Privacy Policy

1. The Data Controller

The controller of personal data is:

• Company name: GALIAN SOFTWARE DEVELOPMENT SRL
• Tax ID (CUI): RO45988048
• Trade Register No.: J12/2051/2022
• Registered office: Str. Tulcea 6, Postal Code 400594, Cluj-Napoca, Cluj County, Romania
• General email: contact@cursuri-ai.ro

1.1 Data Protection Contact Point

For any requests, questions or complaints related to the processing of personal data, or to exercise the rights provided for by the GDPR (access, rectification, erasure, portability, objection, restriction), Users may contact our dedicated data protection contact point:

• GDPR contact email: contact@cursuri-ai.ro (subject: "GDPR")
• Postal address: GALIAN SOFTWARE DEVELOPMENT SRL — Str. Tulcea 6, Postal Code 400594, Cluj-Napoca, Cluj County, Romania (marked "Attn: Data Protection Officer")
• Response time: a maximum of 30 calendar days from receipt of the request (Art. 12(3) GDPR)

Note: Under Art. 37 GDPR, GALIAN SOFTWARE DEVELOPMENT SRL is not required to designate a Data Protection Officer (DPO) — we are not a public authority, we do not process personal data on a large scale as a core activity, and we do not process special categories of data or data relating to criminal convictions. Nevertheless, we have voluntarily established a dedicated contact point to ensure prompt and specialised responses to GDPR requests.

1.2 The Supervisory Authority

If you have not received a satisfactory response to your request, you have the right to lodge a complaint with the supervisory authority:

• The National Supervisory Authority for Personal Data Processing (ANSPDCP) — the Romanian data protection authority
• B-dul G-ral. Gheorghe Magheru nr. 28-30, Sector 1, Postal Code 010336, Bucharest
• Phone: +40.318.059.211 / +40.318.059.212
• Email: anspdcp@dataprotection.ro
• Web: www.dataprotection.ro

The processing of personal data is carried out in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation — GDPR) and Law no. 190/2018 on measures implementing the GDPR in Romania.

2. Categories of Personal Data Collected

2.1. Data provided directly by the User

• Identification data: first name, last name, email address.
• Authentication data: password (stored exclusively in encrypted/hashed form).
• Billing data: information required for issuing invoices (processed through Stripe).
• Voluntary feedback: answers to the satisfaction surveys displayed on the Platform (NPS recommendation score, CSAT satisfaction score and the associated optional comments). Completing these surveys is always voluntary and may be declined without any consequence.
• Questions and suggestions on the blog: when you voluntarily submit a question or a suggestion on a blog article, we collect the display name, the email address and the content of the message, together with the confirmation of your consent to publication and its date. Submission is always voluntary. After approval by a moderator, only the display name and the content of the message are published publicly on the article page; the email address is never published and is used exclusively for contacting you in connection with the message and for preventing abuse.

2.2. Data collected automatically

• Technical data: IP address, browser type, operating system, screen resolution.
• Usage data: pages visited, courses accessed, course progress, results in quizzes and skill assessments, time spent on the platform.
• Product events (first-party analytics): interactions within the Platform (for example: starting or completing a lesson, completing a course, completing the welcome guide, using search, starting a skill assessment). These events are collected and stored exclusively on our servers, without third-party analytics tools, and do not contain directly identifying data (name, email) in the event content.
• Cookies and similar technologies: in accordance with the Cookie Policy.

