Privacy Policy

1. Who We Are

csmasters.dev is operated by Artem Blazhievskii, an individual based in the Philippines. For the purposes of applicable data protection laws, Artem Blazhievskii is the data controller responsible for your personal data.

Privacy inquiries: [email protected]

2. Data We Collect

We collect only the data necessary to provide our educational service:

3. How & Why We Use Your Data

We process your data for the following purposes:

• Providing the Service (contractual necessity): authenticating your account, maintaining curriculum progress, delivering autotest feedback, and generating AI Tutor responses
• Billing (contractual necessity): managing subscriptions, processing refunds, and fulfilling purchase agreements via Lemon Squeezy
• Safety & security (legitimate interest): preventing abuse, enforcing acceptable use, and responding to safety reports
• Product notifications (consent): sending optional feature release emails, only when you opt in
• Aggregate analytics (legitimate interest): understanding how the Service is used in aggregate to improve the learning experience, using Umami which does not identify individual users

We do not sell your personal data. We do not use student data for advertising or profiling.

4. AI Tutor Processing (OpenAI)

The AI Tutor is powered by OpenAI. When you use the AI Tutor, minimized content from your interaction is sent to OpenAI’s API. Here is how your data is handled:

• We send requests with store: false, which prevents storage of application state for later retrieval through the API
• Separate OpenAI abuse-monitoring logs may retain API inputs for up to 30 days
• OpenAI’s API content is not used for model training by default. We have not opted in to training data usage
• Questions containing detectable emails, phone numbers, self-identified names, school affiliations, or addresses are blocked and returned for correction before persistence. Other free-form Tutor context is filtered with redaction tokens before job processing and transmission
• Automated filtering reduces exposure but cannot guarantee complete anonymization. Avoid sharing personal information in Tutor conversations

5. Processors & Third Parties

We share data with the following service providers, strictly for the purposes described:

• OpenAI (United States) — processes minimized AI Tutor content via API
• Lemon Squeezy (United States) — Merchant of Record handling payments, billing, tax, and refunds
• Umami — privacy-focused, cookieless web analytics (no personal data collected, no individual tracking)
• Infrastructure provider — cloud hosting for the application and database

We do not sell, rent, or share your personal data with any other third parties for their own purposes.

6. International Transfers

Our Service is operated from the Philippines. Your data may be processed in the United States (OpenAI, Lemon Squeezy) and other jurisdictions where our infrastructure providers operate. We rely on contractual agreements with our processors to provide appropriate safeguards for your data. Data protection standards vary by jurisdiction, and we cannot guarantee that all jurisdictions provide the same level of protection as your home country.

7. Cookies & Local Storage

We use essential and functional browser storage and do not currently use advertising, marketing, or cross-site tracking cookies. If non-essential storage is introduced, we will update this notice and obtain consent where required.

Analytics: Umami is our analytics tool. It is cookieless and does not store any data in your browser.

8. Retention

We retain your data for the following periods:

• Account and learning data: retained while your account is active; verified deletion requests are reviewed and completed within the stated response period subject to legal exceptions
• AI Tutor conversations: deleted with your account
• Guardian authorization records: deleted with the learner’s account
• Server logs (IP, user agent): retained according to the infrastructure provider’s operational and security settings
• Payment records: retained by Lemon Squeezy and, where applicable, by us for tax, accounting, dispute, and other legal obligations
• Data request records: retained as needed to document verification, fulfillment, disputes, and compliance

9. Security

We implement the following security measures to protect your data:

• Passwords are hashed using bcrypt (never stored in plain text)
• All traffic is encrypted via HTTPS with HSTS enforcement
• CSRF protection on all state-changing requests
• Rate limiting on authentication and sensitive endpoints
• Code execution is sandboxed in isolated environments
• Database-backed sessions with signed, HttpOnly cookies

No system is perfectly secure. We cannot guarantee absolute security, but we are committed to following industry-standard practices and promptly addressing any vulnerabilities.

10. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access — request a copy of your personal data
• Correction — request correction of inaccurate data
• Deletion — request deletion of your account and data (subject to legal retention requirements)
• Restriction — request that we limit processing of your data
• Objection — object to processing based on legitimate interest
• Data portability — request your data in a structured, machine-readable format (where technically feasible)
• Withdraw consent — withdraw consent for optional processing (e.g. marketing emails) at any time

To exercise any of these rights, submit a data request or email [email protected]. Public form requests must be verified through an email link that expires after 48 hours. A signed-in request using the account email is treated as email-verified. We do not begin fulfillment before verification and may request additional identity evidence where needed. We aim to respond within 30 days, subject to applicable law.

11. Information for Parents & Guardians

12. Data Subject Requests

We provide a dedicated data request form for submitting access, correction, deletion, and guardian withdrawal requests. Public requests enter the operator review queue only after an expiring email-verification link is used; signed-in requests using the account email are verified immediately.

We will process your request within 30 days. In some cases, we may need to retain certain data to comply with legal obligations (e.g. tax records for payment transactions). We will inform you of any retention exceptions in our response.

13. Children’s Privacy

The Service is available to individuals aged 13 and older. We do not knowingly collect data from children under 13. If we discover that a user is under 13, we will promptly delete their account and associated data.

For learners aged 13–17, guardian authorization is required before accessing paid features, including the AI Tutor. See Section 11 for guardian-specific information.

14. Complaints

If you have concerns about how we handle your data, please contact us first at [email protected]. We will work to resolve your concern promptly.

You may also have the right to lodge a complaint with the data protection authority in your jurisdiction. For users in the Philippines, this is the National Privacy Commission. For users in the EU/EEA, this is your local supervisory authority. For users in the UK, this is the Information Commissioner’s Office (ICO).

15. Changes to This Policy

We may update this Privacy Policy from time to time. Each version is identified by its version date. We will notify registered users of material changes via email or a prominent notice on the Service. Continued use of the Service after changes are posted constitutes acceptance of the updated policy.

16. Contact

For privacy inquiries, data requests, or concerns about this policy:
[email protected]

For general support:
[email protected]