Sign in

Last updated: 2026-06-24

Privacy Policy

This Privacy Policy explains how Prompt Learn (“the Service”), operated by Prompt under Aaltoes (Aalto Entrepreneurship Society), collects, uses, and protects your personal data. The Service is a free, not-for-profit educational platform. The data controller is Aaltoes. You can reach us at privacy@aaltoes.com.

1. What data we collect

Account data

When you create an account, our authentication provider Clerk collects and stores your email address, and optionally your display name and profile avatar. We do not store your password — Clerk handles credentials using industry-standard security practices.

Learning activity

Once signed in, we store your lesson progress (which lessons you have started or completed), bookmarks, and any lesson feedback you submit (thumbs-up/down ratings and optional free-text comments). This data is tied to your account and lives in our Neon database.

Suggest-a-topic submissions

If you use the “Suggest a lesson, tool, or resource” form, your submission text and your account ID are stored so the Prompt team can review and act on your suggestion.

AI helper messages

The in-lesson and in-page AI helper sends the text you type to one or more AI model providers (see Section 4) to generate a reply. We do not permanently store the contents of these messages on our servers beyond what is necessary to route the request.

IP address (rate-limiting)

Your IP address is used transiently to enforce per-user rate limits on the AI helper. It is not stored in a database, logged long-term, or associated with your account.

Usage analytics

We use Vercel Web Analytics, a privacy-friendly, cookieless analytics product. It counts page views and unique visitors using anonymised, aggregated data. No tracking cookies are set and no personal profiles are built.

2. Legal basis (GDPR Article 6)

  • Contract performance (Art. 6(1)(b)): Processing your account data and learning activity is necessary to provide the Service you signed up for.
  • Legitimate interest (Art. 6(1)(f)): Transient IP processing for rate-limiting is based on our legitimate interest in protecting the Service from abuse.
  • Consent (Art. 6(1)(a)): Where we ask for optional data (e.g. profile avatar, lesson feedback comments), you may withdraw consent at any time by editing or deleting your account.

3. How we use your data

  • To create and maintain your account
  • To track your learning progress and show it back to you
  • To improve the curriculum by reviewing anonymous, aggregated feedback
  • To review lesson/tool/resource suggestions submitted through the form
  • To prevent abuse of the AI helper (rate-limiting)
  • To understand overall usage patterns via anonymised analytics

We do not sell your data or use it for advertising.

4. Third-party processors

We share your data only with the following processors and only to the extent necessary to provide the Service:

  • Clerk — authentication and account management. Processes your email, name, and avatar. See Clerk Privacy Policy.
  • Neon — PostgreSQL database hosting. Stores your learning progress, bookmarks, feedback, and suggestions. We choose EU regions where available. See Neon Privacy Policy.
  • Vercel — application hosting and anonymised web analytics. See Vercel Privacy Policy.
  • AI model providers (Google Gemini, Groq, Anthropic) — when you send a message to the AI helper, the text of that message is forwarded to one of these providers to generate a response. Please review their respective privacy policies: Google, Groq, Anthropic.

5. Data retention

Your account data and learning activity are retained for as long as your account is active. You can request deletion of your account and personal data at any time by emailing privacy@aaltoes.com, and we will erase it from our systems. Anonymised, aggregated analytics data may be retained indefinitely.

6. Your rights under GDPR

As a data subject under the GDPR, you have the following rights. To exercise any of them, contact us at privacy@aaltoes.com.

  • Right of access — request a copy of the personal data we hold about you.
  • Right to rectification — ask us to correct inaccurate data.
  • Right to erasure — ask us to delete your personal data and account by emailing us.
  • Right to object — object to processing based on legitimate interest.
  • Right to restriction — ask us to restrict processing in certain circumstances.
  • Right to data portability — request your data in a machine-readable format.
  • Right to lodge a complaint — you have the right to complain to the Finnish Data Protection Ombudsman (tietosuoja.fi).

7. International data transfers

Some of our processors (Clerk, Groq, Anthropic) operate servers outside the European Economic Area (EEA). Where transfers occur, they are covered by appropriate safeguards such as Standard Contractual Clauses (SCCs) as required by the GDPR. Please consult each processor’s privacy policy for details.

8. Children and age

The Service is not directed at children under 16. If you become aware that a child under 16 has provided us with personal data, please contact us at privacy@aaltoes.com and we will take steps to delete that information.

9. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated via a notice on the platform or by email. The “Last updated” date at the top of this page reflects the most recent revision. Continued use of the Service after changes are posted constitutes your acceptance of the revised policy.