Privacy Policy

1. Introduction and Who We Are

This Privacy Policy explains how AI LABS ("we", "us", or "our"), the operator of AI Wizardry, collects, uses, shares, and protects personal information when you use the AI Wizardry website at aiwizardry.app, our mobile applications, and related services (together, the "Service"). It also explains your rights and choices. It forms part of, and should be read together with, our Terms of Service.

Data controller. For the purposes of the EU and UK General Data Protection Regulation (GDPR), the controller of your personal information is AI LABS, Plot-12, Sonargaon Janapath Road, Sector-12, Uttara, Dhaka-1230, Bangladesh. You can contact us about privacy at privacy@aiwizardry.app.

By using the Service, you acknowledge this Policy. Where the law requires consent for specific processing, we ask for it separately.

2. Information We Collect

Information you provide to us:

• Account information — your email address, display name, and password. Passwords are handled by Google Firebase Authentication; we do not see or store your plaintext password.
• Profile information — a display name, and, where relevant to certificates, your birth year or similar details you choose to provide.
• User Content — the prompts you write, your responses and answers, and any username, public profile, or portfolio information you create.
• Payment information — when paid plans are available, billing details processed by our payment providers. We do not store full payment-card numbers.
• Communications — messages you send us, including support and privacy requests.

Information we collect automatically when you use the Service:

• Learning and usage data — levels, lessons, courses, practice attempts, scores, grades, certificates, streaks, and feature usage.
• Prompt data sent to AI providers — the prompts and answers you submit are transmitted to our AI provider (currently Google's Gemini) to generate scores, feedback, and sample responses.
• Device and log data — IP address, approximate location derived from your IP, device and browser type, operating system, app version, timestamps, referring pages, and error and diagnostic data.
• Analytics and advertising measurement — aggregate usage analytics to understand how the Service is used. Where advertising measurement is enabled and only after you accept cookies, this includes Google Analytics and the Meta (Facebook) pixel, which set cookies and receive event data such as page views, sign-ups, and purchases. If you decline cookies, these are never loaded.
• Security and anti-abuse data — information used to verify requests and protect the Service, including Firebase App Check and reCAPTCHA signals, and rate-limit and usage-quota records.
• Error monitoring — where enabled, diagnostic data via Sentry to detect and fix problems.

Public Content you create — usernames, public certificates available at shareable links, public portfolios, and community "exemplar" submissions are visible to anyone and may be indexed by search engines.

Information from third parties — if you sign in with a third-party provider (such as Google), we receive basic profile information from that provider; and our payment and subscription providers (such as Stripe, SSLCommerz, RevenueCat, or app stores) tell us your subscription status. We do not receive your full payment-card details.

3. How We Use Your Information

We use personal information to:

• create and manage your Account and provide the Service;
• evaluate your prompts and generate scores, feedback, sample responses, and certificates using AI Features;
• personalize content and track your learning progress;
• process payments and manage subscriptions, when available;
• send you transactional messages (such as verification, security, receipts, and important notices) and — only with your consent or where permitted — optional product updates and tips, which you can opt out of at any time;
• measure and improve the Service using aggregate analytics;
• maintain the security, integrity, and reliability of the Service, prevent fraud and abuse, and enforce our Terms and usage limits;
• comply with legal obligations and respond to lawful requests.

4. Legal Bases for Processing (EEA/UK)

If you are in the EEA or UK, we rely on the following legal bases under the GDPR:

• Performance of a contract — to create your Account, provide the Service and AI Features you request, and process Subscriptions.
• Consent — for optional marketing communications and any non-essential processing that requires consent; you may withdraw consent at any time.
• Legitimate interests — to secure and improve the Service, prevent fraud and abuse, and understand usage through privacy-friendly analytics, balanced against your rights and freedoms.
• Legal obligation — to comply with applicable laws, tax and accounting requirements, and lawful requests.