3. Purposes and Legal Bases of the Processing

4. Data Retention Periods

• Account data: for the lifetime of the account. After a deletion request, marketing communications stop immediately and the data is irreversibly anonymised after 30 days (grace period for cancelling the request); billing data is retained in accordance with the next point.
• Billing data: 5 years from 1 July of the year following the year in which they were drawn up, in accordance with art. 25 of the Romanian Accounting Law no. 82/1991, as amended by Law no. 36/2023, or a longer period where fiscal legislation so requires.
• Usage and progress data: for the lifetime of the account; anonymised upon account deletion.
• Product events (first-party analytics): for the lifetime of the account; upon account deletion, the link to the user is permanently removed and the data remains exclusively in anonymous, aggregated form.
• Voluntary feedback (NPS/CSAT): for the lifetime of the account; permanently deleted upon account deletion.
• Questions and suggestions on the blog: approved messages remain published for as long as the article is available or until the withdrawal of consent or a deletion request; rejected or unapproved messages are deleted within a maximum of 12 months. You may withdraw your consent or request the removal of your message at any time by writing to the contact address in Section 1.1.
• Log of emails sent: metadata (recipient, email type, subject, date sent, delivery events) — 24 months from sending; the HTML content of the email — 90 days, after which it is deleted automatically. Upon account deletion, the subject, content and promotional codes in the log are anonymised (only aggregate figures remain). Details in section 7.1.
• Leads without an account (addresses left in the "send me the syllabus / the guide / new articles" forms): if the address is not confirmed through the link in the verification email (double opt-in), it is deleted within 30 days; after unsubscribing, it is deleted within 12 months. Quote requests from companies are kept for the duration of the pre-contractual steps and, if no contract is concluded, for at most 12 months from the last exchange of messages.
• Technical data (logs): as a rule 30 days, a maximum of 12 months.
• Cookies: in accordance with the durations specified in the Cookie Policy.

4.bis The Affiliate Programme

The Platform runs its own affiliate programme (section 13.4 of the Terms and Conditions). The processing concerns two groups of people: the partners, and the people who reach the Platform through a partner's link.

4.bis.1 Partners' data

• Identification and contact data: name, email address and phone number;
• Billing data entered by the partner in Settings: the address (individuals) or the company name, tax ID (CUI), trade register number and address (companies);
• Payment data: IBAN, account holder name and bank;
• Invoices uploaded by companies for payout requests;
• The affiliate code and link, the custom name chosen for the link, the commissions calculated, the payout requests and the payments made.

Purposes and legal bases: managing the partner account, calculating and paying commissions and the related emails — Art. 6(1)(b) GDPR (performance of the affiliate contract); keeping the supporting documents for payments — Art. 6(1)(c) GDPR (accounting and tax obligations). Retention: for as long as the partner account exists; the supporting documents for payments, in line with section 4.

4.bis.2 What a partner learns about the people they refer

If you create an account after reaching the Platform through a partner's link (attribution is only possible if you accepted marketing cookies, see the Cookie Policy) or through the invitation of a company whose administrator is a partner, the partner sees in their account: your name, your partially hidden email address (for example, jo***@example.com), the date the account was created, whether you have made a payment and the commission due to them. They also receive an email with your name when you create your account and when your first payment generates a commission. For a gift or advertorial order paid through a partner's link, the partner sees the buyer's or the company's name and the commission.

The partner does not see your payment details, the courses you take or any other data in your account.

Legal basis: Art. 6(1)(f) GDPR — the legitimate interest of the Operator and of the partner in calculating and verifying, transparently, the commission due for a referral. You can object to this processing (Art. 21 GDPR) by writing to the contact address in section 1.

4.ter Data of a Gift Recipient

The Platform allows a month of access to be bought as a gift for another person (the Gift page). In this case the buyer provides us with the data of a third party, and the processing has the particular features below.

4.ter.1 Data processed about the recipient

• The recipient's name (optional; it appears on the gift card);
• The recipient's email address (required only if the buyer chooses direct delivery; it is missing when the buyer prefers to hand the code over in person);
• The personal message written by the buyer, if there is one;
• The gift code, its status and, after redemption, the account on which it was redeemed.

