Legal
Privacy
This site collects the least it can get away with: enough to know who you are when you sign in, and enough to know which courses you have bought. There is no analytics, no advertising and no tracking of any kind.
Who is responsible
The data controller is Klajd Koskija, not set — add it to .env, Albania. Questions about anything on this page go to klajd.koskija@cit.edu.al.
What is collected
- Your identity
- Name, email address and profile picture, as supplied by Auth0 when you sign in — including through Google if you use that button. A stable identifier from Auth0 is stored so that your account survives an email change. No password ever reaches this server; sign-in is handled entirely by Auth0.
- Your purchases
- Which courses you own, when you enrolled, the amount and currency, and the Stripe session and payment references needed to match a payment to an enrolment. No card details are collected, seen or stored by this site — the card form is hosted by Stripe.
- Your progress
- Which lessons you have completed and roughly where you are in a video, so a course resumes where you left it.
- Server logs
- Ordinary web-server records and an application log used for diagnosing faults, such as a payment that did not complete. These are kept short.
Why, and on what basis
- To deliver what you bought — your account, enrolments and progress. This is necessary to perform the contract between us.
- To keep the site secure and working — logs and abuse prevention, on the basis of legitimate interest.
- To meet tax and accounting obligations — payment records are retained because the law requires it.
Your data is never sold, rented, or shared for advertising. It is not used to train anything.
Who else processes it
Running this site means using a small number of providers. Each sees only what it needs to do its job:
- Auth0 (Okta) — sign-in and identity.
- Stripe — payment processing. Stripe is the sole handler of card data.
- Cloudflare R2 — storage and delivery of course video.
- Hostinger — hosting of this site and its database.
Some of these operate outside the European Economic Area. Where that is the case, transfers rely on the safeguards those providers publish, typically Standard Contractual Clauses.
Cookies
One cookie, named learn_session. It keeps you signed in and
nothing else — it holds a random session identifier, is marked HttpOnly
and Secure, and expires when you close your browser. It is strictly
necessary for the site to function, which is why you are not being asked
to consent to it. There are no analytics, advertising or third-party
cookies to consent to.
How long it is kept
Your account and enrolments are kept for as long as you have an account, because they are what give you access to what you bought. Records tied to a payment are kept for as long as tax law requires, which is normally several years, even after an account is closed. Logs are kept only as long as they are useful for diagnosing problems.
Your rights
You can ask for a copy of your data, ask for it to be corrected, ask for it to be deleted, ask for it in a portable form, or object to a particular use. Email klajd.koskija@cit.edu.al and you will get an answer within 30 days.
Deleting your account removes your profile and progress. Payment records that must be retained for tax purposes are kept, but are no longer linked to an active account.
If you think your data has been handled badly and raising it directly has not resolved it, you are entitled to complain to your national data protection authority.
Changes
If this policy changes in a way that matters, the date at the top changes with it.