Privacy Policy

1. Who we are

Ulern is operated by Novatra B.V. (“Ulern”, “we”, “us”), the company responsible for deciding how and why your personal data is processed — the “data controller” under the GDPR.

Company: Novatra B.V., a private limited company in the Netherlands
Registered address: In de Wolken 244, 1186 BR Amstelveen, The Netherlands
Chamber of Commerce (KvK) number: 98010298
VAT (BTW) number: NL868323627B01
Privacy contact: privacy@ulern.com

2. What data we collect

We collect only what we need to provide and improve Ulern:

Account data — your name, email address, and password (stored only as a secure hash), or your Google account identifier if you sign in with Google.
Profile and preferences — your learning goals, background, preferences, and constraints.
Learning data — your journeys, plans, your answers and responses, activity, and the progress and understanding the system derives from them.
Payment data — handled by our payment provider (Stripe). We store your plan and subscription status and a Stripe customer identifier; we do not store full card details.
Technical and usage data — device and browser information, IP address, and logs of how you use the platform.
Communications — messages you send us, for example when you contact support.

3. How we use your data, and our legal bases

Under the GDPR we must have a legal basis for each use of your data:

To create your account and deliver your personalized learning journeys — to perform our contract with you (Art. 6(1)(b)).
To process payments and manage your subscription — to perform our contract with you.
To send essential service emails (verification, account, billing, security) — to perform our contract; any marketing emails are sent only with your consent (Art. 6(1)(a)), which you can withdraw at any time.
To secure the platform, prevent abuse, and improve our service — our legitimate interests (Art. 6(1)(f)), balanced against your rights.
To meet legal obligations such as tax and accounting — legal obligation (Art. 6(1)(c)).

4. AI processing of your content

Ulern is an AI-powered platform. To plan your learning, generate explanations and activities, and adapt to you, your inputs, answers, and learning context are processed by AI models — including those of our AI provider (currently Anthropic).

We do not sell your data, and we do not use your personal data to train AI models. We use our AI provider through its business API, under which the content we send is not used to train its models and is retained only briefly for abuse monitoring before deletion. We process this data under a data-processing agreement with the provider.

AI-generated content can be incomplete or inaccurate; please see our Terms of Service for the limits of what AI output should be relied on for.

5. Who we share data with

We do not sell your personal data. We share it only with vetted service providers (“processors”) who act on our instructions under data-processing agreements:

Stripe — payment processing and subscription billing.
Anthropic — AI processing of your learning inputs and content.
Google — sign-in (Google login) and email delivery.
Our cloud hosting provider — hosting and storing the platform and its data (EU region by default).

We may also disclose data where required by law, or to protect our rights, users, and the security of the service.

6. Where your data is processed

By default we host and process your data within the European Union. Some providers (for example our AI provider) may process data outside the European Economic Area. Where that happens, we rely on appropriate safeguards under the GDPR — such as the European Commission’s Standard Contractual Clauses or an adequacy decision — to protect your data.

7. Cookies

We use strictly necessary cookies to run the platform, such as keeping you signed in and keeping your session secure. These are required for Ulern to work.

If and when we introduce analytics or other non-essential cookies, we will ask for your consent through a cookie banner first. You can also manage cookies through your browser settings.

8. How long we keep your data

We keep your personal data while your account is active. After your account is deactivated (for example, when your subscription or trial ends), we retain your data for up to 365 days and then delete or anonymize it — except where we are legally required to keep certain records longer (for example, invoices for tax purposes). You can also ask us to delete your data sooner; see “Your rights” below.

9. Your rights

Under the GDPR you have the right to:

Access the personal data we hold about you, and receive a copy.
Have inaccurate data corrected (rectification).
Have your data deleted (erasure), where applicable.
Restrict or object to certain processing.
Receive your data in a portable format (data portability).
Withdraw any consent you have given, at any time.

To exercise any of these rights, email privacy@ulern.com. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or your local supervisory authority.

10. Children

Ulern is not directed to children under 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact privacy@ulern.com and we will delete it.

11. How we protect your data

We use appropriate technical and organizational measures, including encryption of data in transit and at rest, access controls, and regular review of our security practices. No method of storage or transmission is perfectly secure, but we work to protect your data and to respond quickly if something goes wrong. To report a security concern, email privacy@ulern.com.

12. Changes to this policy

We may update this policy to reflect changes in our practices or the law. We will post the updated version here with a new date and, for material changes, notify you by email or within the platform.