Privacy Policy

1. Introduction

This Privacy Policy explains how [PLACEHOLDER: Lecturia, Inc.] ("Lecturia", "we", "us", or "our") collects, uses, shares, retains, and protects personal data in connection with the Lecturia website at lecturia.ai, the web application at app.lecturia.ai, the Lecturia iOS and Android mobile applications, and any related APIs and services (collectively, the "Service").

This Privacy Policy applies to personal data we process as a controller (for EU purposes: the "data controller" under Article 4(7) GDPR). Lecturia is committed to processing your personal data lawfully, fairly, and transparently. Section 4 describes the purposes for which Lecturia currently processes personal data. If Lecturia adds a new processing purpose, Lecturia will update Section 4 and notify you in advance as described in Section 13, in the manner required by applicable law.

If you do not agree with this Privacy Policy, please do not use the Service.

2. Who we are and how to contact us

• Controller: [PLACEHOLDER: Lecturia, Inc.]
• Registered address: [PLACEHOLDER: {street, city, state/region, postal code, country}]
• General privacy inquiries: [email protected]
• Data-subject rights requests (GDPR, UK GDPR, CCPA, etc.): [email protected]
• EU representative under Article 27 GDPR (if applicable): [PLACEHOLDER: TBD]
• UK representative under the UK GDPR (if applicable): [PLACEHOLDER: TBD]
• Data Protection Officer: [PLACEHOLDER: Not appointed -- Lecturia has assessed that the mandatory appointment criteria in Article 37 GDPR are not met. Revisit if processing volumes or categories change.]

3. What personal data we collect

We collect the following categories of personal data:

3.1 Account data

When you create an Account, we collect:

• Email address (required, used for sign-in, service communications, and account recovery);
• Password hash (we never store your password in plain form);
• Display name or nickname (optional, used within the Service UI);
• Profile settings (language preference, notification preferences, playback preferences, chosen e-reader voices);
• Authentication metadata (Supabase Auth user ID, sign-in method, multi-factor authentication status).

3.2 Content you upload

When you upload an ebook, document, or other file to the Service, we collect and process:

• The file itself (EPUB, PDF, TXT, and any other supported format);
• Extracted text that we derive from your file in order to perform text-to-speech conversion;
• Material metadata (title, author, language, chapter structure) automatically detected during extraction or manually provided by you;
• Audio we generate on your behalf using the TTS Provider you select.

Your uploaded files, the extracted text, and the generated audio are treated as your personal content. They are stored on your behalf, used only to provide the Service to you, and are not shared with any other User. See Section 5 and Section 6 for details of sub-processors and international transfers.

3.3 Usage data

When you use the Service, we automatically collect:

• Service events (sign-in, upload, conversion start/finish, playback start/stop, credit purchase, listening progress);
• Device and technical data (device type, operating system and version, app version, IP address, user agent, approximate location derived from IP address, crash reports, performance metrics);
• Cookies and local storage (session tokens, preference cookies; we do not use third-party advertising cookies).

Usage data is used for operating the Service, securing it against fraud and abuse, and improving its reliability and performance. It is not sold.

3.4 Payment data

When you purchase credits through app.lecturia.ai, your payment is processed by Stripe. Stripe collects your payment card details directly; Lecturia receives only the last four digits of the card, the card brand, country, and a tokenized reference. When you purchase credits through a mobile app, your payment is processed by Apple (on iOS) or Google (on Android); those providers share a transaction token and receipt with Lecturia but not your full payment details.

We also collect and store transaction records (credit purchases, credit consumption, refunds, chargebacks) for accounting, tax, and legal-compliance purposes, as required by Section 7.

3.5 Communications with us

If you contact us by email (including support@, legal@, abuse@, copyright@, privacy@, or security@) or respond to a service email, we collect and retain the content of your message and any information you voluntarily share.

