Privacy Policy

1. Who is responsible for your data

Izidora Academy is operated by the company below, which is the data controller under the EU General Data Protection Regulation (GDPR). The course content is created by Izidora Weisseisen.

For any privacy question or request, write to support@izidoraempire.com.

2. What data we collect

• Account data. Your name, e-mail address and, if you sign in with Google or Apple, the basic profile those services share with us (name, e-mail address, profile picture, an account identifier). Passwords are handled by our authentication provider; we never see or store them. If you use Apple’s “Hide My Email”, we receive the relay address Apple creates for you instead of your real one. If you sign in with a one-time code, our authentication provider e-mails the code to the address you enter.
• Quiz answers. If you take the quiz for your personal business plan: the kind of work you do, your experience, where you work, your typical number of jobs, rate and inquiries (as ranges), what holds your business back, your goals, how you like to learn and, if you give it, your first name. Until you save your plan the answers stay in your browser only; when you save it they are stored with your account so that we can show you your plan.
• Purchase data. Payments are processed by Stripe. We receive confirmation of the payment, the amount and currency, your e-mail address and Stripe’s reference numbers. We do not receive or store your card number or bank details.
• Learning data. Which lessons you have completed and everything you type into the workbooks, checklists, calculators, quizzes and other exercises. These answers may contain information about your business. We store them only so that you can see and continue your own work.
• Technical data. Your IP address, browser type, the pages requested and the time of the request. Our hosting provider processes this to deliver the site and keep it secure.
• Device and access data. While you are signed in we record, for each device you use: a random device identifier stored in a cookie, the browser and operating system, the IP address, the approximate location derived from it by our hosting provider (country, region, city), the network provider, and the time and page of your visits, at most once every few minutes.
• Visit statistics. Which pages are viewed, how long they stay open, how far down they are scrolled and where on the page people click (positions only, never what you type), the referring website and campaign tags, the country and city (derived from your IP address by our hosting provider), the browser, operating system and screen size, and page loading speed. In the quiz it also records the screens you reach and the options you pick (never your name or e-mail address). This works without cookies or any other storage in your browser and is not linked to your account, name or e-mail address. To count visitors, a one-way code is calculated from your IP address and browser and changes every day; the IP address itself is discarded.
• Course usage statistics. While you are signed in, our server records what you do in the course: which lessons you open and complete, whether your exercise and part-check answers were right, when a workbook field has been filled in (never what you wrote), saving your quiz plan together with its main answers (kind of work, experience, goal, what holds your business back and the focus areas of your plan), starting checkout, your purchase, refund or certificate, and the country and city of the request. These records carry a pseudonymous code instead of your name, e-mail address or account id; only we can link the code back to your account.
• Messages. The content of e-mails you send us and our replies.

We do not buy data about you from third parties, we do not build advertising profiles and we do not sell personal data.

3. Why we use it and on what legal basis

• To create your account and deliver the course: including saving your progress and answers. Legal basis: performance of our contract with you (Article 6(1)(b) GDPR).
• To prepare and show your personal plan from your quiz answers, which you ask for when you take the quiz. Legal basis: steps at your request before a contract and performance of our contract with you (Article 6(1)(b) GDPR).
• To take payment, issue invoices and keep accounting records. Legal basis: performance of the contract and our legal obligations under tax and accounting law (Article 6(1)(b) and (c) GDPR).
• To keep the service secure and working: preventing abuse, investigating errors, protecting accounts. Legal basis: our legitimate interest in a secure and reliable service (Article 6(1)(f) GDPR).
• To protect accounts and the personal licence: limiting an account to three devices at a time, showing you your signed-in devices, and detecting accounts that are shared with other people or used by someone who obtained your password. A daily automated check compares devices, simultaneous use and locations; it never blocks anyone on its own; a person reviews the result and contacts you first. Legal basis: our legitimate interest in protecting accounts and our content (Article 6(1)(f) GDPR).
• To understand how the site is used and improve it: anonymous visit statistics as described above. Legal basis: our legitimate interest in running and improving the site (Article 6(1)(f) GDPR). You can object at any time, and content blockers or your browser’s “Do Not Track” setting also stop it.
• To see how students move through the course and make it better: pseudonymous course usage statistics as described above, for example which lessons or questions people get stuck on and where they stop. Legal basis: our legitimate interest in improving the course (Article 6(1)(f) GDPR). You can object at any time by writing to us, and we stop recording your account.
• To answer your questions and requests. Legal basis: performance of the contract or our legitimate interest in responding to you (Article 6(1)(b) and (f) GDPR).

