Privacy Policy

1. Who we are and what this covers

This Privacy Policy explains how the operator of Artificial University (“Artificial University”, “we”, “us”) collects, uses, shares and protects personal information when you use artificialuniversity.app, its subdomains, Artificial Canvas, the community showcase, public portfolios and related features (the “Service”). It forms part of our Terms and Conditions.

It covers three kinds of people: visitors to the site, account holders (learners and creators), and users of published creations that we host on a creator’s behalf. For data that visitors provide directly to a creator’s published creation, the creator decides what is collected and why; we process that data on the creator’s behalf (see section 7).

2. Information we collect

Information you give us

• Account details: first and last name, email address and a password. Passwords are stored only as salted hashes; we cannot see them.
• If you continue with Google: Google shares your name, your verified email address and a Google account ID with us, which we use only to create your account and sign you in. We never receive your Google password, and we do not access your Gmail, contacts, files or anything else in your Google account. You can remove our access at any time in your Google Account settings.
• Profile and portfolio: if you create a public portfolio, its handle, display name, headline and the published work you choose to show. Portfolios are public only when you switch them on.
• Course work: lesson, reading and quiz progress, practice submissions, test results and readiness checks.
• Projects and Canvas content: the instructions and messages you send to Artificial Canvas, the conversation history, generated and edited code, drafts, saved versions, project briefs and notes, project “memory”, and any reference images or files you attach to a request.
• Action Studio videos: the descriptions and settings you choose, the clips, photos and reference images you upload, the consent you confirm for people shown in them, and the videos made from them.
• Published creations: the code and assets of anything you publish, its public address, its community listing and case-study text, and any files uploaded through it.
• Invitations, feedback and support: invitation codes you redeem, feedback you send from the Service, and anything you include in messages to us, including the name, email address, topic and message you send through the Contact Us form (and your account, if you are signed in).
• Billing: your plan, billing period, subscription status and renewal date, and the payment partner’s customer and subscription identifiers that link your account to them. Paid plans are sold through our payment partner as merchant of record: you enter your card details, billing address and country directly with that partner, which uses them to take payment, calculate tax and prevent fraud under its own privacy policy. We never receive or store your full card details.

Information collected automatically

• Cookies: a small number of first-party cookies needed to keep you signed in, to remember invitation access, and to count visits to published creations (section 6).
• Advertising measurement (optional): if you allow it, Meta’s pixel on our own pages records which of our pages you visit and whether you open the sign-up form, create an account, start a checkout or buy a plan, and Google’s tag records which of our pages you visit and whether you create an account, start a checkout or buy a plan, so we can tell which of our ads work (section 6).
• Site analytics: which pages of our site are visited, the website that referred a visit and any campaign tag in the link, and how many people are on the site right now. Visitors are counted with a one-way code made from the connecting address and browser that changes every day, so visits cannot be linked across days or traced back to an address, and nothing is stored on your device for this. If you are signed in, your visits and current page are linked to your account so we can see which members are online. This is never shared with third parties and is kept for 90 days.
• Usage metering: which features you use, when, and how much AI capacity each Canvas request consumed, so we can apply plan allowances, daily ceilings and credits.
• Technical logs: our servers record the IP address, browser type, requested address, referring page, timestamp and response status of each request, for security, debugging and abuse prevention. Logs are kept for about 14 days.
• Security records: sign-in attempts per email address and rate-limiting counters keyed by a one-way hash of the connecting address, so repeated attempts can be slowed without storing the address itself.
• Analytics on published creations: when someone uses a published creation, we record the event name, page path, non-sensitive properties chosen by the creator, and a random visitor identifier from a cookie. We reject property names that suggest personal data (such as email, phone or name).

We do not ask for, and ask you not to provide, sensitive personal information such as health, financial account, government ID or biometric data, or information about children, in your account, your prompts or your creations.

