Privacy notice
Updated 30 October 2026. Littiset Oy is the controller. Contact details appear below.
Accounts, purchases and support
We use your email, verified account identity, sign-in/session information, payment references and status, accepted offer versions, course rights, progress and support messages to deliver and protect the service. An opaque, HttpOnly checkout cookie lasts up to 30 days and protects payment ownership and retries. Stripe handles payment fields; we do not receive full card numbers. Google sign-in is used only if you choose it. Refund and withdrawal notices and their delivery records are retained to handle your request.
AI Tutor
Your question, lesson/step context and up to three recent exchanges are sent to OpenAI. We do not deliberately send your account email or authentication cookies, but information you type is included. Chat text stays in page memory rather than a saved-chat database and normally clears when you leave or reload; browser restoration may preserve it. Account-linked usage counters and technical cost/error information are stored. The request uses store:false; provider safety logs and temporary retention may still apply. Do not enter sensitive information.
Measurement and browser storage
Necessary storage supports sign-in, checkout security and saved lesson progress. Optional measurement can use Google Analytics, Meta Pixel/server events and Microsoft Clarity. It records page views, acquisition UTMs and campaign/ad identifiers, intentional checkout entry and verified purchases, with provider event IDs used to prevent duplicates. Clarity is limited to the sales homepage with text masking. Learning measurement uses existing course/lesson identifiers and supported progress actions; opening a lesson is not completion. Authentication tokens, raw quiz answers and Tutor chat text are excluded from event payloads. Technical security logs remain separate.
Google Analytics, Meta advertising measurement and Microsoft Clarity start automatically when you visit the public site, without a prior consent prompt. Provider cookies and campaign identifiers may identify your browser. You can restrict cookies and scripts through your browser controls and contact us about your privacy rights. Browsing or purchasing is not treated as a record of consent. Historical consent and opt-out records are retained.
Why and with whom
Service delivery, account verification, payment and support use contractual necessity; proportionate security and claims handling use legitimate interests; accounting and required notices use legal obligations. Optional tracking and promotional email require consent where applicable. You can object to legitimate-interest processing and withdraw consent without affecting earlier lawful processing.
Netlify provides hosting/functions; Supabase accounts, database and access records; Stripe payments; Resend service emails; OpenAI Tutor replies; Google optional sign-in. Analytics providers receive the optional measurement described above. Providers may process outside the EEA, including the US, using applicable adequacy decisions or contractual safeguards. Ask support for the safeguards relevant to your information.
Email, history and retention
Access/login, payment, recovery, security, withdrawal and necessary earlier billing notices are separate from marketing. Marketing is disabled for this release. Existing contacts, unsubscribes and suppressions are retained; historical quiz and subscription evidence is not erased or reused as new consent.
We keep account/access and transaction records for service delivery, recovery, disputes and legal duties. Finnish accounting vouchers generally require six years and specified books/statements ten years; those duties do not justify keeping all chat or quiz data for that long. Tutor usage rows older than 35 days are removed on the next accepted request. Provider logs and backups follow their actual settings; instant deletion is not promised.
Your rights
You can request access, correction, deletion, restriction, portability where applicable, object to processing, withdraw consent and complain to the Finnish Data Protection Ombudsman or another competent authority. We normally respond within one month, explaining lawful extensions. Rights also apply where other mandatory privacy law covers the service. Identity is verified proportionately; do not send your password. The service is for adults. We communicate material changes where required.
Controller
Littiset Oy · Business ID 3284107-4
Männistöntie 84, 92500 Siikalatva, Finland
support@myailessons.com