Privacy Policy

This Policy explains how the operator of the Lenitera platform (“Lenitera”, the “Service”, “we”, “us”) collects, uses, discloses, and protects personal data when people use our websites, accounts, public pages, video lessons, and other Service features.

For privacy questions and to exercise your rights, email info@lenitera.com. Current contact options are also available at /support.

This Policy applies only to Lenitera. Third-party websites, applications, and services linked from the Service or connected by a user are governed by their respective operators and policies.

For account-holder, website visitor, payer, support, security, and Service operations data, the operator of Lenitera generally determines the purposes and means of processing and acts as the data controller under applicable law.

When a tutor or organisation uploads or creates data about students, representatives, email recipients, or other people for its educational activities, that user generally determines the purpose and acts as controller, while Lenitera processes the data on its documented instructions as a processor. The user must provide required notices, establish an appropriate legal basis, and enter into any data-processing terms required by law.

If you are a student, representative, or another person whose data was added by a tutor, please contact that tutor first about the content of your learning record and their decisions. We will assist the controller with a valid request and will respond directly for processing where Lenitera acts as controller.

The data depends on your role, enabled features, and what users choose to provide. It may include:

• Account and profile: name, display name, email, password hash, external sign-in details, language, time zone, photo, specialisation, settings, and public-profile information
• Student and representative data: name, contact details, tutor relationship, representative details, age indicator, invitations, account, and activity history
• Learning and communications: schedule, attendance, programmes, groups, notes, homework, answers, tests, results, progress, messages, reports, whiteboards, and learning materials
• Public pages and booking: description, photographs, credentials, services, prices, reviews, availability, enquiries, selected times, and the applicant’s message
• Files and media: documents, images, audio, video, lesson recordings, transcripts, requested generated materials, and related metadata
• Payments and subscriptions: plan, subscription status and period, amount, currency, payment and tax identifiers, country, and limited transaction details; complete card details are processed by the payment provider
• Support and feedback: request content, attachments, preferred contact channel, and correspondence history
• Technical data: IP address, session and device identifiers, browser, operating system, language, approximate IP-based location, request timestamps, diagnostic events, security logs, and feature usage

Do not upload special-category data (such as health, biometric, religious, or political information), government identifiers, or payment credentials unless this is strictly necessary, lawful, and expressly supported by the Service.

• Directly from you when you register, complete a profile, pay, contact support, or use Service features
• From a tutor, organisation, or other user who lawfully adds you to the Service, invites you to a lesson, or sends materials
• Automatically from browsers, devices, servers, and security systems as the Service operates
• From sign-in, payment, calendar, video, and other providers you connect, within the permission you grant
• From public sources when reasonably necessary to protect rights, investigate abuse, or review public content

Depending on context and applicable law, we process data on the following bases:

• Contract and pre-contract steps: creating accounts, authentication, providing features, support, subscription administration, and carrying out user requests
• Legitimate interests: protecting accounts and infrastructure, preventing fraud and abuse, diagnostics, reliability, establishing or defending legal claims, and improving the Service after balancing users’ rights and interests
• Legal obligation: accounting and tax records, responses to authorised bodies, data-protection compliance, and retention of mandatory records
• Consent: optional cookies, marketing, recording, or other processing where consent is legally required; consent may be withdrawn for the future
• Controller instructions: processing learning records, contacts, files, and communications on behalf of a tutor or organisation

If required data is not provided, we may be unable to enter into or perform a contract or provide a requested feature. Optional fields may be left blank unless the interface states otherwise.

A video lesson transmits audio, video, whiteboard data, and technical metadata between participants and communications infrastructure providers. If a tutor enables recording, the Service may store participants’ image, voice, screen share, materials, and actions. Recording must not begin without required notice and a valid legal basis; the user organising the lesson is responsible for the decision to record and for obtaining required permissions.

At a user’s request, available features may send a recording to speech-recognition or AI providers to create a transcript, summary, assignment draft, or report. These outputs may contain errors and require human review. We do not use them to make decisions producing legal or similarly significant effects without separate notice and a valid legal basis.

A participant who objects to recording should tell the organiser before it begins or promptly after a recording notice appears. Depending on applicable law, the organiser must provide a lawful alternative or refrain from recording.

We use strictly necessary cookies and local storage for sign-in, security, language selection, settings, and core Service operation. Disabling them may make some features unavailable.

Optional analytics, diagnostic, or marketing tools, if enabled, are activated only on a lawful basis and, where required, after your choice. You can update settings through the mechanism offered in the Service or your browser. Individual cookie lifetimes vary and are shown in the relevant consent interface.

