Privacy Policy

1. Who is responsible

The controller of your personal data is Denis Brevdo, individual entrepreneur, Tbilisi, Georgia. Contact for anything related to privacy: support [at] coolpan.com.

2. What data we process

• Account data: a unique account identifier, your email address and password are handled by our sign-in provider (Amazon Cognito); we store the identifier, the display name you choose, your role (learner, teacher, author), languages, time zone and interface preferences.
• Learning data: notebooks, words, texts, lessons, homework, your answers and results, review (spaced repetition) progress and notifications.
• Teacher–student data: when a teacher adds a student, the student name the teacher types, the link between the accounts, lesson schedule, level and notes.
• Content you upload: images, page photos, documents and boards (including boards imported from Miro at your request).
• Live lessons: audio and video are transmitted in real time between the participants; we do not record them.
• Technical data: request logs (account identifier, time, page or API route, status) and load-balancer access logs (IP address, browser user agent, requested address).
• Usage analytics: which pages and features are used — counted without cookies or any identifier stored on your device (see section 7).

We do not ask for, and ask you not to upload, special categories of data (health, religion, etc.).

3. Why we process it and on what legal basis

• To provide the service you signed up for — your account, materials, lessons, homework, exercises, AI features (GDPR Art. 6(1)(b), performance of a contract).
• To keep the service secure and working — logs, abuse prevention, error analysis (Art. 6(1)(f), our legitimate interest in a secure, working service).
• To understand and improve the product with usage analytics and — for teachers only — session recordings with all text and input masked (Art. 6(1)(f), our legitimate interest in improving the service; you can object at any time by writing to support [at] coolpan.com).
• To meet legal obligations, e.g. answering a data-protection request (Art. 6(1)(c)).

4. Who receives the data (processors)

We use the following service providers, bound by data-processing agreements, only to run CoolPan:

• Amazon Web Services (sign-in, hosting, database, file storage, logs) — data stored in the EU (Paris, eu-west-3).
• OpenAI — generates texts, exercises, explanations and images, and reads uploaded pages and images to turn them into materials. It receives the text, words or images involved, not your email.
• Google Cloud — speech synthesis (text-to-speech), translation and image object detection for the text or image involved.
• PostHog (EU servers) — product analytics without cookies; session recordings of teachers’ screens only, with all text and input masked (no students’ names, texts or answers).
• Cloudflare (Turnstile) — the bot check on sign-up, password reset and repeated sign-in attempts. It receives technical data of your browser and your IP address, not your email.
• LiveKit — real-time audio and video transport for live lessons.
• Miro — only if you choose to import a board; we read that board once and do not keep your Miro access.

Speech input in exercises uses your browser's built-in speech recognition; depending on the browser, the browser vendor (for example Google in Chrome) processes the audio. CoolPan does not record or store it.

We do not sell personal data and do not use it for advertising.

5. Transfers outside the EU

Some providers (OpenAI, Google, LiveKit, Miro, Cloudflare) may process data in the United States. Such transfers rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses.

6. How long we keep it

• Account and learning data: as long as your account exists. After a deletion request we delete it within 30 days; copies in backups expire with the backup cycle.
• When a teacher and a student unlink, materials are handed over to the student as described in the Terms; each side keeps their own copy.
• Request and access logs: up to 90 days.
• Analytics data: up to 12 months.

7. Cookies and analytics

We use only strictly necessary cookies and storage — to sign you in and remember your settings. Analytics runs without cookies and stores nothing on your device, so there is no cookie banner. Details: see the Cookie Policy.

8. Children

CoolPan is used for language lessons, including by school-age learners. If you are under 16, use CoolPan only with the permission of a parent or guardian, or through a teacher who has that permission. Parents may exercise the rights below on behalf of their child.

9. Your rights

You have the right to access your data, to have it corrected or deleted, to restrict or object to processing, to data portability and to withdraw consent at any time (withdrawal does not affect processing before it). To use any of these rights, email support [at] coolpan.com from the address you sign in with; we answer within one month.

You may also lodge a complaint with a data-protection supervisory authority, in particular in the EU country where you live or work.

10. Deleting your account

Email support [at] coolpan.com from the address you sign in with and ask to delete your account. We confirm the request and delete your account and its data within 30 days. If you are a teacher, the materials you gave your students stay with them as their own copies.

11. Automated decisions

We do not make decisions with legal or similarly significant effects about you solely by automated means. Exercise checking and review scheduling are learning aids, not such decisions.

12. Changes

We may update this policy. The date at the top shows the current version; for significant changes we will notify you in the app.