We do not send marketing e-mails unless you have asked for them, and we do not make decisions about you by automated means.

4. Cookies

This site uses only cookies that are strictly necessary: a session cookie that keeps you signed in, a device cookie with a random identifier that recognises your browser for the device limit and account security, and short-lived cookies used during sign-in. They are not used for analytics or advertising, and our visit statistics use no cookies at all, so no cookie banner is shown. When you are sent to the sign-in page or to the payment page, those providers set their own necessary cookies on their own domains.

5. Who processes data on our behalf

We use a small number of service providers. Each receives only the data it needs for its task.

• Auth0 (Okta, Inc.): account creation, sign-in, password reset and e-mail verification. Our tenant is hosted in the European Union.
• Resend, Inc.: delivers the e-mails our authentication provider sends, such as your one-time sign-in code.
• Stripe Payments Europe, Ltd.: payment processing. Stripe is an independent controller for the payment data it needs to process your payment and prevent fraud.
• Cloudflare, Inc.: hosting of the site, the database that stores purchases, progress and answers, and network security.
• PostHog, Inc.: anonymous visit statistics and pseudonymous course usage statistics. Data is stored in PostHog’s EU region (Frankfurt, Germany).
• Google and Apple: only if you choose to sign in with your Google or Apple account. The site also loads its fonts from Google Fonts, which means your browser sends your IP address to Google when a page loads.
• Our e-mail provider: to receive and answer the messages you send us.

We may also disclose data where the law requires it, for example to tax authorities or courts.

6. Transfers outside the European Economic Area

Some of these providers are based in the United States or use sub-processors there. Where personal data is transferred outside the EEA, it is protected by the EU–US Data Privacy Framework where the provider is certified, or by the European Commission’s Standard Contractual Clauses. You can ask us for more information about these safeguards.

7. How long we keep it

• Account, learning data and saved quiz answers: for as long as you have an account. Taking the quiz again replaces the saved answers; answers that were never saved stay in your browser until you start over or clear it. If you ask us to delete your account, we erase it and your saved answers without undue delay and at the latest within one month.
• Purchase and invoice records: for as long as tax and accounting law requires, which in Slovenia is generally ten years.
• Technical logs: for a short period set by our hosting provider, unless needed longer to investigate a security incident.
• Device and access data: 90 days, then deleted automatically. The result of the daily sharing check is kept for one year, or longer if needed to handle a breach of the Terms of Use.
• Visit and course usage statistics: they contain no name, e-mail or IP address. PostHog keeps them for one year, or up to seven years if we move to a paid plan.
• E-mail correspondence: for as long as needed to handle your request and for up to two years afterwards.

8. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected;
• have your data erased, where we are not legally required to keep it;
• restrict or object to processing that is based on our legitimate interests;
• receive the data you gave us in a portable format;
• withdraw consent at any time, where processing is based on consent.

To use any of these rights, write to support@izidoraempire.com. We answer within one month. You also have the right to lodge a complaint with a supervisory authority (in Slovenia the Information Commissioner, Informacijski pooblaščenec, www.ip-rs.si), or with the authority in the country where you live.

9. Children

Izidora Academy is a professional course for working adults. It is not directed at children, and we do not knowingly collect data from anyone under 16.

10. Security

All traffic is encrypted in transit. Sign-in is handled by a specialized authentication provider, payments by a certified payment processor, and access to stored data is limited to what is needed to run the service. No system is perfectly secure; if a breach affects your data we will inform you and the authority as the law requires.

11. Changes to this policy

If we change how we handle personal data we will update this page and its date. If a change is significant we will tell you by e-mail or in the course before it takes effect.