3. How we use information

• To provide the Service — creating and securing your account, saving progress and projects, generating and previewing code, publishing creations, hosting them at their public addresses, and showing your portfolio and community listings when you choose to publish them. (Legal basis: performance of our contract with you.)
• To meter and bill — applying credit allowances and plan limits, processing subscriptions, preventing accounts from being created in bulk. (Contract; legitimate interests.)
• To keep the Service safe — detecting and preventing abuse, fraud, unauthorised access and security incidents; enforcing our Terms; rate limiting. (Legitimate interests; legal obligation.)
• To communicate with you — account and security emails such as password recovery, notices about your plan, changes to these policies, and replies to your messages. We do not send marketing email without your consent, and you can opt out of any marketing at any time. (Contract; consent.)
• To improve the Service — understanding which lessons and features are used, fixing errors, and evaluating changes, using aggregated or de-identified information where possible. (Legitimate interests.)
• To measure our advertising — where you allow it, learning which of our ads on Facebook and Instagram lead to sign-ups and purchases, so we can show them to people likely to find the Service useful (section 6). (Consent, or in the US, subject to your right to opt out.)
• To comply with law — responding to lawful requests and protecting rights, safety and property. (Legal obligation; legitimate interests.)

We do not use your personal information for automated decisions that produce legal or similarly significant effects about you. We never use your projects, Canvas instructions, course work or published creations for advertising.

4. AI processing

• Artificial Canvas and some course features are powered by artificial intelligence provided by third-party AI providers. To fulfil a request we send them the instructions you type, the relevant project context (code, pages, brief, recent conversation), any reference images or files you attach, and system instructions we author. The provider returns generated text, code or images. When a build calls for photos, the image descriptions Canvas writes from your request are sent to the provider to create them.
• Those providers process this content under their own terms and security commitments. We choose providers that do not use our customers’ content to train their models under the arrangements we use; provider practices can change, and we will update this policy if our arrangements materially change.
• Action Studio (paid plans) makes videos with third-party AI video providers. To make a video we send them your description, the settings you chose and any clips, photos or reference images you add. Video providers process this content under their own terms, which can differ from the arrangements described above. Your uploads are stored privately; a provider can fetch one only through a link that expires after 48 hours.
• Finished videos are private to your account: only you can watch or download them, until you publish one to the Community page. A published video can be watched by anyone and shows a “Created on Artificialuniversity.app” watermark unless you turn it off when publishing; you can make it private again at any time. Only upload people who have agreed to appear in your video.
• Generated output is stored with your project so you can revisit, restore and publish it.
• The people who run Artificial University can view the projects you create — including ones you have not published — together with their Canvas conversations, to support you, keep the platform safe, enforce our Terms and improve Canvas. Each such view is recorded in an internal access log.
• Photos generated for a project are stored on our servers as image files, together with the description they were made from and the account they were made for. Like any image on a website, a photo can be opened by anyone who has its link; each link is a long random address that is not listed or searchable anywhere.
• Do not include in a prompt or attachment anything you are not entitled to share, or anything you would not want processed by a third party.

5. Who we share information with

• Service providers that process data on our behalf and only as needed to run the Service: hosting and infrastructure, AI generation, transactional email delivery, and payment processing. They are bound by contractual confidentiality and data-protection obligations. A current list of provider categories is available on request.
• Our payment partner, which sells our paid plans as merchant of record and is named on the checkout page. When you subscribe we share your account email and name with it so it can take payment, calculate and remit taxes, prevent fraud and support your purchase. For that purchase the partner is responsible for the data you give it directly, under its own privacy policy.
• Our advertising partner, Meta Platforms (Facebook and Instagram), only if you allow advertising measurement: the events described in section 6, together with your IP address, browser details, Meta’s cookie identifiers and, for account events, your email address, name and account ID in hashed (scrambled) form so Meta can match the event to a Meta account. Meta processes this under its own terms and data policy, which include using it to deliver and improve ads.
• Our advertising partner, Google (Google Ads), only if you allow advertising measurement: the pages of ours you visit, that an account was created and, when you start a checkout or buy a plan, the plan’s price and an order reference, together with your IP address, browser details and Google’s cookie identifiers (including the ad click, when you arrive from one of our ads). We do not send Google your email address, name or account details. Google processes this under its own terms and privacy policy, which include using it to deliver and improve ads.
• Creators, when you use their published creation: anything you enter into that creation, and the fact that your account used it, is available to the creator as described in section 7.
• The public, when you choose to publish: published creations, community listings, case-study text and public portfolios are visible to anyone, may be indexed by search engines, and may be copied by others.
• Legal and safety reasons: when we believe disclosure is required by law, a valid legal process, or to protect the rights, safety or property of users, the public or Artificial University.
• Business transfers: if Artificial University is reorganised, sold or merged, information may be transferred to the successor, who must honour this policy.

