The data controller for the Saasworld service is [Company legal name], [Registered address]. Privacy questions and requests: [privacy email]. If we appoint a data protection officer, their contact will appear here.

This policy is written to meet the GDPR / UK GDPR because our database lives in the EU and many of our learners do too. It applies to everyone who uses the Service, wherever they are.

We collect what the product needs to work and very little else. There is no third-party advertising or tracking on the site.

Signed out, we keep almost nothing: a cookie that marks the one free task as used, a random anonymous id in your browser for analytics, and your progress in your browser's localStorage (which we don't see until you sign up and it's merged into your account).

• Contract (GDPR art. 6(1)(b)) — the processing needed to give you the Service you signed up for: account, progress, grading, purchases.
• Legitimate interest (art. 6(1)(f)) — product analytics in our own database, security logs, course feedback, and one lapse email per 14 days with a one-click unsubscribe. We've balanced these against your interests; none involves profiling with legal effects, and you can object at any time.
• Legal obligation (art. 6(1)(c)) — keeping billing records for as long as tax and bookkeeping law requires.
• Consent (art. 6(1)(a)) — not currently relied on for anything; if we ever add non-essential cookies or marketing email, we'll ask first.

When you submit a written answer to an explain-task or ask the tutor a question, the text you typed — together with the task, the lesson excerpt and a rubric — is sent to Anthropic's Claude API, which returns a score, feedback, or a hint. We do not send your name, email or user id with it. Anthropic processes API inputs to provide the service and, per its usage policies, does not use them to train its models; retention is limited to what its API terms state.

Practical advice: keep answers about the task. Don't paste personal data, secrets or confidential material into them. The grade is automated and used only inside the Service (XP, progress); a person will review any grade you dispute — write to [support email].

We don't sell personal data and we don't share it with advertisers. These companies process it on our behalf, under data-processing agreements, only to provide the Service:

We may also disclose data if the law requires it, to protect the Service or its users from abuse, or as part of a merger or sale — in which case this policy continues to apply and we'll tell you.

We use only strictly necessary cookies and local storage — no advertising or third-party analytics cookies — so we don't show a cookie banner. In short:

• Supabase auth cookies (sb-*-auth-token) — keep you signed in.
• gw_free — remembers which one task you tried while signed out.
• gw-theme, groundwork.progress.v6, groundwork.merged.v1, groundwork.anon.v1 — localStorage: theme, signed-out progress, whether that progress was merged, and the anonymous analytics id.

The full table with durations is in the Cookie policy.

Your account data is stored in the EU (Paris). Some processors — Vercel, Anthropic, Resend, Google — are in the United States and receive the limited data described above. Those transfers rely on the EU–US Data Privacy Framework where the processor is certified and otherwise on the European Commission's Standard Contractual Clauses (and the UK Addendum), with supplementary measures where needed. Copies of the relevant clauses are available on request.

We keep account data for as long as you have an account. When you delete your account (email [support email] from your account address; a self-serve button is planned), we delete your profile, progress, answers, review items and onboarding answers within 30 days. Billing records are kept for the statutory bookkeeping period; analytics events are stripped of your user id; backups roll over within 30 days.

Accounts with no sign-in for 3 years may be deleted after we've emailed you a warning.

Under the GDPR (and similar laws elsewhere) you can ask us to:

• Access — get a copy of the personal data we hold about you;
• Rectify — fix anything wrong (name, email and settings you can change yourself in the app);
• Erase — delete your account and data;
• Restrict or object — including objecting to legitimate-interest processing such as analytics or the lapse email;
• Port — receive your data in a machine-readable format (JSON);
• Withdraw consent — where processing is based on it.

Write to [privacy email]. We answer within a month. You can also complain to your local supervisory authority — for the EU, the list is at edpb.europa.eu; in the UK, the ICO.

Data is encrypted in transit (TLS) and at rest by our database provider. Access to your rows in the database is enforced by row-level security policies, so even our own API cannot read another user's data with your session. Sign-in uses one-time email codes or Google OAuth; we don't store passwords. No system is perfect: if we learn of a breach affecting you we'll notify you and the regulator as the law requires.

The Service is for people aged 16 and over. We don't knowingly collect data from anyone younger; if you believe a child has created an account, tell us at [privacy email] and we'll delete it.

We'll update this policy when the Service changes — for instance when a payment processor is connected. Material changes are announced by email or in the app before they take effect. The date at the top is the current version.

[Company legal name], [Registered address]. Privacy: [privacy email]. General: [support email].