LearningLevels AG — Privacy Policy

LearningLevels AG

Last updated: 23 June 2026

1. Who We Are

LearningLevels AG (“LearningLevels”, “we”, “our”, or “us”) operates the LearningLevels platform, an AI-powered educational workspace and learning platform for teachers, schools, and students. We are incorporated in Switzerland and subject to Swiss data protection law (DSG) and, where applicable, the EU General Data Protection Regulation (GDPR).
Our Data Protection Contact can be reached at: privacy@learninglevels.com

2. Who This Policy Covers

This Privacy Policy applies to:

Individual teachers and educators who use the LearningLevels AI Workspace or
Learning Platform (“Users”);
Students who access the Learning Platform through a school or teacher account (“Students”);
Representatives of schools, districts, or educational organizations that contract with
LearningLevels (“Organizations”);
Visitors to our website.
If you are a Student, your school or teacher is primarily responsible for how your data is used on the platform. Please refer to your school’s privacy notices in addition to this policy.

3. Data We Collect

Our overriding policy is to collect as little user information (personal data included) as possible to ensure a private user experience when using the Services.

Data collection is limited to the following:

3.1 Account and Registration Data

When you create an account, we collect your name, email address, and account credentials (password hash). For Google Sign-In, we receive your name and email from Google. For
Organization accounts, we additionally collect organization name and contact details.

3.2 User Content

We collect content you upload, create, or generate on the platform, including scanned documents, lesson plans, worksheets, quizzes, course materials, and AI-generated content.
This content belongs to you and is stored solely to provide the Services.

3.3 Student Data

When a school or teacher uses the Learning Platform, we process student data including name (or display name), class membership, assignment submissions, progress data, and platform activity. Student data is processed only as directed by the teacher or Organization and solely to provide the educational Services.
LearningLevels AG | privacy@learninglevels.com

3.4 Usage and Analytics Data

We collect product analytics data including feature usage events, session information, and performance metrics, linked to your account. This data is anonymized after 12 months. We do not use advertising analytics or sell analytics data.

3.5 Billing Data

For paid subscriptions, we collect your Stripe customer ID and subscription status. Payment card details are processed directly by Stripe and are not stored by LearningLevels.

3.6 Technical Data

We collect standard technical information including IP address, browser type, device information, and access logs. This data is used for security, debugging, and platform operation.

3.7 Waitlist Data

If you joined our waitlist, we hold your email address for the purpose of notifying you of platform availability. You may request deletion of this data at any time.

4. How We Use Your Data

We use your personal data for the following purposes and legal bases:

Providing and maintaining the platform and Services — lawful basis: performance of contract;
Authenticating your account and ensuring platform security — lawful basis: legitimate interest;
Processing payments and managing subscriptions — lawful basis: performance of contract;
Sending service-related communications (e.g., account alerts, billing) — lawful basis: performance of contract;
Improving platform performance and diagnosing technical issues — lawful basis: legitimate interest;
Complying with legal obligations — lawful basis: legal obligation.
We do not use your data or content to train AI or machine learning models. We do not sell your data. We do not use your data for advertising.

5. How We Share Your Data

We do not sell, rent, or trade personal data. We share personal data only in the following circumstances:

5.1 Subprocessors

We share data with the following authorized subprocessors who process data on our behalf:

Google Cloud EMEA Limited (Google Cloud Platform, Document AI, Gemini API) — for cloud infrastructure, document processing, and AI content generation. Data is processed in the EU/EEA.
Stripe Payments Europe Limited — for payment processing. Data is processed in the
EU/EEA.
Resend Inc. — EU/EEA region — Transactional email delivery (account notifications,
DSAR export delivery, deletion request confirmations)
We do not share personal data with any other third-party processors.

5.2 Legal Requirements

We may disclose personal data if required to do so by applicable law, court order, or regulatory authority. We will notify you of such disclosure where legally permitted to do so.

5.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, personal data may be transferred to a successor entity. We will notify you before your data is transferred and becomes subject to a different privacy policy.

5.4 Aggregated or Anonymized Data

We may share aggregated, anonymized data (such as usage statistics) that cannot reasonably be used to identify individuals, including with investors or partners, for business reporting purposes.

6. Data Retention

We retain personal data for the following periods:

Account data: for the duration of your account, plus 30 days following account deletion;
User content: for the duration of your account or until you delete it;
Student data: for the duration of the school or teacher contract, plus 90 days;
Analytics data: anonymized after 12 months; anonymized data may be retained indefinitely;
Application logs: 12 months;
Audit and deletion records: 7 years;
Waitlist data: deleted within 30 days of platform launch or on request.
Financial and billing records are retained by Stripe in accordance with their legal obligations.
We retain only a Stripe customer ID and subscription status, which is deleted on account deletion.

7. Your Rights

Depending on your location, you may have the following rights in relation to your personal data:

Right of access — you may request a copy of the personal data we hold about you;
Right to rectification — you may request correction of inaccurate data;
Right to erasure — you may request deletion of your personal data, subject to legal retention obligations;
Right to restriction — you may request that we restrict processing of your data in certain circumstances;
Right to data portability — you may request your data in a commonly used machine-readable format;
Right to object — you may object to processing based on legitimate interests.
To exercise any of these rights, please contact us at privacy@learninglevels.com. We will respond within 30 days. There is no charge for exercising your rights.
If you are a Student, please direct rights requests to your school or teacher in the first instance, as they are the data controller for your education records.

8. Children and Students

8.1 Minimum Age

The LearningLevels platform is not directed at children under 13 and we do not knowingly collect personal data from children under 13 without appropriate authorization. Individual sign-up requires users to be at least 13 years of age.

8.2 School Deployment and COPPA

Where a school deploys LearningLevels to students who may be under 13, the school provides consent on behalf of parents under the school consent exception to the Children’s
Online Privacy Protection Act (COPPA). In such cases, we collect only data strictly necessary for the educational service and do not use it for any commercial purpose.

8.3 FERPA

Where we process education records on behalf of a U.S. educational institution, we act as a school official with a legitimate educational interest as defined under FERPA. We do not disclose education records to third parties without institutional consent except as permitted by FERPA.

9. Security

We implement appropriate technical and organizational measures to protect your personal data, including:

Encryption of data at rest using Google Cloud managed encryption;
Encryption of data in transit using TLS;
Access controls and role-based permissions;
Audit logging for systems containing personal data;
Security incident detection and response procedures.
In the event of a data breach affecting your personal data, we will notify you and the relevant supervisory authority as required by applicable law.

10. International Transfers

LearningLevels processes personal data primarily within Switzerland and the EU/EEA. Our subprocessors operate in the EU/EEA. Where any transfer of personal data occurs outside of Switzerland or the EU/EEA, we ensure that appropriate safeguards are in place, including
Standard Contractual Clauses or equivalent mechanisms recognized by Swiss and EU law.

11. Cookies

We use strictly necessary cookies to operate the platform (e.g., session management and authentication). We do not use advertising cookies or third-party tracking cookies. For information about cookie management, please refer to your browser settings.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or via a prominent notice on the platform at least 30 days before changes take effect. The effective date at the top of this policy reflects the date of the most recent update.

13. Supervisory Authority

If you are located in Switzerland, you have the right to lodge a complaint with the Federal
Data Protection and Information Commissioner (FDPIC) at www.edoeb.admin.ch.
If you are located in the EU/EEA, you have the right to lodge a complaint with the supervisory authority in your country of residence.

14. Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact:
LearningLevels AG, Scheuergasse 5, 5210 Windisch, Switzerland
Email: privacy@learninglevels.com