Privacy Policy

Last Updated: January 11, 2026

Nastavnyk ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered learning and development platform ("Service").

1. Information We Collect

1.1 Information You Provide

We collect information you voluntarily provide, including:

• Account Information: Name, email address, password, profile picture, language preference, and timezone
• Professional Information: Job title, department, employment type, hire date, current position, and target career positions
• Learning Data: Skills you're developing, learning preferences, hours per week available for learning, preferred content types and perspectives
• Content You Submit: Job descriptions, comments, notes, feedback, and any other content you provide
• Communication Data: Messages with AI mentors, support requests, and feedback

1.2 Information Collected Automatically

When you use the Service, we automatically collect:

• Usage Data: Learning activity, resources viewed, assessment results, time spent learning, progress on learning paths
• Device Information: IP address, browser type, operating system, device identifiers
• Log Data: Access times, pages viewed, referring URLs, and actions taken on the Service
• Cookies and Tracking: Information collected through cookies, pixels, and similar technologies

1.3 Information from Third Parties

We may receive information from:

• Social login providers (Google) when you choose to authenticate with them
• Your employer or organization if you access the Service through a team account
• Payment processors (Stripe) for subscription management

2. How We Use Your Information

We use the collected information to:

2.1 Provide and Improve the Service

• Create and manage your account
• Generate personalized learning paths and recommendations
• Power AI mentorship features and conversations
• Conduct skill assessments and track your progress
• Process payments and manage subscriptions
• Analyze usage patterns to improve our Service

2.2 AI Processing

We use your data to power AI features, including:

• Generating personalized learning content and paths from job descriptions
• Providing AI mentor responses based on your questions and context
• Creating skill assessments and verification games
• Extracting skills and requirements from uploaded documents

Your conversations with AI mentors are stored to maintain context and improve the quality of responses. We do NOT use your personal data to train our AI models without your explicit consent.

2.3 Communications

• Send transactional emails (account verification, password resets)
• Provide learning reminders and progress updates
• Send weekly learning summaries and recommendations
• Communicate about Service updates and changes

2.4 Security and Compliance

• Detect and prevent fraud, abuse, and security incidents
• Comply with legal obligations
• Enforce our Terms of Service

3. How We Share Your Information

3.1 With Your Organization

If you access the Service through a team or organization account, your organization's administrators may have access to your learning progress, skill assessments, and activity within the team context. This may include:

• Learning path completion status
• Skill proficiency levels and verification status
• Time spent on learning activities
• Assessment scores and results

3.2 With Service Providers

We share data with third-party providers who help us operate the Service:

Provider	Purpose	Data Shared
OpenAI	AI content generation, mentorship	Prompts, conversation content
Anthropic	AI content generation, mentorship	Prompts, conversation content
Google	AI features, authentication	Prompts, OAuth tokens
Stripe	Payment processing	Payment details, billing info
AWS	Cloud hosting, storage	All Service data
Sentry	Error monitoring	Error logs, device info
Google Analytics	Usage analytics	Anonymized usage data

3.3 Legal Requirements

We may disclose your information if required by law, legal process, or government request, or to protect our rights, privacy, safety, or property.

3.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.

4. Data Retention

We retain your data as follows:

• Account Data: Retained while your account is active and for 30 days after deletion request
• Learning Progress: Retained while your account is active
• AI Conversations: Retained for up to 2 years to maintain context and improve service quality
• Assessment Results: Retained while your account is active
• Payment Records: Retained for 7 years for legal and tax compliance
• Log Data: Retained for up to 90 days

After the retention period, data is either deleted or anonymized for statistical analysis.

5. Your Rights and Choices

5.1 Access and Portability

You have the right to request a copy of your personal data in a machine-readable format.

5.2 Correction

You can update your account information through your profile settings or request corrections to inaccurate data.

5.3 Deletion

You can request deletion of your account and personal data. Some data may be retained for legal compliance or legitimate business purposes.

5.4 Restriction and Objection

You may request restriction of processing or object to certain data uses, including marketing communications.

5.5 Withdraw Consent

Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.

5.6 Communication Preferences

You can manage email preferences in your account settings or unsubscribe using links in our emails.

5.7 Exercising Your Rights

To exercise these rights, contact us at [email protected]. We will respond within 30 days.

6. Cookies and Tracking Technologies

We use cookies and similar technologies for:

• Essential Cookies: Required for authentication, security, and basic functionality
• Functional Cookies: Remember your preferences (language, theme)
• Analytics Cookies: Understand how users interact with the Service

You can control cookies through your browser settings. Disabling certain cookies may affect Service functionality.

7. Data Security

We implement appropriate technical and organizational measures to protect your data, including:

• Encryption of data in transit (TLS/SSL)
• Secure password hashing
• Access controls and authentication
• Regular security assessments
• Employee training on data protection

While we strive to protect your data, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

8. International Data Transfers

Your data may be transferred to and processed in countries other than your country of residence, including the United States. We ensure appropriate safeguards are in place for such transfers, including:

• Standard Contractual Clauses approved by the European Commission
• Data Processing Agreements with service providers
• Adequacy decisions where applicable

9. Children's Privacy

The Service is not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16. If you believe we have collected data from a child under 16, please contact us immediately at [email protected].

10. Regional Privacy Rights

10.1 European Economic Area (GDPR)

If you are in the EEA, you have additional rights under the General Data Protection Regulation (GDPR):

• Right to lodge a complaint with your local data protection authority
• Right to data portability
• Right to erasure ('right to be forgotten')
• Right to object to automated decision-making

Legal bases for processing include: contract performance, legitimate interests, legal obligations, and consent.

10.2 California (CCPA/CPRA)

California residents have the right to:

• Know what personal information is collected
• Know whether personal information is sold or disclosed and to whom
• Say no to the sale of personal information
• Access your personal information
• Request deletion of personal information
• Not be discriminated against for exercising these rights

We do not sell personal information as defined by the CCPA.

10.3 Other Jurisdictions

We comply with applicable privacy laws in all jurisdictions where we operate. Contact us for information about your specific rights.

11. Third-Party AI Providers

When you use AI-powered features, your data may be processed by third-party AI providers. Each provider has their own privacy practices:

• OpenAI: https://openai.com/policies/privacy-policy
• Anthropic: https://www.anthropic.com/privacy
• Google: https://policies.google.com/privacy

We use API services from these providers configured to minimize data retention. Data sent to AI providers is used to generate responses and is not used to train their general models, as per our agreements with these providers.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on the Service and, where appropriate, by email. Your continued use of the Service after changes become effective constitutes acceptance of the updated policy.

13. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at:

Email: [email protected]
Data Protection Inquiries: [email protected]