We do not sell personal information for money, and we do not give it to other companies to market their own products to you. Some US state laws treat advertising measurement like Meta’s pixel and Google’s tag as “sharing” personal information for cross-context behavioural advertising; you can opt out at any time (section 6).

6. Cookies and browser storage

Cookies the Service needs

• au_session — keeps you signed in. Contains a random token, not your password. Removed when you sign out or when it expires.
• au_google and au_google_signup — only while you continue with Google: they tie the sign-in to your browser and hold your place until you accept our terms. They expire after 10 minutes.
• au_beta — remembers that this browser redeemed an invitation during invitation-only access. Expires after 30 days.
• au_analytics_visitor — a random identifier set when you use a published creation, so the creator’s analytics can count visits without personal details. It is not linked to your name or email.

Your browser may also hold small pieces of local storage, such as which project you last opened, and the sandboxed preview of a creation may keep that creation’s own temporary state. None of this is sent to third parties.

Advertising measurement (optional)

We advertise on Facebook, Instagram and Google (including YouTube). To learn which ads work, our own pages can use Meta’s pixel and send the same events from our server to Meta, and can use Google’s tag, which records page visits, new accounts, checkout starts and completed purchases (for checkouts and purchases, the plan’s price and an order reference; never your name or email). We record page visits, viewing our plans, opening the sign-up form, creating an account, starting a checkout, and buying a plan (with the plan and the amount paid). We never send your projects, Canvas instructions, course work, passwords or card details, and neither the pixel nor the tag ever runs on published creations. When you open checkout with measurement allowed, we keep that browser’s Meta identifiers, IP address and browser details for up to 30 days, only so a completed purchase can be reported once even if you close the page before returning to our site.

• Your choice comes first: outside the United States we ask before measuring and nothing runs until you accept. In the United States measurement is on unless you opt out, and we show a notice on your first visit. A Global Privacy Control signal from your browser is always treated as an opt-out.
• au_ads_choice and au_ads — remember your choice for a year so we do not ask again; our server checks au_ads before sending any event to Meta. au_ads_notice remembers that you have seen the notice.
• _fbp and _fbc — Meta’s cookies, set only if measurement is allowed. They identify this browser and, when you arrive from one of our ads, the ad click. They last about 90 days.
• _gcl_au and _gcl_aw — Google’s advertising cookies, set only if measurement is allowed. They identify this browser and, when you arrive from one of our Google ads, the ad click, so a later purchase can be credited to that ad. They last about 90 days.
• Changing your mind: use “Your privacy choices” at the bottom of any page. Declining never changes what you can do on the Service.

Apart from Global Privacy Control, we do not respond to “Do Not Track” signals, which have no common standard. You can also clear or block cookies in your browser; signing in requires the session cookie.

7. Data inside published creations

• A published creation can store data for the people who use it — for example records, shared collections, uploaded files and analytics events — using the managed data features of the Service. Where a creation asks you to sign in with your Artificial University account, the data you save is kept separately for your account within that creation.
• The creator of a creation decides what it collects and how it is used, and is responsible for informing their users and complying with privacy law. Artificial University stores and secures that data on the creator’s behalf, restricts each creation to its own data, and does not use it for any other purpose.
• Creators may connect their own third-party services (for example email or checkout). Data sent to those services is governed by the creator’s arrangements with them, not by this policy.
• If you have questions about data you provided to a creation, contact its creator first. If you cannot reach them, contact us and we will help where we reasonably can, including by removing your data from our systems.

