سياسة الخصوصية

1. Who we are

InvestLearn is operated by George applications ("we", "us"), trading as InvestLearn. We act as the data controller for personal data processed through the service. Contact: support@investlearn.app.

2. Personal data we collect and why

• Account data (name, email, login credentials / Google account identifier) — to create and secure your account. Legal basis: performance of a contract.
• Service content (lesson progress, quiz scores, portfolio entries, watchlists, decision logs, assistant conversations) — to provide the service. Legal basis: performance of a contract.
• Support messages — to answer your requests. Legal basis: legitimate interests.
• Usage and telemetry, device identifiers, IP address, push subscription endpoints — for security, fraud and abuse prevention, rate limiting, notifications and product improvement. Legal basis: legitimate interests, or consent for push notifications.
• Marketing preferences — only where you opt in. Legal basis: consent.

3. Who we share data with

• Service providers and subprocessors: hosting, database and authentication infrastructure, AI model providers used by the assistant, market-data and news providers, analytics and support tooling.
• Paddle.com, our Merchant of Record, for the sale of subscriptions, subscription management, payments, invoicing and tax compliance.
• Professional advisers (legal, accounting) where necessary.
• Authorities where required by law.

4. International transfers

Our providers may process data outside your country, including outside the UK/EEA. Where that happens we rely on adequacy decisions or Standard Contractual Clauses as appropriate safeguards.

5. Retention

We keep account and service data for as long as your account is active, and for up to 12 months after deletion where needed for security, dispute resolution or legal obligations. Data is then deleted or anonymised. Billing records are retained by Paddle for the period required by tax law.

6. Your rights

Subject to applicable law you may request access, rectification, erasure, restriction, portability, object to processing based on legitimate interests, and withdraw consent at any time. Email us and we will respond within one month. If you are in the UK/EEA you may also complain to your local supervisory authority.

7. Security

We apply appropriate technical and organisational measures, including encryption in transit, access controls, row-level security on our database and per-endpoint rate limiting.

8. Cookies

We use essential cookies for sessions and sign-in, and may use analytics and advertising cookies. You can manage or block cookies in your browser settings; blocking essential cookies will break sign-in.