3.6 Data we do not collect

We do not collect, as part of your Account data or the usage data we record about you:

• Your real legal name, date of birth, or government identification, unless specifically required for a legal compliance reason (for example, responding to a court order);
• Sensitive data within the meaning of Article 9 GDPR (race, political opinions, religious beliefs, health data, biometric data, sex life, or sexual orientation);
• Payment card numbers or CVV codes.

User-uploaded Content is addressed separately in Section 3.2. You are responsible for what you upload, and you must not upload Content that falls within the categories prohibited by the Acceptable Use Policy (including protected health information under AUP Section 2.6). Where a piece of user-uploaded Content incidentally contains text that would, if collected directly from you as Account data, fall within Article 9 GDPR (for example, a book on a medical condition that you happen to own), Lecturia processes that text only as part of operating the Service on your instruction and under the license described in Terms of Service Section 6.2, not as a direct collection of sensitive data about you.

3.7 Phone number (freemium unlock)

Providing a phone number is optional. We ask for it only if you choose to verify a mobile number to unlock the freemium credits. If you verify a number, we collect and process:

• Your mobile phone number, in international format (E.164);
• The verification code, which is generated and delivered to you by our verification provider, Prelude (see Section 5.1);
• The fact and time of the confirmation that you entered the correct code.

From the number we derive a keyed hash. A keyed hash is a one-way value that cannot be turned back into the number without Lecturia's secret key. We use it to allow one freemium unlock per phone number. It is pseudonymised personal data, not anonymous data.

If you do not provide a phone number, the freemium credits stay locked. Paid credits and the rest of the Service are not affected.

The number is stored only with your Account, in our authentication database. We do not write it to our logs. Logs and audit records hold only the last two digits and the country code.

See Section 4 for the purpose and legal basis, Section 5.1 for Prelude, and Section 7 for retention.

4. How we use personal data, and the legal bases

We use personal data only for the purposes and on the legal bases described below. For Users in the European Economic Area, the United Kingdom, or Switzerland, the legal bases listed refer to Article 6 of the GDPR (or its equivalents).

Balancing note (phone number and keyed hash). Our interest is to stop one person claiming the free credit grant repeatedly, and to limit fraudulent SMS traffic, which costs us money per message. A limit per Account does not achieve this because a new Account is easy to create, so a per-number check is necessary. The impact on you is limited. Verification is optional, the keyed hash cannot be turned back into your number without our secret key, and after you delete your Account the hash is detached from any Account and is used only to check whether the number has already unlocked the freemium credits. It is deleted when Lecturia stops offering the grant. You can object under Section 9. Section 7 sets the retention periods.

We do not use your personal data or Content for:

• Profiling for automated decisions with legal or similarly significant effects under Article 22 GDPR;
• Marketing or advertising that identifies you individually or discloses the specific contents of your upload;
• Sales or licenses of your raw Content to any third party for that third party's independent commercial use; or
• Any purpose that is outside the scope of the license you grant in Section 6.2 of the Terms of Service or that is not described in this Section 4 (including Section 4.1 below).

Service improvement and model training by Lecturia. Lecturia may use your Content and associated usage signals, on a de-identified basis where technically feasible, to improve the Service and to train, fine-tune, and evaluate machine-learning models that Lecturia develops for internal purposes. This "Improvement Use" is described in detail in Section 4.1 below and is optional and off by default. It happens only if you give your consent in your Account settings, and you can withdraw that consent at any time.

Third-party TTS Providers. When you select a TTS Provider (the current TTS Providers are listed in Section 5.1.1) and initiate a conversion, Lecturia transmits your extracted text to that provider for processing. Lecturia sends the provider only the text to be synthesized. Each provider operates under its own terms of service, privacy policy, and data-use practices, which are outside Lecturia's contractual control. Lecturia cannot audit a provider's internal systems and does not guarantee how a given provider handles the data it receives -- including whether the provider uses that data to operate, improve, or train its own models. Lecturia uses commercially reasonable efforts to select provider tiers, endpoints, and account-level settings that, under each provider's then-current published policies, minimize provider-side use of customer data for training. See Section 5.1.1 of this Privacy Policy for the current list of TTS Providers and Section 5.4 of the Terms of Service for the full disclosure.

