GDPR — Data Protection for EU and UK Users

Who is the data controller?

Coachingle Technologies Private Limited is the data controller for personal data processed through study.coachingle.com. We can be contacted at privacy@coachingle.com.

We are not currently established in the EU or UK. Where required, we will appoint an EU/UK representative under Article 27 GDPR before we begin marketing into specific member states — this page will be updated when that appointment is made.

What personal data we process

• Account data: email address, name, password hash, role (student / tutor / institute admin), country.
• Usage data: pages viewed, study packs generated, queries to the AI tutor. This data is associated with your account so we can show you your history.
• Uploaded content: any documents, photos, or notes you upload for AI processing. Stored in your account; deleted on request.
• Billing data: if you subscribe, name, billing address, last 4 digits of card. Card details are handled by Stripe; we never see the full card number.
• Cookies: see the cookie banner on first visit for the categories.

Lawful basis for processing

• Contract performance (Art. 6(1)(b)): when you create an account and use the service, processing is necessary to deliver what you signed up for.
• Legitimate interests (Art. 6(1)(f)): for product analytics, security monitoring, and abuse prevention. Balanced against your interests.
• Consent (Art. 6(1)(a)): for marketing emails and non-essential cookies. You can withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)): for tax records, fraud prevention, and mandatory disclosures.

Your rights

You have the following rights regarding your personal data:

• Access (Art. 15): request a copy of the personal data we hold about you.
• Rectification (Art. 16): ask us to correct inaccurate data.
• Erasure (Art. 17): ask us to delete your data (the “right to be forgotten”). Note: we may retain limited records where required by law.
• Restriction (Art. 18): ask us to stop processing while a dispute is being resolved.
• Portability (Art. 20): receive your data in a structured, machine-readable format and transmit it to another controller.
• Objection (Art. 21): object to processing based on legitimate interests, including profiling.
• Withdraw consent (Art. 7): withdraw consent at any time for processing based on consent.
• Complaint to a supervisory authority (Art. 77): for UK residents, the Information Commissioner's Office (ICO); ico.org.uk/make-a-complaint. For EU residents, your local data protection authority.

To exercise any of these rights, email privacy@coachingle.com. We respond within 30 days.

International data transfers

Personal data of EU and UK users may be transferred to the United States and to India where our infrastructure providers and team operate. We rely on the following safeguards:

• Standard Contractual Clauses (SCCs) for transfers to non-adequacy countries (US, India).
• UK International Data Transfer Agreement (IDTA) for UK-to-non-adequacy transfers.
• Sub-processors (listed on our Security page) are bound to equivalent data protection commitments via written agreements.

Retention

We retain personal data only for as long as necessary for the purposes described. On account deletion, identifiable data is removed within 30 days. Aggregated, anonymous analytics may be retained longer.

Children

The service is not directed at children under 13. EU users under the digital age of consent in their member state must have a parent or guardian's consent before creating an account.

Data Protection Officer

We do not currently meet the legal threshold for a mandatory DPO (Art. 37 GDPR). For all data protection matters, contact privacy@coachingle.com.