4.ter.2 Purposes and legal bases

• Delivering the gift to the recipient (the email with the card and the code) — Art. 6(1)(b) GDPR in relation to the buyer (performance of the contract concluded by the buyer) and Art. 6(1)(f) GDPR in relation to the recipient (the legitimate interest in receiving a product bought for them);
• Reminders about a code that has not been redeemed — Art. 6(1)(f) GDPR; they are strictly limited in number and stop when the code is redeemed or expires;
• Informing the buyer that the gift has been redeemed — Art. 6(1)(b) GDPR.

4.ter.3 What we do NOT do with the recipient's address

The recipient's email address is not added to any marketing list and does not trigger any commercial sequence. The emails they receive on the basis of the gift — the delivery of the code, the reminders about it, the notice that the access is ending — are transactional. The recipient receives commercial communications (including the invitation to continue after the gifted month) only if they create an account on the Platform and give their own consent, in accordance with section 7.1; without that consent, we send them no commercial message.

4.ter.4 The recipient's rights

• They may ignore the gift: no account is created for them and nothing further is processed;
• They may request the erasure of their data related to the gift by writing to contact@cursuri-ai.ro; we erase the name, the address and the message, keeping only the code and the accounting record of the buyer's order;
• The recipient's data is kept for as long as the code can be redeemed, plus the accounting retention periods applicable to the buyer's order (section 4).

5. Recipients of the Data

Personal data may be transmitted to the following categories of recipients:

We do not sell, rent or exchange Users' personal data with third parties for marketing purposes.

6. International Data Transfers

In the case of data transfers outside the European Economic Area (EEA), we ensure that appropriate safeguards are in place, including:

• Standard contractual clauses approved by the European Commission (Art. 46(2)(c) GDPR).
• Adequacy decisions of the European Commission, where available.

7. Rights of Data Subjects

In accordance with the GDPR, Users have the following rights:

• The right of access (Art. 15) — the right to obtain confirmation of the processing and a copy of the data.
• The right to rectification (Art. 16) — the right to correct inaccurate or incomplete data.
• The right to erasure ("the right to be forgotten") (Art. 17) — the right to request the deletion of the data, subject to certain legal exceptions.
• The right to restriction of processing (Art. 18) — the right to limit the processing in certain circumstances.
• The right to data portability (Art. 20) — the right to receive the data in a structured, commonly used and machine-readable format.
• The right to object (Art. 21) — the right to object to processing based on legitimate interest.
• The right not to be subject to an automated decision (Art. 22) — the right not to be subject to a decision based solely on automated processing.

To exercise these rights, the User may send a request to contact@cursuri-ai.ro. We will respond within 30 days of receiving the request.

7.0 Processing through Artificial Intelligence Systems

The Platform uses artificial intelligence ("AI") systems to provide the Virtual AI Professor feature (text chat, synthetic voice, summaries, adaptive quizzes). These systems process:

• The content of your requests (text questions or transcribed audio) — for the purpose of generating an answer relevant to the accessed lesson.
• The lesson context (title, educational content) — so that the AI answers based on the exact content of the course.
• Internal identifiers (the user's ID, the lesson's ID) — for accounting for usage and preventing abuse (fair use).

7.0.1 Storage of Conversations in Our Database

In order to give you access to the history of your conversations with the Virtual AI Professor and for the continuity of your learning experience, we store the conversations (questions + answers) in our database on our servers in the European Union. Conversations are associated with your account and the lesson in which they were initiated.

• What we store: your text questions, the AI-generated answers, the lesson ID, the time of the conversation, the number of messages exchanged.
• What we do NOT store in our database: raw audio recordings (they are processed in real time and deleted immediately after transcription), voice biometric data.
• Legal basis: performance of the contract (Art. 6(1)(b) GDPR) — access to the conversation history is part of the Virtual AI Professor service included in the subscription.
• Storage duration: conversations remain stored for the lifetime of your account. Upon account deletion (section 7 — The right to erasure), conversations are permanently removed from our database within a maximum of 30 days.
• Access to your conversations: only you (from your account) and our technical staff strictly necessary for troubleshooting (under a confidentiality clause). They are not visible to other users.
• Selective deletion: you can delete an individual conversation at any time from the Virtual AI Professor interface, without affecting your account.

