected and in every message (unsubscribe link).
• Leads without an account — addresses left in the "send me the syllabus", "send me the guide" or "I want new articles" forms are used only after confirmation through the link in the verification email (double opt-in), on the basis of consent. On the campaign pages (cursuri-ai.ro/resurse/…, in Romanian), the text under the button says that you receive the page's material and the Cursuri AI newsletter (new articles, new courses and offers, at most twice a month); so does the "Newsletter" box under the Romanian blog articles, which sends you the three most recent articles right away, then at most three emails over the next two weeks and the newsletter, at most twice a month. You can unsubscribe at any time, from the link in every email. Quote requests from companies are processed as pre-contractual steps at the request of the person (Art. 6(1)(b) GDPR) and are not turned into a marketing subscription without a separate checkbox.

We send at most one marketing email per day to the same address, only on working days and Saturdays, between 09:00 and 19:00 (Romanian time).

7.1.3 Email log, delivery events and address suppression

For every email sent we keep a record (recipient, type, subject, date, delivery status, HTML content for 90 days) — the legal basis is the performance of the contract for service emails and our legitimate interest (Art. 6(1)(f) GDPR) in proving what we sent, troubleshooting delivery and meeting the accountability obligation (Art. 5(2)). The record also exists for emails sent to people without an account on the Platform, such as the customers and contact persons in our sales conversations (offer, confirmation code, pro forma invoice, booking) or the recipients of a gift; for these we do not keep the content of the email, only the metadata, for 24 months. The record is included in the export of your data and is anonymised when your account or your data in our sales records is deleted. Our email provider is Amazon Web Services, through the Amazon SES service (processor, Art. 28 GDPR, for all Platform emails, in the Frankfurt region). Amazon SES returns to us events about every email: delivered, rejected (bounce), blocked, reported as spam and, where the email client allows it, opened and link clicked. Unsubscribing through the email client's button reaches us directly (section 7.1.4). Emails may contain an open-tracking pixel; marketing emails may also contain links redirected through the Amazon SES tracking domain (an AWS domain, awstrack.me) to record clicks. In service emails (for example offers, confirmation codes, password resets) links are not redirected. These events help us measure whether the messages are useful, reduce their frequency and choose the hour at which we send you the newsletter: from the hours at which you opened or clicked our emails (and, if you have an account, went through lessons) in the last 180 days we work out an hour between 09:00 and 19:00 and keep it in your account or in the record of your address; without enough data, we use the hour at which most subscribers read. The hour is recalculated every night and never leaves that interval. The legal basis is legitimate interest (Art. 6(1)(f) GDPR); you may object at any time (Art. 21 GDPR), most simply by unsubscribing from marketing — after unsubscribing you receive no marketing emails, hence no tracking of them. Open and click data is aggregated into internal statistics and is not passed on to other third parties. The events from Amazon SES reach us through a message queue in the same AWS region, where they stay for at most 4 days until we process them; those that cannot be processed are kept for at most 14 days, for troubleshooting.

If an email is permanently rejected by the recipient's server (bounce), is blocked, or is marked as spam by the recipient, we suppress the address: we no longer send it marketing emails, and service emails resume only after you update the address in your account. An address that was permanently rejected or from which we received a spam complaint is also placed on the suppression list of our Amazon SES account, where it stays until we remove it; you can ask us to do so at the address in section 1.1. Suppression protects both the recipient and the reputation of our sending domain.

We keep proof of marketing consent — the source (registration, account settings, lead form), the version of the checkbox wording and the date — as well as the date and source of unsubscription, in order to demonstrate compliance with the record-keeping obligations (Art. 5(2) and Art. 7(1) GDPR).

7.1.4 Unsubscribing

You have the right to object at any time to the processing of your data for direct marketing purposes (Art. 21(2) GDPR). We process unsubscribe requests immediately through the following channels:

• A single click on the "Unsubscribe" link in the footer of every marketing email or on the "Unsubscribe" button of your email client (Gmail, Yahoo, Apple Mail, Outlook) — implemented in accordance with RFC 8058 (List-Unsubscribe / List-Unsubscribe-Post One-Click). No login and no further confirmation is required.
• The "Notifications" section in your account (at /app/profile) — toggle between receiving / not receiving marketing emails.
• Email to contact@courses-ai.com with the subject "Unsubscribe" — we process it manually within a maximum of 24 hours.

Unsubscribing from marketing does not affect the service emails described in 7.1.1. To completely stop receiving any emails, you must delete your account (Art. 17 GDPR; see section 7 — The right to erasure).

8. Data Security

We implement appropriate technical and organisational measures to protect personal data, including:

• Encryption of data in transit (HTTPS/TLS).
• Encryption of data at rest: the database, its backups and the private file storage space.
• Storage of passwords exclusively in hashed form (bcrypt).
• Role-based access control.
• A limit on simultaneous sessions per account: when it is exceeded, the oldest session is closed automatically.
• Access monitoring and activity logging.
• Regular security updates of software components.

9. Children's Data

The Platform is not intended for persons under the age of 16. We do not knowingly collect personal data of minors under this age. If we discover that we have collected such data, we will delete it immediately.

10. Changes to the Privacy Policy

We reserve the right to update this policy. Users will be notified by email and/or through an announcement on the Platform of significant changes. The date of the last update is displayed at the top of this page.

11. Complaints

If you consider that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with:

• The National Supervisory Authority for Personal Data Processing (ANSPDCP) — the Romanian data protection authority
• Address: B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, postal code 010336, Bucharest, Romania
• Website: dataprotection.ro
• Email: anspdcp@dataprotection.ro

12. Contact

For any questions regarding the processing of personal data:

• Email: contact@courses-ai.com
• Address: GALIAN SOFTWARE DEVELOPMENT SRL, Str. Tulcea 6, Postal Code 400594, Cluj-Napoca, Cluj County, Romania