Privacy Policy

1. Introduction and Who We Are

This Privacy Policy explains how AI LABS ("we", "us", or "our"), the operator of AI Wizardry, collects, uses, shares, and protects personal information when you use the AI Wizardry website at aiwizardry.app, our mobile applications, and related services (together, the "Service"). It also explains your rights and choices. It forms part of, and should be read together with, our Terms of Service.

Data controller. For the purposes of the EU and UK General Data Protection Regulation (GDPR), the controller of your personal information is AI LABS, Dhaka, Bangladesh. You can contact us about privacy at privacy@aiwizardry.app.

By using the Service, you acknowledge this Policy. Where the law requires consent for specific processing, we ask for it separately.

2. Information We Collect

Information you provide to us:

• Account information — your email address, display name, and password. Passwords are handled by Google Firebase Authentication; we do not see or store your plaintext password.
• Profile information — a display name, and, where relevant to certificates, your birth year or similar details you choose to provide.
• User Content — the prompts you write, your responses and answers, and any username, public profile, or portfolio information you create.
• Payment information — when paid plans are available, billing details processed by our payment providers. We do not store full payment-card numbers.
• Communications — messages you send us, including support and privacy requests.

Information we collect automatically when you use the Service:

• Learning and usage data — levels, lessons, courses, practice attempts, scores, grades, certificates, streaks, and feature usage.
• Prompt data sent to AI providers — the prompts and answers you submit are transmitted to our AI provider (currently Google's Gemini) to generate scores, feedback, and sample responses.
• Device and log data — IP address, approximate location derived from your IP, device and browser type, operating system, app version, timestamps, referring pages, and error and diagnostic data.
• Analytics — privacy-friendly, cookie-free usage analytics via Plausible Analytics, which does not track individuals across sites or store personal identifiers.
• Security and anti-abuse data — information used to verify requests and protect the Service, including Firebase App Check and reCAPTCHA signals, and rate-limit and usage-quota records.
• Error monitoring — where enabled, diagnostic data via Sentry to detect and fix problems.

Public Content you create — usernames, public certificates available at shareable links, public portfolios, and community "exemplar" submissions are visible to anyone and may be indexed by search engines.

Information from third parties — if you sign in with a third-party provider (such as Google), we receive basic profile information from that provider; and our payment and subscription providers (such as Stripe, SSLCommerz, RevenueCat, or app stores) tell us your subscription status. We do not receive your full payment-card details.

3. How We Use Your Information

We use personal information to:

• create and manage your Account and provide the Service;
• evaluate your prompts and generate scores, feedback, sample responses, and certificates using AI Features;
• personalize content and track your learning progress;
• process payments and manage subscriptions, when available;
• send you transactional messages (such as verification, security, receipts, and important notices) and — only with your consent or where permitted — optional product updates and tips, which you can opt out of at any time;
• measure and improve the Service using aggregate analytics;
• maintain the security, integrity, and reliability of the Service, prevent fraud and abuse, and enforce our Terms and usage limits;
• comply with legal obligations and respond to lawful requests.

4. Legal Bases for Processing (EEA/UK)

If you are in the EEA or UK, we rely on the following legal bases under the GDPR:

• Performance of a contract — to create your Account, provide the Service and AI Features you request, and process Subscriptions.
• Consent — for optional marketing communications and any non-essential processing that requires consent; you may withdraw consent at any time.
• Legitimate interests — to secure and improve the Service, prevent fraud and abuse, and understand usage through privacy-friendly analytics, balanced against your rights and freedoms.
• Legal obligation — to comply with applicable laws, tax and accounting requirements, and lawful requests.

5. AI Processing and Your Prompts

When you use AI Features, the prompts and answers you submit are sent to our third-party AI provider (currently Google's Gemini family of models) to produce scores, feedback, sample responses, and grades. This processing is necessary to provide the features you request.

Please do not include sensitive personal information (such as government identifiers, or health, financial-account, or biometric data), confidential information, or other people's personal data in your prompts. You are responsible for the content of your prompts.

The AI provider processes your prompt content under its own terms and privacy policy to return a response. Under the provider's current API terms, prompt content submitted through the API is generally not used to train its general-purpose models; however, those terms may change, so you should review the provider's terms. AI output is generated automatically and may be inaccurate — see "Automated Decision-Making and Profiling" below.

6. How We Share Information

We do not sell your personal information. We share it only as described here:

• Service providers (processors) acting on our behalf, including: Google Firebase (authentication, database, hosting, and app integrity); Google / Gemini AI (prompt evaluation and generation); Plausible (cookie-free analytics); Sentry (error monitoring, where enabled); our email-delivery provider (transactional and, with consent, optional emails); and our payment providers (Stripe, SSLCommerz, RevenueCat, and app stores) when paid plans are active. These providers may process your information only on our instructions and under appropriate safeguards.
• Public Content — information you choose to make public (username, public certificates, portfolios, and exemplars) is shared with anyone who accesses it.
• Legal and safety — we may disclose information where required by law, regulation, legal process, or governmental request, or where we believe disclosure is necessary to protect the rights, safety, or property of users, the public, or us, or to detect, prevent, or address fraud, security, or technical issues.
• Business transfers — if we are involved in a merger, acquisition, financing, reorganization, or sale of assets, your information may be transferred as part of that transaction, subject to this Policy.
• With your consent or at your direction.