8. How long we keep information

• Account, progress and projects: for as long as your account exists. When you close your account or ask us to delete it, we delete or de-identify this information within 30 days, except as described below.
• Published creations, portfolios and community listings: until you unpublish or delete them, your account is closed, or we remove them under the Terms.
• Backups: routine backups are kept for about 14 days and then overwritten; deleted data may persist in them for that period.
• Site analytics: 90 days. Contact messages: as long as needed to answer them and keep a record of support, then deleted on request.
• Technical logs and security records: about 14 days for access logs; sign-in attempt and rate-limiting counters reset within hours.
• Billing records: as long as required by tax and accounting law.
• Legal holds: longer where we must keep information to comply with law, resolve disputes, prevent abuse or enforce our agreements.

9. Security

We protect information with measures appropriate to its sensitivity, including encryption in transit (HTTPS everywhere, with HSTS), salted password hashing, hashed session and recovery tokens, per-account access checks on every request, rate limiting, isolation of generated code in a sandbox that cannot reach your session or our systems, restricted access to servers and databases, and encrypted backups kept off the public internet. No method of transmission or storage is completely secure; if we learn of a breach affecting your personal information we will notify you and any authority as the law requires.

10. Where information is stored

Our servers are currently located in the United States, and our service providers may process information in the United States or other countries. If you use the Service from elsewhere, including the European Economic Area, the United Kingdom or Switzerland, your information will be transferred to and processed in those countries, whose laws may differ from yours. Where required, we rely on appropriate safeguards for such transfers, such as standard contractual clauses with our providers, and you may ask us for more information about them.

11. Your rights and choices

• Access, correction and deletion: you can view and update your name and email in your account, and you can ask us to provide a copy of, correct or delete the personal information we hold about you. Paid plans also let you export your project code directly.
• Closing your account: ask us to close your account and we will delete it as described in section 8. Published creations are taken down when the account is closed.
• Marketing: we do not send marketing email without consent; where you have consented, every message includes a way to opt out.
• Cookies and advertising measurement: use “Your privacy choices” at the bottom of any page, turn on Global Privacy Control, or control cookies in your browser (section 6).
• If you are in the EEA, UK or Switzerland you also have the rights to restrict or object to processing, to data portability, to withdraw consent at any time without affecting earlier processing, and to lodge a complaint with your data-protection authority.
• If you are a California resident (or live in another US state with a similar law) you have the rights to know what personal information we collect, use and disclose, to delete it, to correct it, to opt out of its “sale” or “sharing” for cross-context behavioural advertising, and not to be discriminated against for exercising these rights. We do not sell personal information for money. Advertising measurement with Meta and Google may count as sharing; opt out with “Your privacy choices” or Global Privacy Control.

To exercise any right, email us at the address in section 15 from the address on your account, or include enough information for us to verify that the request is yours. We respond within the time the applicable law allows, normally within 30 days, and we will not charge for reasonable requests.

12. Children

The Service is intended for adults. People under 18 may use it only with the consent and supervision of a parent or legal guardian, as set out in the Terms. We do not knowingly collect personal information from children under 13 (or the higher age that applies where you live) without such consent. If you believe a child has provided us personal information without it, contact us and we will delete it.

13. Third-party links and services

The Service and published creations may link to or integrate with websites and services we do not operate, including checkout pages, external tools referenced in lessons, and services a creator connects to their creation. Their privacy practices are their own; please review their policies before providing information to them.

14. Changes to this policy

We may update this policy as the Service, our providers or the law change. The effective date and version at the top will change when we do. For material changes we will notify you through the Service or by email before they take effect. Continuing to use the Service after that date means the updated policy applies; if you do not agree, stop using the Service and ask us to close your account.

15. Contact

Privacy questions, requests to exercise your rights, and reports of security issues can be sent to artificialuniversityapp@gmail.com.