Legal
Privacy Policy
Draft: pending lawyer review. Not legal advice. This text has not yet been reviewed by a lawyer and may change before launch.
This policy explains how Farlane ("Farlane", "we", "us") handles personal data when you visit our website, take the quiz, create an account, subscribe or use the lessons. We wrote it to describe what the product actually does. If something here does not match what you see in the product, please tell us.
Who we are
Farlane is operated by [TBD: legal entity name and registered address]. For the account, lesson and website data described below, we are the controller. You can reach us about privacy at [TBD: privacy contact email].
Who can use Farlane
You must be at least 18 years old to create an account or buy a subscription. We do not knowingly collect data from anyone under 18; if you believe a minor has given us data, contact us and we will delete it.
Farlane is not offered in Russia, Belarus or regions under comprehensive sanctions. We block sign-ups from those places and do not target them with advertising. The Russian-language version of the site is for Russian speakers in other countries.
What we collect and why
| Data | Why we use it | Legal basis |
|---|---|---|
| Email address, name, password hash, sign-in codes | Create and secure your account, send sign-in codes | Contract |
| Quiz answers (role, industry, goals) | Build your personal plan | Contract (steps you ask for before signing up) |
| Lesson progress, exercise answers, scores, certificates | Run the lessons, give feedback, issue certificates | Contract |
| Subscription status, plan, country | Give you the plan you paid for | Contract |
| Product events (pages viewed, lessons started) | First-party analytics to improve the product | Legitimate interests |
| IP address, device and browser data, security logs | Keep the service secure, prevent abuse, block unsupported countries | Legitimate interests, legal obligation |
| Advertising pixel data | Measure our ads | Consent |
| Marketing emails | Send product news you asked for | Consent (you can unsubscribe at any time) |
Exercise answers may contain whatever you paste in. Please do not paste personal data about other people or confidential information from your employer.
AI processing
Some features send data to AI model providers through their commercial APIs:
- Personal plan. Your quiz answers are sent to the model to pick the lessons in your plan.
- Exercise scoring. Your exercise answer and the exercise rubric are sent to the model to produce a score and written feedback.
We use Anthropic and OpenAI for this. Under their commercial API terms, data we send is not used to train their models. They may keep it for a short period for abuse monitoring, as described in their terms. [TBD: confirm current API retention periods for each provider.]
AI scores are feedback only. Certificates are based on completing the lessons, not on an AI score alone. You can ask a person to review any AI score by contacting us.
Who receives your data
We share personal data only with the service providers we need to run Farlane, and only for the purposes above:
- Paddle (Paddle.com Market Ltd and its affiliates) is our reseller and merchant of record. Paddle processes your payment, billing address, tax details and order history as an independent controller under its own privacy notice. We never see your full card number.
- Resend sends our transactional emails (sign-in codes, receipts links, account notices).
- Anthropic and OpenAI process plan and scoring requests as described above.
- Unsplash hosts some lesson and article images. These images load directly from Unsplash, so your browser sends your IP address and browser data to Unsplash when a page shows them.
- Hosting and database: [TBD: hosting, database and error-monitoring providers and regions].
- Advertising partners (for example Meta and Google) receive pixel data only if you accept advertising cookies.
We may also disclose data to professional advisers, or to authorities when the law requires it.
Analytics and cookies
We run first-party analytics: product events are recorded by our own servers and are not shared with an analytics vendor. Advertising pixels load only after you consent in the cookie banner. See the Cookie Policy for details.
International transfers
Some providers above process data outside the European Economic Area and the UK, including in the United States. Where that happens, we rely on an adequacy decision or on the EU Standard Contractual Clauses and the UK Addendum, together with the provider's security measures.
How long we keep data
- Account, progress and certificate data: while your account is open, then deleted within [TBD: number] days of account deletion.
- Exercise answers: [TBD: retention period].
- Security logs: [TBD: retention period].
- Billing records are kept by Paddle for as long as tax law requires.
Your rights
Depending on where you live, you can ask to access, correct, delete or export your data, to restrict or object to processing, and to withdraw consent at any time. You can object to processing based on legitimate interests, and you can ask for human review of any automated score. We answer within one month. You can also complain to your local data protection authority.
Security
We protect data with encryption in transit, access controls and limited staff access. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.
Changes to this policy
When we make a material change, we will update the date above and tell account holders by email before the change takes effect.
Attribution
Portions of this policy are adapted from the Basecamp open-source policies, licensed under CC BY 4.0. Changes were made: the text was rewritten to describe Farlane's own data flows, processors and legal bases.