4.1 Service improvement and Lecturia model training (only with your consent)

If you give your consent (see below), Lecturia may use your Content and associated usage signals ("Improvement Data") to improve the Service and to train, fine-tune, and evaluate machine-learning models that Lecturia develops for internal purposes (collectively, the "Improvement Use"). The Improvement Use includes:

• Improving Lecturia's text extraction, text cleanup, chunking, chaptering, language detection, and quality-assurance pipelines;
• Measuring and improving Service reliability and audio quality;
• Training, fine-tuning, and evaluating Lecturia-developed machine-learning models that serve the purposes above.

Security and abuse prevention are not part of the Improvement Use. Lecturia secures the Service and detects, prevents, and investigates fraud, abuse, and Service-integrity issues on the basis of its legitimate interests (Article 6(1)(f) GDPR), as listed in the table in Section 4. That processing does not depend on your consent and continues if you refuse or withdraw it.

De-identification and memorization safeguards. Where technically feasible, Lecturia processes Improvement Data in a manner designed not to identify you by name, email address, or Account, applying commercially reasonable de-identification techniques, and Lecturia does not intentionally process Improvement Data in a manner that enables reconstruction of your original file. Lecturia uses commercially reasonable technical measures -- including de-identification, training practices intended to prevent the memorization of User Content, and access controls on the resulting models -- so that Improvement Data is not published in identifiable form and is not included in any output that is visible to any third party or to any other User. Because no technical measure can guarantee perfect suppression of memorization in machine-learning systems, Lecturia's commitment in this paragraph is to apply these measures, not to an absolute outcome. If Lecturia becomes aware of any incident in which identifiable User Content has been exposed through Improvement Data, Lecturia will treat that incident as a personal-data incident and respond as described in Section 8.1.

What the Improvement Use does not include. The Improvement Use does not include (a) selling, licensing, or sharing your raw Content with any third party, (b) using your Content in advertising or publicity that identifies you or discloses the specific contents of your upload, (c) voice cloning of any User, (d) general-purpose language-model training whose outputs are made available to third parties, or (e) any processing by third-party TTS Providers beyond what Lecturia has instructed them to do as sub-processors (third-party providers' own data use under their own terms is addressed separately in Section 4 above and in Section 5.4 of the Terms of Service).

Legal basis (GDPR): your consent. Lecturia carries out the Improvement Use only on the basis of your consent under Article 6(1)(a) GDPR. The Improvement Use is off by default. You give your consent by turning on the Improvement Use setting in your Account settings. Lecturia does not ask for it as part of sign-up or acceptance of the Terms of Service, and the Service works the same whether or not you consent. Lecturia records each time you give or withdraw your consent, with the date and time and the version of this Privacy Policy in force at that time.

Withdrawing your consent. You may withdraw your consent at any time, as easily as you gave it, by turning the setting off in your Account settings. Withdrawal takes effect for future use: from then on Lecturia does not use your Content for new Improvement Use. Withdrawal does not affect the lawfulness of processing carried out before it (Article 7(3) GDPR). It does not require Lecturia to unwind or delete (a) any improvement, analysis, or model training already performed before your withdrawal, or (b) any de-identified or aggregated outputs derived from your Content before your withdrawal, but only where those outputs are not identifiable, that is, where they cannot be linked back to you and cannot be unwound. If Lecturia finds that an output derived from your Content is identifiable, it is not covered by this exception: Lecturia treats it as a personal-data incident under Section 8.1 and, on your request, removes it or the model that produced it where technically feasible. Refusing or withdrawing consent stops only the new Improvement Use of your Content. It does not affect the other purposes described in Section 4 (such as delivering the Service, securing the Service and preventing fraud and abuse, processing payments, sending transactional emails, responding to your data-subject requests, or complying with law).

