Legal
Privacy Policy
Effective date: April 8, 2026 · Last updated: October 15, 2026
1. Introduction
RetenzAI ("we," "us," "our") operates FirstAIClass at firstaiclass.com. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our Service.
2. Information We Collect
2.1 Information You Provide
- Account information: name, email address, and password (managed via Supabase Auth).
- Profile and quiz information: learning preferences, selected modules, account role, readiness-quiz answers, and the email address you submit with a quiz. We save quiz responses and a starter plan even if you have not created an account. We may also create a contact record from the submitted email. A quiz submission does not create an account.
- Payment information: processed and stored by Stripe. We do not store credit card numbers on our servers.
- Gift and support information: gift recipient email, name and message; and the name, email, category and message you send through our contact form. Gift buyers and recipients are recorded in distinct roles.
- Content you submit: practice or community contributions and portfolio entries. Community submissions and portfolio entries you choose to publish may be visible to other people. Linked guardian accounts can see associated learner progress.
2.2 Information Collected Automatically
- Study progress: answers, quiz results, confidence ratings, response times, flashcard review history, review schedules, and progress estimates. These records support practice; they are not proof of professional competence.
- Operational data: request counts for abuse prevention, payment and subscription events, and limited error diagnostics used to investigate failures.
- Device and browser information: IP address, browser type, operating system, referral URLs.
3. How We Use Your Information
- Provide the Service: deliver lessons, save plans and learning history, process payments, manage access, and fulfill gifts.
- Personalize practice: use selected quiz answers to suggest starter activities and use review history to schedule spaced repetition. Rule-based starter plans do not require an AI provider.
- Communicate: send account notifications, subscription receipts, and product updates.
- Improve the Service: analyze usage patterns to improve content, features, and user experience.
- Prevent abuse: detect fraud, enforce Terms of Service, and maintain security.
4. Third-Party Services
These services process data for the features described below. Optional AI features send data to a model provider only when enabled and used.
| Provider | Purpose | Data Shared |
|---|---|---|
| Supabase | Authentication, database, storage | Account and profile data, quiz responses and saved plans, learning history, submitted content, and purchase, gift and access records |
| Stripe | Payment processing | Buyer email and account reference, payment and billing details, purchase and subscription records, gift delivery details, and applicable referral or campaign references |
| Resend | Account, gift and support email | Sender and recipient addresses and email content, including gift messages and contact-form submissions |
| Vercel | Hosting and edge functions | Request logs, IP addresses, performance data |
| Upstash | Request limits and abuse prevention | Request counts and quota identifiers based on account IDs, IP addresses, or keyed hashes of email and IP addresses, depending on the feature |
| Sentry | Error monitoring | Limited error types, application version and generated-code locations. Our diagnostic filter excludes form text, prompts, account details and page URLs from error reports; the service also receives network connection metadata. |
| SortieOps | Campaign attribution at eligible checkout | A campaign-link token and the confirmed buyer account email, after checking its bound payment account. Validated campaign references can be attached to Stripe purchase records. Gift recipients are not assigned buyer campaign credit. |
| Anthropic (optional) | AI-generated learning plans, when enabled | Selected quiz answers, learning-preference categories and course names. The plan prompt does not include your email address. |
| Configured practice AI service (optional) | Practice responses, when enabled | The prompt you submit and practice instructions. Use fictional or non-sensitive examples, not private information about yourself or other people. |
Optional AI services have their own data-handling terms. Do not assume submitted prompts have zero retention. Campaign attribution is not permission to send marketing email.
We do not sell your personal information to third parties.
5. Children's Privacy (COPPA)
FirstAIClass is designed for users aged 13 and older. We do not knowingly collect personal information from children under 13. If we learn that we have collected information from a child under 13, we will promptly delete that information. If you believe a child under 13 has provided us with personal information, please contact us at privacy@firstaiclass.com.
Optional usage counts
When optional usage measurement is available, it is off until you choose Allow counts. We count a small set of actions, such as opening a page, requesting a starter plan or clicking a checkout link. Counts use a broad page category and UTC day. They do not include your answers, email, account or browser identifier, full page address, or referring page. A click is not proof of a purchase or learning result.
We remember your choice on this browser for up to 90 days. Use Change measurement choice at the bottom of the page to turn counts off. We do not send past activity when you opt in. Turning counts off stops future collection; a request already received may still be counted, and an individual contribution cannot be separated from its total.
These optional counts are held in our Supabase database. The target retention is 90 UTC calendar days, with scheduled removal. Collection stops if the retention check is overdue. Hosting services still receive ordinary connection metadata; this is not a promise of anonymity. There is no Google Analytics or PostHog tracking script.
7. Data Retention
- Account data: retained for as long as your account is active.
- Study progress: retained for the lifetime of your account so you can resume learning if you resubscribe.
- Payment records: retained as required by law and Stripe's data retention policies (typically 7 years for tax and audit purposes).
- Existing analytics data: aggregated and anonymized after 24 months. The new optional daily counts described above have a separate 90-day retention target.
Upon account deletion, we will remove your personal data within 30 days, except where retention is required by law.
8. Your Rights
Depending on your jurisdiction, you may have the right to:
- Access the personal data we hold about you.
- Correct inaccurate or incomplete data.
- Delete your personal data ("right to be forgotten").
- Export your data in a portable format.
- Object to or restrict certain data processing.
- Withdraw consent where processing is based on consent.
To exercise any of these rights, email privacy@firstaiclass.com. We will respond within 30 days.
9. Data Security
We implement industry-standard security measures including encryption in transit (TLS), encrypted storage, access controls, and regular security reviews. However, no method of transmission or storage is 100% secure. We cannot guarantee absolute security of your data.
10. International Data Transfers
Your data may be processed in the United States and other countries where our service providers operate. By using FirstAIClass, you consent to the transfer of your data to these countries. We ensure appropriate safeguards are in place for any international data transfers.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes via email or an in-app notice. Continued use of the Service after changes constitutes acceptance of the updated policy.
12. Contact
Questions about this Privacy Policy? Contact us at privacy@firstaiclass.com.