Privacy Policy

1. Scope

This Privacy Policy applies to information we collect from and about visitors, registered users (including individual instructors and institutional users), and people who interact with us by email at contact@koneroanalyticsml.com. It does not cover third-party websites or services we link to. When an institution authorizes its faculty or staff to use CoursePortify, the institution may have its own privacy practices and contractual obligations that apply in addition to (or in place of) this Policy. See the Education records & FERPA section.

2. Information we collect

2.1 Information you provide

• Account information. When you create an account, our identity provider (Clerk, Inc.) collects your name, email address, and authentication credentials. We receive a stable user identifier and your email from Clerk.
• Course content. When you upload an IMS Common Cartridge (.zip / .imscc) or other course package, we receive the contents of that package. Course content commonly includes pedagogical materials, instructions, assessment items, media, and metadata. You should not upload student personally identifiable information (PII) or graded student work to CoursePortify. The platform is designed to translate and evaluate course-design artifacts, not student records.
• Payment information. When you pay for a translation or evaluation job, our payment processor (Stripe, Inc.) collects your payment-method details directly. We do not see your full card number or bank credentials. We receive limited transactional metadata (amount, currency, last 4 digits, country, success / failure status, refund status).
• Support communications. If you email us at contact@koneroanalyticsml.com, we retain your message and contact information so we can respond.

2.2 Information collected automatically

• Usage and access logs. Our hosting provider (Google Cloud Run) records standard request logs including IP address, user-agent, request path, status code, and timestamp. We use these for security monitoring, debugging, and abuse detection.
• Job and processing metadata. For each translation or evaluation job we record metadata such as job identifier, owner identifier, upload size, file count, word count, language pair, processing duration, and completion status.
• Cookies and local storage. See §10 Cookies & similar tech.

2.3 Information from third parties

We receive information from our authentication provider (Clerk) and our payment processor (Stripe) as described above. If you sign in with a federated identity provider (such as Google) we receive only the basic profile fields (name, email, profile image URL) that you authorize during sign-in.

3. How we use information

We use the information described above to:

• Provide, operate, secure, and improve the CoursePortify platform.
• Authenticate users and maintain account sessions.
• Process and translate uploaded course content using our pipeline (which includes large language model providers — see §5).
• Generate evaluation reports and quality metrics for course content.
• Bill, invoice, and process payments and refunds.
• Respond to support requests and communicate about service issues.
• Detect, investigate, and prevent fraud, abuse, security incidents, and Terms violations.
• Comply with legal obligations and enforce our agreements.

We do not sell personal information. We do not use your uploaded course content to train machine-learning models for anyone else's benefit. See §6 AI & automated processing.

4. Legal bases for processing (EU/UK users)

If you are in the European Economic Area, the United Kingdom, or another jurisdiction with similar requirements, we process personal information on these legal bases:

• Contract — to provide the service you requested.
• Legitimate interests — to secure the platform, prevent abuse, and improve our service.
• Consent — where required, for example for non-essential cookies.
• Legal obligation — to comply with applicable law (e.g., tax record retention).

5. Sharing & sub-processors

We share information only as needed to operate the service or comply with law. We rely on the following sub-processors:

Sub-processor	Purpose	Data categories	Region
Google Cloud Platform (Cloud Run, Cloud Storage, Firestore)	Hosting, storage, database	Account metadata, course content, job metadata, logs	United States
Clerk, Inc.	Authentication and identity management	Email address, name, authentication credentials, session tokens	United States
Stripe, Inc.	Payment processing	Payment-method details, billing information, transaction metadata	United States
Google (Vertex AI / Gemini, Cloud Translation)	Machine translation and evaluation	Course content excerpts submitted for translation or quality evaluation	United States

Each sub-processor is contractually bound to confidentiality and to process data only on our documented instructions.

We may also disclose information:

• To comply with a lawful government request, subpoena, or legal process.
• To enforce our Terms of Service or protect the rights, property, or safety of CoursePortify, our users, or others.
• In connection with a merger, acquisition, financing, or sale of assets — in which case the recipient will be bound by privacy commitments at least as protective as those in this Policy.