5. Who we share personal data with

Lecturia does not sell your personal data. We share personal data only with the following categories of recipients. For each active sub-processor identified in Section 5.1, other than those marked as independent controllers, Lecturia accepts the sub-processor's standard data-processing agreement or executes a bespoke one before the Service processes any personal data through that sub-processor, in each case intended to satisfy the requirements of Article 28 GDPR where applicable, and, where international transfers are involved, supplemented with Standard Contractual Clauses or an equivalent transfer mechanism. The current state of each sub-processor's data-processing agreement is tracked internally in Lecturia's legal operational readiness register.

5.1 Sub-processors

The following active sub-processors process personal data on our behalf. The TTS Providers are listed separately in Section 5.1.1. For each Active sub-processor, other than those marked as independent controllers, Lecturia accepts the sub-processor's standard data-processing agreement or executes a bespoke one before the Service processes any personal data through that sub-processor, in each case intended to satisfy the requirements of Article 28 GDPR where applicable, and, where international transfers are involved, supplemented with Standard Contractual Clauses or an equivalent transfer mechanism.

Prelude receives your phone number only when you start a verification. It processes the data on our behalf to deliver and check the code. Prelude's own privacy policy states that it also acts as a data controller when it processes data to combat fraud or improve its services. Lecturia has accepted this, and Prelude's own privacy policy governs that processing.

The current list of sub-processors is maintained in this Privacy Policy. Lecturia updates this section, and the "Last Updated" date, whenever a sub-processor is added, replaced or removed. This published list is the notice of the change. Lecturia gives individual advance notice only where applicable law requires it.

5.1.1 TTS Providers

The following TTS Providers are active. Each one receives only the text to be synthesized. Lecturia uses each provider under its API terms and, where the provider offers one, its data-processing agreement.

Each TTS Provider receives only the text segment and the voice settings (voice, language, audio format and speed). Requests come from Lecturia's servers. Lecturia does not send your name, email address, account identifier, IP address or other metadata about you. If your Content itself contains personal data of you or of other people, that text reaches the TTS Provider you chose (see Section 6.3 of the Terms of Service).

Important note on TTS Providers. Each TTS Provider is an independent third party that processes your extracted text on its own systems under its own terms of service, privacy policy, and data-use practices. Lecturia uses each TTS Provider under its API terms and, where the provider offers one, its data-processing agreement, and Lecturia uses commercially reasonable efforts to select provider tiers, endpoints, and account-level settings that -- under each provider's then-current published policies -- minimize the use of customer data for the provider's own model training (for example, the default "no training on API inputs" stance of the OpenAI API and Google Cloud's customer-data governance, and Cartesia's organization-level training opt-out).

However, Lecturia cannot audit a TTS Provider's internal systems and cannot guarantee that any particular provider will not use your data for its own purposes permitted by its own terms. By selecting a TTS Provider and initiating a conversion, you acknowledge and consent to your Content being processed by that provider under the provider's then-current terms, and you agree that Lecturia is not responsible for a provider's handling of your data under those terms. The full disclosure and the list of Lecturia's commitments on provider selection are in Section 5.4 of the Terms of Service.

You can find the current list of TTS Providers (and the e-reader voices that correspond to each) in the Service and in the TTS Providers table in Section 5.1.1 of this Privacy Policy. Links to the current terms and privacy policies of each TTS Provider are available [PLACEHOLDER: in the Service settings screen / at lecturia.ai/providers].

5.2 Legal disclosures

Lecturia may disclose personal data to courts, law-enforcement authorities, regulators, or other third parties when we believe in good faith that disclosure is necessary to:

1. Comply with a valid legal process (subpoena, court order, warrant, or statutory request);
2. Respond to an official request from a competent authority;
3. Enforce our Terms of Service, Acceptable Use Policy, or Copyright & DMCA Policy;
4. Protect the rights, property, or safety of Lecturia, our Users, or the public;
5. Investigate, prevent, or take action against suspected fraud, abuse, or illegal activity.

