Privacy Policy

This Privacy Policy explains how Evalanta Ltd. ("Evalanta", "we", "us") collects, uses, stores, discloses, and protects your personal information when you use our website, applications, and services (collectively, the "Services").

1. Who we are

Evalanta Ltd. operates the Evalanta learning and creator marketplace. For privacy questions, contact us at support@evalanta.com.

2. What personal information we collect

We collect information that is reasonably necessary to provide the Services:

• Account information: name, email address, phone number, password hash, profile photo, and role (learner, creator, admin).
• Identity and verification: tax information where required for creator payouts and tax withholding.
• Payment information: billing address, payment method tokens, and transaction history. Full card numbers are handled by Stripe (and by bKash once our partnership with bKash Limited is approved); we do not store full card details.
• Learning data: course progress, quiz results, certificates, live-class attendance, assignments, and discussion posts.
• Communications: emails, support tickets, and community posts.
• Technical data: IP address, device type, browser, operating system, and cookies.
• AI interactions: prompts, queries, and outputs when you use AI-assisted creation tools.

3. How we collect information

We collect information directly from you when you register, purchase, create content, or contact support. We also collect information automatically through cookies and server logs, and from third parties such as payment providers.

4. Why we use your information

We use personal information to:

• Provide, operate, and improve the Services;
• Process payments, payouts, refunds, and tax documentation;
• Verify identity and prevent fraud, abuse, and security incidents;
• Communicate with you about your account, courses, and service updates;
• Comply with legal and regulatory obligations, including tax and law-enforcement requests;
• Develop and improve AI features, including evaluating quality and safety.

5. AI data practices

When you use AI features, your inputs and related context are sent to AI models through our AI gateway. We use reputable providers (such as Anthropic, OpenAI, and Google) under contractual protections.

• We do not use learner tutoring conversations to train or fine-tune AI models without explicit consent.
• AI-assisted creator tools may use your prompts and content to generate suggestions. You choose whether to publish any AI-generated output.

6. Who we share information with

We share personal information only when necessary:

• Cloud and infrastructure: Vercel (hosting), AWS (infrastructure and storage), Cloudflare (edge network and security), Google Cloud, and Neon (database).
• Platform services: LiveKit (live classes), Bunny Stream (video), Stripe and bKash (payments, once our bKash partnership is approved), Resend (email), and Supabase (database and auth infrastructure).
• Search, analytics, and error tracking: Meilisearch (search), Umami (analytics), and GlitchTip (error tracking). These are self-hosted or controlled by Evalanta where noted.
• AI providers: Anthropic, OpenAI, Google, and ElevenLabs, accessed through our AI gateway under contractual protections.
• Creators: when you enrol in a course, the creator receives your name, email, progress, and submissions needed to deliver and assess the course.
• Organisations: if you access Evalanta through an organisation, certain learning data may be shared with authorised organisation admins.
• Regulators and law enforcement: when required by law, court order, or to protect safety and rights.

7. Cross-border transfers

Evalanta operates in Bangladesh and Australia and uses service providers located in other countries. Your information may be transferred to and processed in jurisdictions outside your own, including the United States, the European Union, and Singapore.

We take reasonable steps to ensure that overseas recipients protect personal information in accordance with applicable law, including contractual safeguards.

8. Security

We use encryption in transit (TLS), access controls, staff training, and regular security reviews to protect personal information. No system is completely secure, and we cannot guarantee absolute security.

9. Data retention

We keep personal information for as long as necessary to provide the Services, comply with legal obligations, resolve disputes, and enforce agreements. When information is no longer needed, we delete or anonymise it.

10. Cookies and tracking

We use cookies and similar technologies for essential functions, analytics, and preferences. For details, see our Cookie Policy.

11. Your rights

Depending on your location, you may have rights to access, correct, delete, restrict, or port your personal information, and to object to certain processing. To exercise these rights, contact us at support@evalanta.com.

Australian users may also complain to the Office of the Australian Information Commissioner (OAIC) if they believe their privacy rights have been breached.

12. Children

Evalanta is designed for learners aged 16 and above. If we learn that we have collected personal information from a child under the applicable minimum age without appropriate consent, we will delete it promptly.

13. Changes to this policy

We may update this Privacy Policy to reflect changes to our practices or the law. Material changes will be posted on this page.

14. Contact us

For privacy questions, please contact support@evalanta.com.