7. International Data Transfers

We operate from Bangladesh and use service providers (such as Google) that store and process data on servers in various countries, including a primary database region in Asia (asia-east1) and other locations used by our providers. As a result, your information may be transferred to, stored in, and processed in countries other than your own, whose data-protection laws may differ from those where you live. Where we transfer personal data of EEA/UK users internationally, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision, as applicable. Contact us for more information about these safeguards.

8. Data Retention

We keep personal information for as long as your Account is active or as needed to provide the Service. When you delete your Account, we delete or de-identify your personal data within thirty (30) days, except where we must retain certain records to comply with legal, tax, accounting, or dispute-resolution obligations (for example, payment records once paid plans are live), or to enforce our Terms. Public Content you previously shared may persist where it has been cached or copied by third parties beyond our control. Aggregated or anonymized data that no longer identifies you may be retained indefinitely.

9. Your Privacy Rights

Depending on where you live, you may have some or all of the following rights regarding your personal information:

• Access — request a copy of the personal data we hold about you. You can download your data at any time from your account settings, or email privacy@aiwizardry.app.
• Rectification — correct inaccurate or incomplete data, including by editing your profile.
• Erasure — delete your Account and associated personal data via the in-app "Delete account" option or by contacting us.
• Restriction and objection — restrict or object to certain processing, including processing based on legitimate interests.
• Portability — receive your data in a structured, commonly used, machine-readable format; we provide a JSON export.
• Withdraw consent — withdraw consent for processing based on consent (such as optional marketing) at any time, without affecting prior processing.
• Complaint — lodge a complaint with your local data-protection authority (in the EEA/UK) if you believe we have handled your data unlawfully.

How to exercise your rights. Use the in-app tools (export, delete, profile editing, and the email-preferences toggle) or email privacy@aiwizardry.app. We will respond within the time required by law (generally within thirty (30) days). We may need to verify your identity before acting on a request. You will not be discriminated against for exercising your rights.

EU/UK representative. If we are required to appoint a representative under Article 27 GDPR, the contact details will be published here. In the meantime, you may contact us directly at privacy@aiwizardry.app.

10. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect, use, and disclose; to request access to and deletion of your personal information; to correct inaccurate information; and to be free from discrimination for exercising your rights. We do not "sell" or "share" your personal information for cross-context behavioral advertising as those terms are defined under California law. You may exercise your rights using the methods in "Your Privacy Rights" above, and you may use an authorized agent acting on your behalf.

11. Cookies and Similar Technologies

We use only strictly necessary cookies and local storage to keep you signed in and remember preferences (such as language and theme). Our analytics provider, Plausible, is cookie-free and does not use cross-site tracking or store personal identifiers. We do not use advertising or third-party tracking cookies. Where a consent banner is shown, you can manage non-essential preferences there. You can also control cookies through your browser settings, though disabling essential cookies may prevent the Service from working.

12. Data Security

We use technical and organizational measures designed to protect your information, including encryption in transit (HTTPS/TLS) and at rest, authentication via Google Firebase, access controls limiting who can access data, abuse protections (such as App Check, reCAPTCHA, and rate limiting), and server-side enforcement of account and billing rules. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your credentials confidential.

13. Children's Privacy

The Service is not directed to, and we do not knowingly collect personal information from, children under 13 (or under 16 in the EEA/UK and other regions that set a higher digital-consent age). If you are a parent or guardian and believe a child has provided us personal information without appropriate consent, contact privacy@aiwizardry.app and we will delete it. We comply with applicable children's-privacy laws, including the U.S. Children's Online Privacy Protection Act (COPPA) where relevant.

14. Automated Decision-Making and Profiling

The Service uses AI to score prompts and grade exercises automatically, and uses those results to provide feedback and to determine whether learning activities are completed, which may affect issuance of a certificate. These are educational assessments and are not intended to produce legal or similarly significant effects on you. If you believe an automated result is wrong, you may request human review by contacting privacy@aiwizardry.app, and you may express your point of view or contest the result.

15. Third-Party Links and Services

The Service may link to or rely on third-party websites and services that we do not control. This Policy does not apply to them, and we are not responsible for their privacy practices. Review their policies before providing information.

16. Do Not Track

Because we do not track users across third-party websites for advertising, and our analytics are cookie-free, we do not behave differently in response to browser "Do Not Track" signals — we simply do not engage in cross-site tracking.

17. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will post the updated Policy with a new "Last updated" date and, where appropriate or required, notify you by email or in-app. Your continued use of the Service after changes take effect constitutes acknowledgment of the updated Policy.

18. How to Contact Us

For privacy questions or to exercise your rights, contact privacy@aiwizardry.app. For general support, support@aiwizardry.app. For security reports, security@aiwizardry.app. Postal address: AI LABS, Dhaka, Bangladesh. If you are in the EEA or UK and are not satisfied with our response, you may contact your local data-protection authority.