Privacy Policy

1. Introduction

This Privacy Policy explains how [COMPANY LEGAL NAME] ("DevPath", "we") collects, uses, and shares personal data when you use rmalphaflow.com and the DevPath Service. [CONFIRM the controller entity and, if required, an EU/UK representative and DPO contact.]

2. Information we collect

• Account data: your name, email, and authentication identifiers (including via any sign-in provider you choose).
• Learning & usage data: your progress, activity, submissions, preferences, and interactions with the Service.
• Payment data: if you subscribe, billing is handled by Stripe. We receive limited information such as your subscription status and customer/subscription identifiers — we do not receive or store your full card number.
• Integrations: if you connect GitHub or similar, we access only what you authorize.
• AI interactions: prompts and content you submit to AI features are processed to generate responses (see section 6).
• Technical data: log data, device/browser information, and cookies or local storage needed to run the Service.

3. How we use your data

To provide and secure the Service; to operate your account and subscription; to personalize learning; to communicate with you; to comply with legal obligations; and to improve the Service. We do not sell your personal data.

4. Legal bases (where GDPR/UK GDPR applies)

We rely on: performance of our contract with you (to provide the Service and billing); our legitimate interests (to secure and improve the Service); your consent (where required, e.g. certain cookies or communications); and compliance with legal obligations.

5. How we share your data

• Service providers who process data on our behalf under contract, including Stripe (payments), our hosting/infrastructure provider, and AI providers such as Anthropic (AI features).
• Legal: where required by law or to protect rights and safety.
• Business transfers: as part of a merger, acquisition, or asset sale, subject to this Policy.

6. AI processing

When you use AI features, your prompts and relevant context are sent to a third-party AI provider (e.g. Anthropic) to generate a response. Please do not submit sensitive personal data in AI prompts. [CONFIRM the provider(s), data-retention terms, and whether inputs are used for model training — request a no-training / zero-retention arrangement where possible.]

7. Cookies and similar technologies

We use cookies/local storage that are necessary for the Service (such as authentication and preferences) and, where applicable and with consent, analytics. [CONFIRM analytics/marketing cookies and a consent mechanism if used.]

8. Data retention

We keep personal data for as long as your account is active and as needed to provide the Service, then for the period required to meet legal, accounting, and dispute-resolution obligations, after which it is deleted or anonymized.

9. Security

We use technical and organizational measures to protect personal data (including encryption in transit and access controls). No system is perfectly secure, and we cannot guarantee absolute security.

10. Your rights

Depending on your location, you may have rights to access, correct, delete, port, or restrict processing of your personal data, and to object or withdraw consent. Residents of the EEA/UK (GDPR) and California (CCPA/CPRA) have specific rights, including the right not to be discriminated against for exercising them. To exercise your rights, contact [CONTACT EMAIL]. You may also lodge a complaint with your data protection authority.

11. International transfers

We may process data in countries other than yours. Where required, we use appropriate safeguards (such as Standard Contractual Clauses) for international transfers.

12. Children's privacy

The Service is not directed to children under [MINIMUM AGE], and we do not knowingly collect their data. If you believe a child provided us data, contact us to have it removed.

13. Changes

We may update this Policy; material changes will be notified through the Service or by email and take effect on the stated date.

14. Contact

Privacy questions or requests: [CONTACT EMAIL]. [ADD postal address / DPO / EU representative if required.]