Privacy Policy

1. Data Controller

The data controller responsible for personal data processed through Wall Street Uni under Article 4(7) GDPR is:

We are not required to designate a Data Protection Officer under Article 37 GDPR, but you may direct any GDPR enquiry to the address above.

2. Categories of Personal Data We Process

Account data

• First and last name, email address.
• Password (stored only as a bcrypt hash; we never see plaintext).
• Optional profile picture, exam level/year/window.
• Federated identifiers (Google / LinkedIn) if you choose social sign-in.

Learning data

• Quiz and mock-exam answers, scores, time spent, streaks, achievements.
• Topic preferences and content interactions.
• Conversations with the WSU AI study assistant.

Billing data

• Stripe customer id, subscription status, plan type, invoice metadata.
• Payment-card data is processed entirely by Stripe — we never store full PANs.

Technical and tracking data

• IP address, user-agent, device class, approximate location (country, region).
• Cookies and pixel identifiers — only when you grant the relevant consent.
• Server-side request logs (auto-deleted after 30 days).

3. Why We Process Your Data (Lawful Basis)

Under Article 6 GDPR, every processing activity has at least one of the following bases:

• Performance of a contract (Art. 6(1)(b)): running your account, delivering the courses you paid for, processing your subscription.
• Legitimate interests (Art. 6(1)(f)):platform security, abuse prevention, fraud detection, server logs, anonymous performance telemetry (Vercel Analytics & Speed Insights).
• Consent (Art. 6(1)(a)): analytics cookies (GA4, Microsoft Clarity) and marketing cookies (Google Ads, Microsoft Ads, LinkedIn Insight Tag) — collected via our consent banner and revocable at any time.
• Legal obligation (Art. 6(1)(c)): tax invoicing, accounting records, responding to lawful authority requests.

4. Recipients and Sub-Processors

We use the following processors. Each is bound by a GDPR-compliant data processing agreement (DPA) and processes data only on our documented instructions. Transfers outside the EEA rely on the EU Standard Contractual Clauses (SCCs) and, where applicable, the EU–US Data Privacy Framework.

A current list of sub-processors is maintained on this page. Material changes are announced at least 14 days in advance via email or in-app notice.

5. Retention Periods

• Account & learning data: kept while your account is active. On deletion request, erased or anonymised within 30 days.
• Billing & invoice records: retained for 10 years to satisfy Czech accounting law (Act No. 563/1991 Coll.).
• Server logs: 30 days.
• Analytics events (GA4): 14 months on Google's servers.
• Microsoft Clarity recordings: 13 months.
• Marketing cookies: per platform — typically 13 months from your last interaction.
• Backups: rolling 35-day window; data inside a backup is purged at the next rotation after erasure.

6. Your Rights Under GDPR

• Access (Art. 15): request a copy of the personal data we hold about you.
• Rectification (Art. 16): correct inaccurate data — most fields are self-serve in account settings.
• Erasure (Art. 17): "right to be forgotten" — delete your account and associated data.
• Restriction (Art. 18): ask us to suspend processing while a complaint is investigated.
• Portability (Art. 20): receive your data in a machine-readable format.
• Objection (Art. 21): object to processing based on legitimate interests or to direct marketing.
• Withdraw consent (Art. 7(3)): open the "Manage cookies" link in the footer to revoke analytics/marketing consent at any time.
• Lodge a complaint: with the Czech supervisory authority — Úřad pro ochranu osobních údajů (uoou.cz) — or your local EEA DPA.

To exercise any of these rights write to privacy@wallstreetuni.com. We respond within one month (extendable by two further months for complex requests, Art. 12(3) GDPR).

7. International Data Transfers

Some processors (Vercel, Microsoft Clarity, Google Ads, OpenAI, Anthropic, Pinecone, Stripe global network) are located in the United States. Transfers rely on one or more of:

• European Commission adequacy decisions (incl. the EU–US Data Privacy Framework).
• EU Standard Contractual Clauses (Decision 2021/914) supplemented by additional safeguards (encryption in transit, pseudonymisation, IP truncation).
• Your explicit consent for non-essential transfers (analytics, marketing cookies).

8. Security

• HTTPS/TLS 1.3 in transit; AES-256 encryption at rest on MongoDB Atlas and Vercel Blob.
• Passwords stored only as salted bcrypt hashes.
• Optional TOTP-based two-factor authentication.
• BotID verification on auth and lead forms (Vercel + Anthropic).
• Strict Content Security Policy, HSTS preload, frame-ancestors lock.
• Least-privilege access controls and audit logging on admin actions.

9. Cookies and Similar Technologies

We use a layered consent banner (Google Consent Mode v2 with deny-by-default signals) to control analytics and marketing cookies. The full cookie inventory is on the Cookie Policy page. You can change your choices at any time via "Manage cookies" in the footer.

10. Children

The platform is intended for users aged 16 and above. We do not knowingly collect data from children under 16. If you believe a child has registered, contact privacy@wallstreetuni.com and we will delete the account.

11. Changes to This Policy

Material changes are announced at least 14 days in advance via email or in-app notice. Continued use after the notice period constitutes acceptance.