GDPR Privacy Policy

At Alimun, accessible from alimun.com, one of our main priorities is the privacy of our visitors and learners. This Privacy Policy document contains types of information that is collected and recorded by Alimun and how we use it, in compliance with the General Data Protection Regulation (GDPR) (EU) 2016/679.

If you have additional questions or require more information about our Privacy Policy, do not hesitate to contact us.

1. Personal Data We Collect

We collect several types of personal data when you create an account, enroll in a cohort, or interact with our Service:

Account Credentials & Profile Info: Your full name, email address, password, and profile metadata (role, language preference, current level).
Teacher Application Info: Specialty, short biography, location, and years of experience (inserted into the `teacher_profiles` table).
Billing & Payment Data: Credit card numbers, transaction history, and subscription statuses processed securely via Stripe.
Usage & Interaction Data: Homework essays submitted, test answers, AI-generated grading feedback, live classroom attendance durations, and technical server logs.

2. Lawful Basis for Processing

Under GDPR, we process your personal data under the following lawful bases:

Performance of a Contract: To administer your account, process payments, register you in cohorts, and coordinate live teaching sessions.
Consent: When you subscribe to our progress newsletter or opt-in to optional analytics/marketing cookies. You may revoke consent at any time.
Legitimate Interests: To improve our language curriculum, debug security issues, detect fraudulent payment attempts, and train our AI essay-feedback models.

3. How We Use Your Information

We use the collected data to run Alimun effectively, including to:

Provide, operate, and maintain our Service.
Improve, personalize, and expand our Service (specifically, refining language levels and curriculum tracks).
Analyze how you navigate our Service.
Process payments and payouts via Stripe and Wise.
Develop new features, services, and educational tools.
Communicate with you regarding cohort updates, session availability, and waitlist progress.
Detect and prevent fraud.

4. Data Retention

We will retain your personal information only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use your information to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with tax laws), resolve disputes, and enforce our agreements.

5. Your GDPR Rights

If you are a resident of the European Economic Area (EEA), you have the following data protection rights:

Right to Access: You have the right to request copies of your personal data.
Right to Rectification: You have the right to request that we correct any information you believe is inaccurate or incomplete.
Right to Erasure (Right to be Forgotten): You have the right to request that we erase your personal data under certain conditions.
Right to Restrict Processing: You have the right to request that we restrict the processing of your personal data.
Right to Data Portability: You have the right to request that we transfer the data that we have collected to another organization, or directly to you.
Right to Object: You have the right to object to our processing of your personal data.

If you make a request, we have one month to respond to you. If you would like to exercise any of these rights, please contact our Data Protection Officer at privacy@alimun.com.

6. Third-Party Services

We share data only with trusted third-party sub-processors required to deliver Alimun:

Supabase: For database hosting, authentication security, and RLS management.
Stripe: For handling card billing and payment processing.
Daily.co: For hosting live video classroom rooms.
Resend: For dispatching notifications and newsletter emails.