6. AI & automated processing

CoursePortify uses large language models and machine translation services to translate and evaluate course content. Specifically:

• Course-content excerpts are sent to Google Vertex AI / Gemini and to Google Cloud Translation under enterprise data-processing terms.
• Inputs and outputs are not used by these providers to train their general-purpose models.
• Translation and evaluation outputs are produced automatically by these models. CoursePortify integrates senior pedagogical experts at validation checkpoints (the "Premium Standard"), but the underlying outputs are AI-generated. Outputs may contain errors and should be reviewed before classroom use.
• We do not make consequential decisions about you (such as employment, credit, or housing) based on automated processing.

7. Retention & deletion

• Uploaded course folders. Auto-deleted from active storage 48 hours after upload, regardless of job state, by Cloud Storage lifecycle rules and Firestore TTL policies.
• Job records (metadata only). Retained for up to 90 days for support and audit purposes, then automatically deleted.
• Account information. Retained while your account is active. You may request deletion at any time (see §9); we will delete it within 30 days, subject to legal retention obligations.
• Payment and tax records. Retained as required by U.S. tax law and our payment processor (typically up to 7 years).
• Logs. Retained for up to 90 days for security and operational purposes.

8. Security

We use commercially reasonable administrative, technical, and physical safeguards designed to protect personal information. These include encryption in transit (TLS 1.2+), encryption at rest for stored data, scoped access via Google Cloud IAM, secrets stored in Google Secret Manager, multi-tenant isolation by owner identifier, and short-lived signed URLs for downloads.

No system is perfectly secure. If we learn of a security incident affecting your information, we will notify you and any required regulators in accordance with applicable law.

9. Your privacy rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate personal information.
• Delete your personal information.
• Port your personal information in a portable format.
• Opt out of any "sale" or "sharing" of personal information for cross-context behavioral advertising — we do not engage in either.
• Object to or restrict certain processing.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with your local data-protection authority.

To exercise any of these rights, email contact@koneroanalyticsml.com from the address on your account, or describe your account so we can verify your identity. We will respond within the period required by applicable law (typically within 30–45 days). We will not discriminate against you for exercising a privacy right.

California residents (CCPA/CPRA). You have the rights listed above. We do not sell or share personal information for cross-context behavioral advertising and have not done so in the past 12 months. We do not use sensitive personal information for any purpose other than operating the service. You may designate an authorized agent to exercise your rights.

10. Cookies & similar technologies

CoursePortify uses a small set of essential cookies and storage:

• Session cookies set by Clerk to keep you signed in.
• A signed session cookie set by CoursePortify to persist your owner identifier across requests.
• Browser local storage for short-lived UI state (such as the active dashboard tab).

We do not use third-party advertising cookies, analytics that track you across other websites, or social-media re-targeting pixels. You can block cookies in your browser, but this will prevent the platform from keeping you signed in.

11. Children's privacy

CoursePortify is intended for use by professional educators, instructional designers, and institutional administrators. The service is not directed to children under 13 (or under 16 in the EEA/UK), and we do not knowingly collect personal information from such children. If we learn that we have collected such information without parental consent, we will delete it.

12. Education records & FERPA

The Family Educational Rights and Privacy Act ("FERPA") protects the confidentiality of student "education records" held by educational institutions that receive federal funds. CoursePortify is designed to translate and evaluate course-design artifacts (syllabi, lectures, problem sets, rubrics, and similar institution-owned content) — not student records.

When an educational institution authorizes its faculty or staff to use CoursePortify to process course content under a written agreement, CoursePortify acts as a "school official" with a legitimate educational interest under 34 CFR § 99.31(a)(1)(i)(B), and only to the extent set out in that agreement. CoursePortify will not redisclose education records except as permitted by FERPA and the institution's written instructions.

Institutional buyers may request our standard Data Processing Addendum ("DPA") and FERPA addendum by emailing contact@koneroanalyticsml.com.

13. International data transfers

CoursePortify is operated from the United States and our sub-processors are located in the United States. If you access the service from outside the United States, your information will be transferred to, and processed in, the United States. Where required, transfers from the EEA, UK, or Switzerland are made under Standard Contractual Clauses or another lawful transfer mechanism.

14. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes we will update the "Last updated" date at the top and, where appropriate, notify you by email or by posting a notice on the platform before the change takes effect. Your continued use of the service after a revised Policy becomes effective constitutes your acceptance of it.

15. Contact us

If you have any questions about this Privacy Policy or our privacy practices, please contact us at:

• Email: contact@koneroanalyticsml.com
• Entity: Konero Analytics & Machine Learning LLC
• Mailing address: 11672 E Berry Ave, Englewood, CO 80111, USA