Privacy Policy

1. Who we are

AI for School is an education project by AI Safe Lens, an AI literacy practice based in Andalusia, Spain, operated by Diana Szyperska (Y7285659D).

For any privacy-related matters, please contact us at [email protected].

2. What data we collect

Browsing this website collects no personal data. We count page views in aggregate, using Cloudflare Web Analytics: it sets no cookies, uses no cross-site identifier, and tells us which pages were read, never who read them.

Pack purchases. If you buy a resource pack, checkout is handled by Stripe. Stripe collects your payment details and billing information under its own privacy policy; we never see or store your card details. We receive your email address and a confirmation of purchase, which we use to send your personal pack access link and to keep the billing records Spanish accounting and tax law requires us to retain (six years). If you ask us to resend a lost access link, the email address you enter is used only to look up your purchase and send the link again.

Free resources. If you ask for a free pack, the email address you enter is used to send you the access link, and for that alone. It stays in the send log of our email provider (Resend); the link carries a random reference, so nothing in it identifies you. Ask again with the same address and a fresh link is sent.

If you choose to contact us via email or through the Substack link on this site, any data you provide on that platform is governed by its own privacy policy.

3. Purpose and lawful basis of processing

Purchase and pack-access data is processed to deliver what you bought, on the basis of Article 6(1)(b) GDPR (performance of a contract), and to meet legal retention obligations under Article 6(1)(c). The email address you give to receive a free pack is processed on the same basis, Article 6(1)(b): delivering the resource you asked for. We use your data for nothing else: no marketing lists, no profiling, no sharing beyond the processors named below.

4. Cookies, browser storage and tracking

This website sets no analytics, advertising, or tracking cookies. The page-view counting described in section 2 is cookieless. One first-party essential cookie exists per pack you buy: when you open your access link, a cookie scoped to that pack's area (/packs/<pack>) keeps you signed in for up to one year. It exists solely so the site remembers you bought that pack, which we think is the only reasonable thing for a cookie to do. If you never unlock a pack, no cookie is set.

What the courses keep in your browser. The two teacher courses record how far through the lessons you are, your quiz result, the name you type on your certificate, and whatever you write into the course tools: the brief builder, the seven-questions card and the working agreement. Your browser holds all of it, on the computer you are reading on. It reaches no server, and we have no way to read it. Clearing your browser data removes it, and opening a course on a second computer starts the lesson list fresh.

Two short-lived records on our side. Refunded and disputed purchases are listed by their Stripe payment identifier, so a link that was paid for and returned stops opening the pack; that list carries a reason and a date, and no name or address. Separately, to stop the resend form being used to send mail in bulk, we count recent requests against a one-way hash of the address and against the requesting IP address. Those counters expire within the hour.

5. Third-party platforms

This website links to AI Safe Lens's main site (aisafelens.com) and its Substack newsletter. AI for School maintains a presence on Substack to share content and connect with readers and educators. Participation is entirely voluntary. Users are encouraged to review the privacy policies of these platforms before engaging.

6. Hosting and processors (Article 28 GDPR)

This website is hosted and served by Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA), which acts as a data processor on behalf of AI Safe Lens within the meaning of Article 28 GDPR.

As a standard part of web hosting, Cloudflare processes technical data such as IP addresses and request logs for the purpose of serving pages and maintaining service security. This processing is governed by its data processing agreement, which covers international data transfers under Chapter V GDPR (Standard Contractual Clauses and, where certified, the EU-US Data Privacy Framework). We do not instruct Cloudflare to store, analyse, or share visitor data beyond what is technically necessary for hosting.

For pack purchases, two further processors are involved: Stripe (payment processing) and Resend (delivery of pack access emails). A free pack involves Resend only. Each processes only the data needed for its role, under its own GDPR-compliant data processing agreement.

For more information, see the privacy policies of Cloudflare, Stripe, and Resend.

7. International access

This website may be accessed from outside Spain. Any personal data is processed in accordance with EU GDPR standards and Spain's LOPDGDD (Ley Orgánica 3/2018), regardless of the visitor's location.

8. Your rights

Under the GDPR and LOPDGDD, you have the right to access, correct, or delete your personal data, withdraw consent, and lodge a complaint with the Spanish Data Protection Authority (Agencia Española de Protección de Datos — AEPD) at aepd.es. One exception: billing records from pack purchases must by law be retained for six years (Código de Comercio article 30 and Spanish tax law), the legal-obligation exception under GDPR Article 17(3)(b), and cannot be erased early.

To exercise any of these rights, please reach out at [email protected].

9. Changes to this policy

This policy may be updated as AI for School's activities evolve. The latest version will always be available at this URL.