This storage is distinct from the processing at the AI providers (Anthropic / OpenAI) described below. The processing at the providers is ephemeral (a maximum of 30 days at the provider); the storage with us lasts for the lifetime of the account, in order to give you access to the history.

7.0.2 AI Providers and International Transfers

AI providers used: artificial intelligence models provided by Anthropic (USA, text models) and OpenAI (USA, synthetic voice and transcription). Data transfers outside the EEA are covered by standard contractual clauses approved by the European Commission (Art. 46(2)(c) GDPR).

Your content is NOT used for training the models. We have DPA agreements with the providers that exclude use for training. Conversational content is automatically deleted at the provider within a maximum of 30 days.

7.0.3 Logging of AI Operations (Audit Trail)

We keep a technical log ("audit log") of each AI operation performed on the platform, in line with the transparency principles of Regulation (EU) 2024/1689 (the AI Act, Art. 50). It contains metadata only — it does NOT contain the text of the questions or of the answers:

• The type of operation (chat, summary, quiz, flashcards, voice, transcription)
• The AI model used (e.g. "claude-haiku-4-5"), the provider (Anthropic / OpenAI)
• The number of tokens consumed and the estimated cost
• The status (success / failure) and the duration of the operation
• The internal user ID and the lesson ID (without direct personal data)

Purpose: technical investigations, troubleshooting, monitoring of the cost and quality of the service, abuse prevention. Legal basis: the Operator's legitimate interest (Art. 6(1)(f) GDPR) — monitoring the cost, quality and security of the service. Retention period: 24 months from the date of the operation, after which the logs are automatically deleted.

7.0.4 AI Transparency (Art. 50 AI Act)

In accordance with Art. 50 of Regulation (EU) 2024/1689 (the AI Act), we explicitly inform you that you are interacting with an AI system, that the answers may contain errors, and that the audio played is a synthetic voice. See the Terms and Conditions, section 10.1, for full details.

7.1 Email Communications, Marketing and the Right to Unsubscribe

7.1.1 Service emails and marketing emails

The Platform sends two categories of emails, on different legal bases:

• Service emails — necessary for the performance of the contract (Art. 6(1)(b) GDPR): the order confirmation on a durable medium, successful or failed payments, cancellation or end of access, the issuing of the certificate of completion, progress in the courses you purchased, invitations and notifications within company accounts, the automatic acknowledgement of messages sent through the contact form, and legal notices (DSA, changes to the Terms). These cannot be switched off while the account is active, because without them we cannot perform the contract; they contain no offers and no unsubscribe links.
• Marketing emails — automated sequences (welcome, first-course nudges, abandoned checkout, re-engagement, win-back), one-off campaigns and offers. You can stop them at any time, with a single click (section 7.1.4).

7.1.2 Legal basis of marketing emails

• Consent (Art. 6(1)(a) and Art. 7 GDPR; art. 12(1) of Romanian Law no. 506/2004 on the processing of personal data and the protection of privacy in the electronic communications sector, transposing Art. 13 of Directive 2002/58/EC) — given through the optional, separate checkbox at registration or in the account settings. Without that checkbox we do not send commercial communications. Consent can be withdrawn at any time, without affecting the lawfulness of prior processing.
• Existing customers (art. 12(2) of Law no. 506/2004) — Users who have purchased a subscription may receive, at the email address obtained at the time of purchase, communications about similar products or services of Cursuri AI, with the possibility to object, simply and free of charge, both when the address is collected and in every message (unsubscribe link).
• Leads without an account — addresses left in the "send me the syllabus", "send me the guide" or "I want new articles" forms are used only after confirmation through the link in the verification email (double opt-in), on the basis of consent. Quote requests from companies are processed as pre-contractual steps at the request of the person (Art. 6(1)(b) GDPR) and are not turned into a marketing subscription without a separate checkbox.

