Privacy Policy

What we collect

We only collect what the service needs to work:

• Account: your name, email address, password (stored only as a secure hash by our authentication provider, Supabase), an optional profile photo, and your language preference.
• Purchases: which courses you bought, the amount paid, and Stripe transaction identifiers. Payments are processed by Stripe — your card number never reaches our servers and we never store it.
• Free lesson signup: the email address and language you submit to receive the free lesson.
• Gift draw: if a purchase wins a gift, we store the prize and its redemption code with your account so café staff can verify it in person.

Cookies

Essential cookies are always set — the site cannot work without them: your sign-in session, your language choice, a small signed-in display hint, and your cookie-consent decision itself.

Analytics and marketing cookies — Google Analytics, Microsoft Clarity and Hotjar (which record interaction data such as clicks, scrolls, and mouse movement, plus privacy-masked session recordings, to build heatmaps that help us improve the site), the Meta (Facebook/Instagram) Pixel with server-side purchase events (which may include a hashed version of your email, your IP address, and browser information), and, if enabled, Pinterest and TikTok tags — are handled based on where you are. In the EU, the EEA, the United Kingdom, and Switzerland they load only if you press “Accept” on the cookie banner, and pressing “Reject” means none of them load. Elsewhere they are enabled by default to measure our advertising, and pressing “Reject” turns them off.

Separately, our hosting provider (Vercel) gives us cookieless, anonymous page-view and performance statistics that identify nobody and use no cookies.

Video lessons

Course videos are streamed through embedded Vimeo players. Vimeo may process playback data (such as watch progress) under its own privacy policy.

Who processes your data

We rely on a small set of service providers, each receiving only what their function requires: Supabase (accounts and database), Stripe (payments), Vercel (hosting and anonymous analytics), Vimeo (video streaming), and — only with your consent — Google, Microsoft (Clarity) and Hotjar (both for heatmaps and session replay), and Meta (and Pinterest/TikTok if enabled) for analytics and advertising measurement.

Retention and your rights

We keep your account data while your account exists. You can ask us at any time to access, correct, or delete your personal information — including deleting your whole account — by writing to the address below. We respond in accordance with applicable Canadian and Québec privacy law.

Changes

If this policy changes, we will update this page and the date at the top.