Privacy Policy

learnfrom.co

Last updated: October 7, 2026

1. Introduction

This Privacy Policy explains how Built by Hajo, operating learnfrom.co (“learnfrom.co”, “we”, “us”, or “our”), collects, uses, and protects personal data when you use our website and cloud-based software platform (the “Service”).

We are committed to protecting your privacy and processing personal data in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

2. Who We Are (Data Controller)

Controller:
Built by Hajo (sole proprietorship)
Brouwersplein 21-rd
2013PG Haarlem
The Netherlands

Contact email: hajo@learnfrom.co

For the purposes of GDPR, Built by Hajo is the data controller for personal data relating to platform users (such as course creators).

3. Our Role When Processing Student Data

When course creators use learnfrom.co to manage learners and deliver courses, learnfrom.co processes personal data on behalf of course creators.

In this context:

• The course creator is the data controller
• learnfrom.co acts as a data processor

We process such data only in accordance with the course creator’s instructions and applicable data protection law.

4. Personal Data We Collect

4.1 Data You Provide Directly

We may collect the following information when you create an account or use the Service:

• Name
• Email address
• Account credentials
• Business information
• Support communications

4.2 User Content

Course creators may upload content that includes personal data (for example, student names or email addresses).

4.3 Automatically Collected Data

When you access the Service, we may automatically collect:

• IP address
• Device and browser information
• Log files
• Usage data and analytics data
• Cookies or similar technologies

5. Purposes and Legal Bases for Processing

We process personal data for the following purposes:

Where required, we rely on user consent, which may be withdrawn at any time.

6. Cookies and Analytics

learnfrom.co uses cookies and similar technologies to:

• Enable essential platform functionality
• Analyze usage and performance
• Improve the user experience

Where required by law, we obtain consent before placing non-essential cookies. More details may be provided in a separate cookie notice.

7. Sharing of Personal Data

We do not sell personal data.

We may share personal data only with:

• Service providers (e.g. hosting, analytics, email delivery)
• Payment processors (such as Stripe or PayPal), where applicable
• AI assistants that a course creator chooses to connect to their account (see section 14)
• Authorities, where required by law
• Professional advisers, where necessary

All processors are bound by contractual confidentiality and data protection obligations.

8. International Data Transfers

Some of our service providers are located outside the European Economic Area (EEA), including in the United States.

Where personal data is transferred outside the EEA, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Additional technical and organizational security measures where required

9. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

Upon account termination:

• User data is deleted promptly
• Data may be retained where legally required (e.g. accounting or tax obligations)

10. Data Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, misuse, or alteration.

However, no system is completely secure, and we cannot guarantee absolute security.

11. Your Rights Under GDPR

If you are located in the EU/EEA, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Request erasure (“right to be forgotten”)
• Restrict processing
• Object to processing
• Data portability
• Withdraw consent at any time
• Lodge a complaint with a supervisory authority

Requests can be made by contacting hajo@learnfrom.co.

12. Student Data Requests

If you are a student or learner, please note that learnfrom.co processes your data on behalf of the course creator.

To exercise your rights, you should first contact the relevant course creator. We will assist course creators where required.

13. Children’s Privacy

learnfrom.co does not knowingly collect personal data from children. Course creators are responsible for ensuring that their courses comply with applicable age-related laws and regulations.

14. AI Assistants and the learnfrom MCP Server

Course creators can connect an AI assistant (such as Claude or ChatGPT) to their learnfrom.co account. learnfrom.co does not send personal data to any AI provider on its own; data is shared only after a creator connects an assistant and approves its permissions.

When a creator connects an assistant, the assistant can, within the permissions the creator approves:

• Read and change the creator’s courses, lessons and settings
• If allowed, see students’ names, email addresses and course progress
• If allowed, invite students by email and remove students from a course

This data is transferred to the assistant provider chosen by the creator, which processes it under its own terms and privacy policy. learnfrom.co does not control that processing. The course creator remains the data controller for their students’ personal data and is responsible for having a lawful basis, such as their own privacy notice, for sharing it with the assistant they use.

We limit what is shared and what can be done:

• Only the data needed is returned (names, email addresses and progress); payment details are never returned
• Creators choose the permissions and can disconnect an assistant or revoke a personal access token at any time in their account settings, which ends access immediately
• Invitations sent by an assistant are emailed on the creator’s behalf, are limited per day, and do not enroll or bill anyone until the recipient accepts
• Access tokens are stored only in hashed form

We keep a log of assistant activity (which action was taken, when, on which course, and which fields changed, without lesson text, email addresses or other content) for 180 days, so that creators can review it and for security purposes. The legal basis is performance of a contract and our legitimate interest in securing the Service.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the Service or by email where required.

The updated version will always be available on our website.

16. Contact

If you have any questions about this Privacy Policy or our data practices, please contact:

Email: hajo@learnfrom.co

Address: Brouwersplein 21-rd, 2013PG Haarlem, The Netherlands