Where we receive such a request, we will, where lawful and practicable, notify the affected User and provide them with an opportunity to object before we disclose their data.

5.3 Business transfers

If Lecturia is involved in a merger, acquisition, sale of assets, bankruptcy, or reorganization, personal data may be transferred to the successor entity. We will notify Users before any such transfer if required by applicable law, and any successor will be bound by this Privacy Policy (or an equivalent) until superseded.

5.4 With your consent

We may share personal data with any other third party with your explicit consent or at your direction.

6. International transfers

Lecturia is [PLACEHOLDER: an EU entity based in Ireland (or equivalent EU member state, pending incorporation)]. Lecturia's primary data storage is located in the European Union: the PostgreSQL database and Supabase Auth are hosted in Frankfurt, Germany (eu-central-1), and the k3s cluster is hosted in Falkenstein, Germany. Transfers within the European Economic Area, to the United Kingdom, and to Switzerland rely on the adequacy decisions in force for those destinations.

A subset of Lecturia's sub-processors (as listed in Section 5.1) is established in the United States or other non-adequate third countries. When personal data is transferred to those sub-processors, Lecturia relies on appropriate safeguards under Article 46 GDPR, including the European Commission's Standard Contractual Clauses (SCCs) (Commission Implementing Decision (EU) 2021/914) and, for transfers from the UK, the UK International Data Transfer Addendum. The following transfer destinations currently require SCC-based safeguards:

• United States - Cloudflare R2, ElevenLabs, Cartesia, Inworld, Speechify, Stripe, Resend, Better Stack (error events from the web apps only), and Google Cloud (where the specific service is billed outside an EU region).
• No guaranteed location - xAI (global processing) and OpenAI (no processing region guaranteed).
• European Economic Area - Mistral processes in the EEA by default, so no transfer takes place on its primary path.
• European Economic Area - Prelude (DING NEGOCE SAS) is established in France and states that it hosts on Amazon Web Services servers in the EU. Its other processing locations and any onward transfers to its own sub-processors are [PLACEHOLDER: confirm from Prelude's DPA].

To deliver a verification code, the message passes through the mobile network that serves your number. That network may be outside the EEA (for example in Ukraine, the United Kingdom or Switzerland). The transfer mechanism for this delivery is [PLACEHOLDER: counsel to confirm].

Section 5.1.1 lists the transfer mechanism each TTS Provider offers. Speechify publishes no SCC annex; its privacy policy states that it relies on SCCs where required.

Better Stack stores Lecturia's application logs, metrics and server-side request traces in the European Union (Germany). Only error events reported by the web apps are stored in the United States (us-west-2), because Better Stack offers its error-tracking product to Lecturia only in a United States region. Those error events are limited to the error message, the stack trace, the page URL without its query string or fragment, and the browser and operating system. The error reporting in the web apps does not send cookies, does not record sessions, and does not collect browser performance traces. Lecturia has decided to keep this transfer rather than move error tracking to an EU region. For it, Lecturia relies on the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) incorporated in Better Stack's data-processing agreement and, for transfers from the UK, the UK International Data Transfer Addendum. Better Stack is established in the United States. Where Better Stack accesses the logs, metrics and traces stored in the European Union from outside the European Economic Area, the same safeguards apply. Those logs contain technical metadata such as IP addresses, account identifiers and redacted storage references, and are designed not to contain the text of your Content.

We have assessed (or will assess, before launch) the risks of each non-adequate international transfer in light of the Schrems II judgment (C-311/18) and we apply supplementary measures where appropriate: encryption in transit (TLS 1.2+), encryption at rest, contractual restrictions on sub-processor access to user Content, preference for provider tiers and settings that minimize customer-data use for provider model training (see Terms of Service §5.4), routing of TTS requests to EU processing regions where a provider offers them, and sending TTS Providers only the text to be synthesized, without account identifiers. The Transfer Impact Assessments themselves are internal documents; you may request a summary of the safeguards applicable to a specific transfer by writing to [email protected].