5. AI Processing and Your Prompts

When you use AI Features, the prompts and answers you submit are sent to our third-party AI provider (currently Google's Gemini family of models) to produce scores, feedback, sample responses, and grades. This processing is necessary to provide the features you request.

Please do not include sensitive personal information (such as government identifiers, or health, financial-account, or biometric data), confidential information, or other people's personal data in your prompts. You are responsible for the content of your prompts.

The AI provider processes your prompt content under its own terms and privacy policy to return a response. Under the provider's current API terms, prompt content submitted through the API is generally not used to train its general-purpose models; however, those terms may change, so you should review the provider's terms. AI output is generated automatically and may be inaccurate — see "Automated Decision-Making and Profiling" below.

6. How We Share Information

We do not sell your personal information. We share it only as described here:

• Service providers (processors) acting on our behalf, including: Google Firebase (authentication, database, hosting, and app integrity); Google / Gemini AI (prompt evaluation and generation); Sentry (error monitoring, where enabled); our email-delivery provider (transactional and, with consent, optional emails); and our payment providers (Stripe, SSLCommerz, RevenueCat, and app stores) when paid plans are active. These providers may process your information only on our instructions and under appropriate safeguards.
• Analytics and advertising partners — where advertising measurement is enabled and only after you accept cookies, we share limited event data (such as page views, sign-ups, and completed purchases, together with online identifiers like cookie IDs and IP address) with Google (Google Analytics) and Meta Platforms (the Facebook pixel) so we can measure how well our advertising works. Depending on where you live, this sharing may be treated as "sharing" for cross-context behavioural advertising or as a "sale" of personal information under some laws. You can prevent it entirely by declining cookies in our banner or clearing your consent choice.
• Public Content — information you choose to make public (username, public certificates, portfolios, and exemplars) is shared with anyone who accesses it.
• Legal and safety — we may disclose information where required by law, regulation, legal process, or governmental request, or where we believe disclosure is necessary to protect the rights, safety, or property of users, the public, or us, or to detect, prevent, or address fraud, security, or technical issues.
• Business transfers — if we are involved in a merger, acquisition, financing, reorganization, or sale of assets, your information may be transferred as part of that transaction, subject to this Policy.
• With your consent or at your direction.

7. International Data Transfers

We operate from Bangladesh and use service providers (such as Google) that store and process data on servers in various countries, including a primary database region in Asia (asia-east1) and other locations used by our providers. As a result, your information may be transferred to, stored in, and processed in countries other than your own, whose data-protection laws may differ from those where you live. Where we transfer personal data of EEA/UK users internationally, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision, as applicable. Contact us for more information about these safeguards.

8. Data Retention

We keep personal information for as long as your Account is active or as needed to provide the Service. When you delete your Account, we delete or de-identify your personal data within thirty (30) days, except where we must retain certain records to comply with legal, tax, accounting, or dispute-resolution obligations (for example, payment records once paid plans are live), or to enforce our Terms. Public Content you previously shared may persist where it has been cached or copied by third parties beyond our control. Aggregated or anonymized data that no longer identifies you may be retained indefinitely.

9. Your Privacy Rights

Depending on where you live, you may have some or all of the following rights regarding your personal information:

• Access — request a copy of the personal data we hold about you. You can download your data at any time from your account settings, or email privacy@aiwizardry.app.
• Rectification — correct inaccurate or incomplete data, including by editing your profile.
• Erasure — delete your Account and associated personal data via the in-app "Delete account" option or by contacting us.
• Restriction and objection — restrict or object to certain processing, including processing based on legitimate interests.
• Portability — receive your data in a structured, commonly used, machine-readable format; we provide a JSON export.
• Withdraw consent — withdraw consent for processing based on consent (such as optional marketing) at any time, without affecting prior processing.
• Complaint — lodge a complaint with your local data-protection authority (in the EEA/UK) if you believe we have handled your data unlawfully.