We send at most one marketing email per day to the same address, only on working days and Saturdays, between 09:00 and 19:00 (Romanian time).

7.1.3 Email log, delivery events and address suppression

For every email sent we keep a record (recipient, type, subject, date, HTML content for 90 days) — the legal basis is the performance of the contract for service emails and our legitimate interest (Art. 6(1)(f) GDPR) in proving what we sent, troubleshooting delivery and meeting the accountability obligation (Art. 5(2)). Our email provider, Brevo (processor, Art. 28 GDPR, for all Platform emails), returns to us events about every message: delivered, rejected (bounce), reported as spam, unsubscribed through the email client's button and, where the email client allows it, opened and link clicked. Emails may contain an open-tracking pixel and links redirected through Brevo to record clicks; these events help us measure whether the messages are useful and reduce their frequency. The legal basis is legitimate interest (Art. 6(1)(f) GDPR); you may object at any time (Art. 21 GDPR), most simply by unsubscribing from marketing — after unsubscribing you receive no marketing emails, hence no tracking of them. Open and click data is aggregated into internal statistics and is not passed on to other third parties.

If an email is permanently rejected by the recipient's server (bounce), is blocked, or is marked as spam by the recipient, we suppress the address: we no longer send it marketing emails, and service emails resume only after you update the address in your account. Suppression protects both the recipient and the reputation of our sending domain.

We keep proof of marketing consent — the source (registration, account settings, lead form), the version of the checkbox wording and the date — as well as the date and source of unsubscription, in order to demonstrate compliance with the record-keeping obligations (Art. 5(2) and Art. 7(1) GDPR).

7.1.4 Unsubscribing

You have the right to object at any time to the processing of your data for direct marketing purposes (Art. 21(2) GDPR). We process unsubscribe requests immediately through the following channels:

• A single click on the "Unsubscribe" link in the footer of every marketing email or on the "Unsubscribe" button of your email client (Gmail, Yahoo, Apple Mail, Outlook) — implemented in accordance with RFC 8058 (List-Unsubscribe / List-Unsubscribe-Post One-Click). No login and no further confirmation is required.
• The "Notifications" section in your account (at /app/profile) — toggle between receiving / not receiving marketing emails.
• Email to contact@cursuri-ai.ro with the subject "Unsubscribe" — we process it manually within a maximum of 24 hours.

Unsubscribing from marketing does not affect the service emails described in 7.1.1. To completely stop receiving any emails, you must delete your account (Art. 17 GDPR; see section 7 — The right to erasure).

8. Data Security

We implement appropriate technical and organisational measures to protect personal data, including:

• Encryption of data in transit (HTTPS/TLS).
• Storage of passwords exclusively in hashed form (bcrypt).
• Role-based access control.
• Single session enforcement.
• Access monitoring and activity logging.
• Regular security updates of software components.

9. Children's Data

The Platform is not intended for persons under the age of 16. We do not knowingly collect personal data of minors under this age. If we discover that we have collected such data, we will delete it immediately.

10. Changes to the Privacy Policy

We reserve the right to update this policy. Users will be notified by email and/or through an announcement on the Platform of significant changes. The date of the last update is displayed at the top of this page.

11. Complaints

If you consider that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with:

• The National Supervisory Authority for Personal Data Processing (ANSPDCP) — the Romanian data protection authority
• Address: B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, postal code 010336, Bucharest, Romania
• Website: dataprotection.ro
• Email: anspdcp@dataprotection.ro

12. Contact

For any questions regarding the processing of personal data:

• Email: contact@cursuri-ai.ro
• Address: GALIAN SOFTWARE DEVELOPMENT SRL, Str. Tulcea 6, Postal Code 400594, Cluj-Napoca, Cluj County, Romania