We do not sell personal data. To the extent necessary for the purposes above, data may be accessed by:

• Tutors, students, representatives, and organisation members according to roles, access settings, and user actions
• Visitors to a public page, but only for information the page owner chooses to publish
• Hosting, file-storage, backup, video, speech-recognition, and AI providers
• Email, authentication, support, security, monitoring, and analytics providers
• Payment, billing, tax, and professional advisers
• Competent authorities or other parties where disclosure is legally required or necessary to protect rights, safety, or investigate violations
• A buyer or successor in a reorganisation, financing, asset sale, or business transfer, subject to appropriate confidentiality safeguards and notice where required

Providers receive only the data needed for their task and must process it on agreed terms. Some recipients may act as independent controllers, such as a payment provider for mandatory verification and payment operations.

The Service and its providers may process data in the European Economic Area and other countries. For transfers outside a territory recognised as providing adequate protection, we use an applicable lawful mechanism, such as an adequacy decision, standard contractual clauses, supplementary safeguards, or a statutory derogation. You may request information about the applicable mechanism at info@lenitera.com.

We retain data no longer than necessary for the stated purposes. The period depends on the data type, account or contract duration, tutor settings and instructions, security needs, limitation periods, and mandatory accounting, tax, or other retention requirements.

• Account data and workspace content are generally kept while the account is active and the data is needed to provide the Service
• Learning data processed for a tutor is deleted or returned on the tutor’s lawful instruction and under the applicable data-processing terms
• Recordings, transcripts, and uploaded files remain until user deletion, an applicable expiry period, or discontinuation of the feature, unless longer retention is legally required
• Payment, tax, security, and dispute records may be retained longer for a mandatory or reasonably justified period
• After deletion from active systems, residual data may remain for a limited period in protected backups and logs until scheduled overwrite; during that period it is isolated from ordinary use

We may irreversibly anonymise data instead of deleting it. Account deletion does not require deletion of information we must or may retain for legal compliance, abuse prevention, dispute resolution, or defence of claims.

We use technical and organisational measures proportionate to risk, including access controls, credential protection, logging, backups, and safeguards for data in transit and at rest. No processing method can guarantee absolute security. Users must also protect credentials and devices and promptly report suspicious activity.

Depending on applicable law, you may request access to and a copy of your data, correction, deletion, restriction, portability, and object to processing based on legitimate interests or direct marketing. Where processing relies on consent, you may withdraw it for the future without affecting prior lawful processing.

To submit a request, email info@lenitera.com. We may request reasonable information to verify identity, authority, and locate the data. Rights are not absolute: law may permit or require us to refuse all or part of a request, for example to protect other people, legal claims, or mandatory retention. If a tutor controls the data, we may refer the request to them or handle it together.

You may also complain to the data-protection authority where you live or work or where an alleged infringement occurred. For processing connected with Poland, the authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO). We invite you to contact us first so we can try to resolve the matter, but this does not limit your right to complain.

We may send necessary service messages about accounts, security, lessons, payments, and material changes; opting out may not be possible while an account remains active. Optional marketing is sent only on a lawful basis, and you may opt out through the message or at info@lenitera.com. A tutor using the Service for their own campaigns or invitations is independently responsible for lawful recipients, content, and opt-out handling.

The Service may process a minor student’s data when it is lawfully provided by a tutor, organisation, the student, or a legal guardian. The account owner who adds a child or provides access generally determines the purposes of that educational processing and is responsible for an appropriate legal basis, an age-appropriate notice, required guardian involvement, data minimisation, access settings, and retention.

Where processing relies on consent and the Service is offered directly to a child, consent must be given or authorised by a legal guardian until the child reaches the age of independent digital consent under applicable law. We and the relevant controller may request proportionate evidence of age, identity, and guardian authority. A user’s statement of age or family relationship does not by itself guarantee lawful processing.

We do not use personal data we know relates to children for behavioural advertising. Recording, transcription, AI processing, and disclosure of a child’s data require a separate assessment and permissions from the organiser and guardian where required by law. A guardian may exercise the child’s applicable rights through the tutor or info@lenitera.com. If you believe a child’s data is processed without a proper basis or in a way that puts the child at risk, notify us; we may restrict access, request evidence, and delete or block data to the extent permitted by law.

We do not make solely automated decisions that produce legal or similarly significant effects on individuals. Automated checks may support security, abuse prevention, quota calculation, and learning tools; a significant decision must receive authorised human review where required by law.

We may update this Policy when the Service, providers, or legal requirements change. The current version and revision date are published here. We will give reasonable advance notice of material changes unless the law requires a faster change.

Questions, requests, and complaints about personal data: info@lenitera.com. Additional contact options: /support.