How to exercise your rights. Use the in-app tools (export, delete, profile editing, and the email-preferences toggle) or email privacy@aiwizardry.app. We will respond within the time required by law (generally within thirty (30) days). We may need to verify your identity before acting on a request. You will not be discriminated against for exercising your rights.

EU/UK representative. If we are required to appoint a representative under Article 27 GDPR, the contact details will be published here. In the meantime, you may contact us directly at privacy@aiwizardry.app.

10. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect, use, and disclose; to request access to and deletion of your personal information; to correct inaccurate information; and to be free from discrimination for exercising your rights. We do not sell your personal information for money. Where advertising measurement is enabled and you have accepted cookies, our use of the Meta pixel and Google Analytics may constitute "sharing" for cross-context behavioral advertising as that term is defined under California law; declining cookies in our banner, or withdrawing that consent, opts you out of it entirely, and we honor Global Privacy Control signals where our banner has not already been answered. We do not knowingly share the personal information of consumers under 16. You may exercise your rights using the methods in "Your Privacy Rights" above, and you may use an authorized agent acting on your behalf.

11. Cookies and Similar Technologies

We use strictly necessary cookies and local storage to keep you signed in and remember preferences (such as language and theme). These are always active because the Service cannot work without them. Separately, where advertising measurement is enabled, analytics and advertising cookies from Google (Google Analytics) and Meta (the Facebook pixel) load ONLY after you accept our cookie banner — if you decline, or never answer, they are never loaded and no data reaches those companies. You can change your mind at any time by clearing this site's data in your browser, which resets the banner. You can also control cookies through your browser settings, though disabling essential cookies may prevent the Service from working.

12. Data Security

We use technical and organizational measures designed to protect your information, including encryption in transit (HTTPS/TLS) and at rest, authentication via Google Firebase, access controls limiting who can access data, abuse protections (such as App Check, reCAPTCHA, and rate limiting), and server-side enforcement of account and billing rules. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your credentials confidential.

13. Children's Privacy

The Service is not directed to, and we do not knowingly collect personal information from, children under 13 (or under 16 in the EEA/UK and other regions that set a higher digital-consent age). If you are a parent or guardian and believe a child has provided us personal information without appropriate consent, contact privacy@aiwizardry.app and we will delete it. We comply with applicable children's-privacy laws, including the U.S. Children's Online Privacy Protection Act (COPPA) where relevant.

14. Automated Decision-Making and Profiling

The Service uses AI to score prompts and grade exercises automatically, and uses those results to provide feedback and to determine whether learning activities are completed, which may affect issuance of a certificate. These are educational assessments and are not intended to produce legal or similarly significant effects on you. If you believe an automated result is wrong, you may request human review by contacting privacy@aiwizardry.app, and you may express your point of view or contest the result.

15. Third-Party Links and Services

The Service may link to or rely on third-party websites and services that we do not control. This Policy does not apply to them, and we are not responsible for their privacy practices. Review their policies before providing information.

16. Do Not Track

Browsers and some extensions can send "Do Not Track" (DNT) or Global Privacy Control (GPC) signals. There is no common industry standard for DNT, so we do not respond to it separately — our cookie banner is the control that matters: unless you accept it, no advertising or analytics tracker loads at all. Where you send a GPC signal and have not already answered the banner, we treat it as a decline.

17. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will post the updated Policy with a new "Last updated" date and, where appropriate or required, notify you by email or in-app. Your continued use of the Service after changes take effect constitutes acknowledgment of the updated Policy.

18. How to Contact Us

For privacy questions or to exercise your rights, contact privacy@aiwizardry.app. For general support, support@aiwizardry.app. For security reports, security@aiwizardry.app. Postal address: AI LABS, Plot-12, Sonargaon Janapath Road, Sector-12, Uttara, Dhaka-1230, Bangladesh. If you are in the EEA or UK and are not satisfied with our response, you may contact your local data-protection authority.