You may also request a copy of the relevant transfer mechanism (for example, the Module 2 SCCs applicable to a given sub-processor) by writing to [email protected].

7. How long we keep personal data

Deletion of your Content. When you delete an individual file or your entire Account, Lecturia removes the file from active storage and expires it from all routine backups within thirty (30) days. After backup expiration, the file cannot be restored from Lecturia's systems. Transaction records are anonymized (separated from your personal identifiers) and retained for the applicable accounting and tax period.

Legal hold. The retention periods in the table above may be exceeded where Lecturia is required to preserve specific records in response to a legal, regulatory, or law-enforcement request (a "legal hold"). Records placed under a legal hold are retained until the hold is released, after which the ordinary retention period in the table above resumes. Legal holds are applied to the minimum set of records necessary to respond to the specific request; Lecturia does not use legal holds to extend retention of unrelated records.

8. Security

Lecturia implements technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, or destruction, including:

• Encryption in transit for all traffic between the client and the Service (TLS 1.2+);
• Encryption at rest for the primary database (Supabase managed encryption) and for object storage (Cloudflare R2 server-side encryption);
• Secrets management through OpenBao with dynamic database credentials and audit logging;
• Access control with least-privilege principles, multi-factor authentication for Lecturia personnel with access to production systems, and audit logging of administrative actions;
• Monitoring of security events, failed sign-in attempts, and anomalous activity;
• Vulnerability management and regular review of dependencies and infrastructure;
• Incident response with a documented runbook and notification obligations under applicable law.

Lecturia personnel who access user Content (as described in Terms of Service Section 6.6 and Section 8.3 below) do so under written confidentiality obligations and only for the limited purposes specified in the Terms.

8.1 Data breach notification

If we become aware of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within seventy-two (72) hours as required by Article 33 GDPR, and will notify affected Users without undue delay where required by Article 34 GDPR or other applicable law.

8.2 Your role in security

You are responsible for keeping your Account credentials confidential, for using a strong password, and for notifying us promptly at [email protected] if you suspect unauthorized access to your Account. No system is perfectly secure, and we cannot guarantee the absolute security of your personal data.

8.3 Internal access to Content

As described in Terms of Service Section 6.6, a small number of authorized Lecturia personnel may access User Content only for (a) abuse investigation, (b) security and fraud prevention, (c) technical support (only with the User's consent or at their request), and (d) legal compliance. All internal access to Content is audit-logged and restricted by access controls.

9. Your rights

Depending on where you reside, you may have certain rights with respect to your personal data. Lecturia honors these rights regardless of where you reside, and the specific legal bases for the rights are:

9.1 Rights under GDPR / UK GDPR

If you are in the European Economic Area, the United Kingdom, or Switzerland, you have the following rights:

• Right of access (Art 15) -- to obtain confirmation that we process your personal data and a copy of the data we hold about you.
• Right to rectification (Art 16) -- to have inaccurate or incomplete personal data corrected.
• Right to erasure ("right to be forgotten", Art 17) -- to have your personal data deleted in certain circumstances.
• Right to restriction of processing (Art 18) -- to limit how we process your personal data in certain circumstances.
• Right to data portability (Art 20) -- to receive your personal data in a structured, commonly-used, machine-readable format and, where technically feasible, to have it transmitted to another controller.
• Right to object (Art 21) -- to object to processing based on our legitimate interests, including direct-marketing-style communications such as re-engagement emails. The right also applies to the phone number verification described in Section 3.7. We assess such objections case by case against our interest in preventing abuse of the free credit grant.
• Rights related to automated decision-making (Art 22) -- Lecturia does not use automated decision-making that produces legal or similarly significant effects.
• Right to withdraw consent (Art 7) -- where processing is based on consent, to withdraw that consent at any time (without affecting the lawfulness of processing before withdrawal) -- for example, your consent to the Improvement Use (Section 4.1), which you can withdraw in your Account settings.
• Right to lodge a complaint (Art 77) -- with a supervisory authority in the Member State of your habitual residence, place of work, or alleged infringement.

