Privacy & Cookies

1. Controller

Star IT, SIA, reg. no. 40203604271, VAT no. LV40203604271, Līgo iela 34A, Berģi, Garkalnes pag., Ropažu nov., LV-1024, Latvija — info@starit-academy.com.

2. What we process, and why

• Account data — email, name, password (stored as a hash by our auth provider). Basis: performance of the contract.
• Course progress — which lessons you completed and when, quiz and exam results. Basis: performance of the contract.
• Certificate data — your name, course title, issue date, unique certificate ID. The verification page shows exactly these and nothing else. Basis: performance of the contract.
• Payment data (when payments launch) — handled by Stripe; we never see or store card numbers. Basis: performance of the contract, legal (tax) obligations.
• Support email — what you send to info@, kept as long as needed to help you. Basis: legitimate interest (answering your request and keeping a record of how it was resolved).

Worth knowing: your lab notes and reflections (Lab exercises, capstone drafts) are stored in your own browser (localStorage), not on our servers — they never leave your machine unless a feature explicitly says so.

Who the service is for: the course is built for working professionals. You must be at least 18 to purchase; the service is not directed at children, and we do not knowingly process children's data.

3. AI features

Some course features are AI-powered: the lab assistant you interview, the judge that grades lab answers, and the feedback on your capstone. The text you type into those features (your questions, eval cases, and written capstone sections) is sent to Anthropic PBC (USA) to generate the response. Basis: performance of the contract (the features are part of the course). Anthropic acts as our processor under a data-processing agreement with EU Standard Contractual Clauses, is certified under the EU-US Data Privacy Framework, and does not use API data to train its models. We cap and log usage. Don't paste personal data into lab exercises — the course itself teaches you why.

4. Processors

We use Supabase (database & authentication — your account and course data are stored in the EU, Frankfurt region), Vercel (hosting; global edge network), Resend (transactional email; USA), Stripe (payments; global, DPF-certified), and Anthropic (AI features; USA, see section 3). Each processes data under the data-processing agreement incorporated in its business terms; where data leaves the EEA, EU Standard Contractual Clauses or an adequacy mechanism such as the EU-US Data Privacy Framework applies.

5. Cookies

We set strictly necessary cookies only: the session cookies that keep you logged in. No advertising cookies, no cross-site tracking, no third-party marketing pixels — which is why you don't see a cookie consent banner: there is nothing optional to consent to. If our analytics needs ever grow, we plan to use cookieless analytics; if that ever changes, a consent mechanism will appear before any such cookie is set.

6. Retention

Account and progress data live as long as your account does. Certificates and their verification records are retained for as long as the verification service operates — that's their purpose — unless you ask us to remove yours, which you can do at any time. Invoices are kept as long as tax law requires.

7. Your rights

Access, rectification, erasure, portability, restriction, objection — the full GDPR set — plus the right to withdraw consent at any time where processing is based on consent. Deleting your account (available directly on your account page) removes your personal data; you can also email info@starit-academy.com for any request. We respond within one month. You may lodge a complaint with your local supervisory authority or the Latvian Data State Inspectorate (Datu valsts inspekcija).