Privacy Policy
Last updated: 22 August 2026
This policy explains what personal data Eureka Academy collects, why, and what rights you have. It is written to comply with the EU General Data Protection Regulation (GDPR) and the Italian Personal Data Protection Code.
Data controller: Camila Paris, [LEGAL ADDRESS], Italy, VAT 05691140288
Contact: support@professorpascal.com
1. Data we collect
You give us: email address, display name, password (stored hashed), date of birth, parent or guardian email if you are under 16, chosen courses, and anything you type into lessons, practice, or Office Hours.
Generated by your use: progress and mastery scores, XP, streaks, practice answers and results, session timestamps, AI conversation transcripts, and aggregate usage counts.
Collected automatically: IP address, browser and device type, and pages visited. We use this for security and for basic aggregate analytics.
Payment data: handled entirely by Stripe. We never receive or store your full card number.
2. Why we process it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Providing your account and courses | Performance of a contract |
| Generating AI tutor responses | Performance of a contract |
| Processing payments | Performance of a contract |
| Age verification and parental consent | Legal obligation |
| Keeping the Service secure and preventing abuse | Legitimate interests |
| Aggregate, non-identifying product analytics | Legitimate interests |
| Service and billing emails | Performance of a contract |
| Marketing emails | Consent (opt-in; withdraw at any time) |
| Retaining accounting records | Legal obligation (Art. 2220 Italian Civil Code) |
3. Children and young people
Our users are often minors, and we treat their data with corresponding care.
- Under 13: not permitted. We do not knowingly collect data from children under 13. If we learn that we have, we delete it promptly. Parents may contact support@professorpascal.com to report such an account.
- Ages 13 to 15: parental consent required. At signup we collect a date of birth. If you are under 16, we ask for a parent or guardian's email address. That parent receives a message describing the Service and this policy, and must confirm consent via a unique link before the account is activated. Until they do, the account cannot be used. We record the date, time, and IP address of that confirmation as evidence of consent.
- Ages 16 and over: you may register on your own behalf.
We set the threshold at 16 because the age of digital consent varies from 13 to 16 across EU member states, and 16 satisfies all of them.
A parent or guardian who has given consent may withdraw it at any time by emailing support@professorpascal.com, which will result in deletion of the account and associated data.
We do not use minors' data for profiling, behavioural advertising, or any automated decision-making that produces legal or similarly significant effects.
4. The AI tutor and your data
When you use Professor Pascal, the text you write is transmitted to Anthropic, our AI provider, to generate a response. Anthropic processes this on our behalf under a data processing agreement and does not use it to train its models.
We retain AI conversation transcripts for 12 months so that you can revisit past sessions and so we can investigate problems. You may delete individual conversations at any time from your account.
5. Who we share data with
We share data only with service providers who process it on our instructions:
- Supabase — database and authentication hosting
- Anthropic — AI response generation
- Stripe — payment processing
- Cloudflare — content delivery and security
- Lovable — application hosting
Some of these are based outside the European Economic Area. Where that is the case, transfers are protected by the European Commission's Standard Contractual Clauses or an adequacy decision.
We do not sell personal data. We do not share it with advertisers. We will disclose data to authorities only where legally compelled, and we will notify you unless prohibited from doing so.
6. How long we keep it
| Data | Retention |
|---|---|
| Account and progress data | Until you delete your account, then 30 days |
| AI conversation transcripts | 12 months |
| Parental consent records | Duration of the account, then 3 years |
| Payment and invoicing records | 10 years (Italian legal requirement) |
| Server and security logs | 90 days |
| Safety event records (category only) | 24 months |
7. Your rights
Under the GDPR you have the right to: access your data; correct it; delete it; restrict or object to processing; receive it in a portable format; and withdraw consent where consent is the basis.
Exercise any of these by emailing support@professorpascal.com. We respond within 30 days. Account deletion and a full data export are also available directly in your account settings.
If you believe we have handled your data unlawfully you may complain to the Italian supervisory authority — the Garante per la protezione dei dati personali (garanteprivacy.it) — or to the authority in your own EU country.
8. Security
Passwords are hashed. Data is encrypted in transit and at rest. Access to production data is restricted and logged. In the event of a data breach affecting your rights, we will notify the Garante within 72 hours and notify you without undue delay where the breach presents a high risk to you.
9. Changes
We will notify registered users by email of material changes at least 30 days before they take effect.