9.2 Rights under CCPA / CPRA (California residents)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (as amended by the California Privacy Rights Act):

• Right to know what personal information we collect, use, disclose, and sell;
• Right to delete personal information;
• Right to correct inaccurate personal information;
• Right to opt out of sale or sharing -- Lecturia does not sell or share personal information within the meaning of the CCPA;
• Right to limit the use and disclosure of sensitive personal information -- Lecturia does not collect sensitive personal information as defined by the CCPA;
• Right to non-discrimination for exercising any of the above rights.

9.3 How to exercise your rights

To exercise any of these rights, please email [email protected] from the email address associated with your Account. We may require additional information to verify your identity before processing a request. We will respond within the time required by applicable law (generally within one month for GDPR requests and forty-five days for CCPA requests; we may extend this period where permitted by law).

The Service also provides self-service mechanisms in your Account settings for:

• Account deletion ("Delete my account") -- invokes the erasure flow described in the Terms of Service and anonymizes your transaction records for the statutory retention period, and, of your phone data, keeps only the detached keyed hash of a verified phone number described in Section 7 (a raw phone number can remain in routine backups for up to thirty (30) days until they expire);
• Data export ("Download my data") -- generates a downloadable ZIP file containing your profile data, material metadata, credit purchase history, and conversion history, as required by Article 20 GDPR. The export does not include the uploaded files themselves or the generated audio, because those are (a) owned by you and already in your possession or available by download from your library, and (b) not Lecturia-originated data.

10. Cookies and tracking

Lecturia uses a minimal set of cookies and similar local-storage mechanisms, limited to:

• Strictly necessary cookies for authentication, session management, and security (for example, your signed-in session token);
• Functional cookies for remembering your preferences (for example, your selected UI language or playback speed);
• Analytics limited to error tracking and operational metrics (Better Stack), used only for operating and improving the Service.

The error tracking in our web apps reports errors to Better Stack without setting any cookie. We do not use Better Stack's separate JavaScript tag, which by default sets a cookie and records sessions.

Lecturia does not use third-party advertising cookies, retargeting pixels, or tracking technologies that share your data with advertising networks. Lecturia does not participate in cross-site behavioral advertising.

Where required by law (for example, under the EU ePrivacy Directive as implemented in your member state), Lecturia will present a cookie consent notice on first visit. You can manage cookies through your browser settings; disabling strictly necessary cookies may prevent the Service from functioning.

11. Children

The Service is not intended for, and may not be used by, children under the age of eighteen (18). Lecturia does not knowingly collect personal data from any person under 18. If you believe a child has provided personal data to Lecturia, please contact [email protected] and we will promptly investigate and, where confirmed, delete the relevant data.

12. Do Not Track

Some browsers send a "Do Not Track" (DNT) signal. Because there is no consistent industry standard for responding to DNT signals, Lecturia does not currently respond to DNT signals differently, but we do not engage in cross-site tracking in any event.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. If we make a material change, we will notify you by email or by an in-app notice at least thirty (30) days before the change takes effect. Non-material changes (for example, clarifications, corrections, or additions of sub-processors with similar protections) may take effect upon publication, with the "Last Updated" date updated accordingly.

14. Contact

If you have any questions or concerns about this Privacy Policy or our handling of your personal data, please contact:

• Privacy and data-subject requests: [email protected]
• Postal address: [PLACEHOLDER: Lecturia, Inc., {street address}, {city, state, postal code, country}]
• EU representative (Art 27 GDPR, if applicable): [PLACEHOLDER: TBD]
• UK representative (UK GDPR, if applicable): [PLACEHOLDER: TBD]

If you are in the European Economic Area, the United Kingdom, or Switzerland and you are not satisfied with our response, you have the right to lodge a complaint with the supervisory authority in your country of residence. A list of EU supervisory authorities is available at https://edpb.europa.eu/about-edpb/board/members_en.