Privacy Policy

The website at chesspulse.co and the student dashboard reached from it (together, the “Site”) are operated by ChessPulse, the data controller for the personal data described here. This policy explains what we collect, why, who we share it with and the rights you have, in line with applicable data protection laws, including the GDPR and UK GDPR for people in the EU and the UK.

1. Data we collect, and how

You can browse the public pages without giving us anything that identifies you. When you buy a course or use your account, we collect the following electronically, through the checkout (via Paddle), the sign-in and account forms, your use of the dashboard, and records our systems create automatically:

• Account details: name, email address and password (stored only as a one-way hash; nobody, including us, can read it).
• Purchase records: the email used at checkout, the course, price, currency and tax amounts, Paddle customer and transaction identifiers, and any refund or chargeback. Your card or other payment details go to Paddle only; we never see or store them.
• Consent record: that you asked for immediate access and acknowledged the end of the withdrawal right before paying, with the date and the version of the wording.
• Access records: when access to a course was granted, and when courses, lessons and videos were first and last opened, with a count. We don't record IP addresses or device details for these.
• Learning data: onboarding answers (age group, level, goal), completed lessons, exercise answers, points, streaks, achievements and certificates.
• Profile preferences: an optional profile photo and settings such as board and piece style.
• Usage and security logs: sign-in times, IP address, device type, time spent in the dashboard, and whether you use two-step verification.

2. Why we use it, and on what basis

• Selling you the course, creating and securing your account, and delivering lessons, progress and certificates: to perform our contract with you.
• Sending service emails such as your purchase confirmation, activation and sign-in links, password resets and study reminders: to perform the contract.
• Keeping consent and access records to answer refund requests and payment disputes, and preventing fraud and abuse: our legitimate interests, and establishing or defending legal claims.
• Keeping records the law requires: legal obligation.

We don't use your data for advertising, we don't sell it, and we don't share it with ad networks.

3. What other students can see

Your display name and score on the leaderboard are visible to other students. Your email address, purchases and other account details are never shown to other students. Certificates are visible only to you unless you share them.

4. Service providers

These providers process data only to deliver their service to us, under contract:

• Paddle: our reseller and merchant of record. Paddle processes your payment and tax details and sends your receipt as an independent controller under its own privacy notice.
• Supabase: database, authentication and file storage.
• Vercel: hosting, and cookie-free visit statistics that don't identify individuals.
• Resend: sending account, purchase and service emails.
• Vimeo: streaming lesson videos (embedded with Vimeo's “do not track” setting).
• ElevenLabs: voice narration of lesson commentary. Only lesson text is sent; no student data is.

Some of these providers process data in other countries. Such transfers are made with the safeguards the law requires, such as adequacy decisions or standard contractual clauses. Data may also be shared with public authorities where the law requires it.

5. Cookies

We use only cookies the Site needs to work:

• Authentication cookies that keep you signed in.
• A checkout cookie (cp_checkout, up to 7 days) that lets your browser show the status of the checkout you started. It is removed when you sign out.
• A preference cookie for the dashboard sidebar, and a short-lived cookie that shows a new certificate notification once.

On the checkout page, Paddle's secure payment form may set its own cookies or similar storage that it needs for payment and fraud prevention. Your theme preference is kept in your browser's local storage. We use no advertising or tracking cookies.

6. Retention

Account and learning data is kept while your account exists. Purchase, consent and access records are kept for as long as needed to provide the course, handle refunds and payment disputes, and meet legal record-keeping obligations, then deleted or anonymised. When you ask us to delete your account, we do so within a reasonable time, except for records the law requires us to keep. Security logs are kept only as long as their purpose requires.

7. Under 18

Students under 18 may use ChessPulse only with the knowledge and consent of a parent or legal guardian, who can exercise all rights over the child's data through the address below.

8. Security

Connections are encrypted with HTTPS. In the database each student can access only their own data, payment records are accessible only to our servers, administrative access is limited to a small number of accounts, and you can protect your account with two-step verification.

9. Your rights and contact

You can ask whether we process your data and for a copy of it, its correction or deletion, restriction of processing, or a copy in a portable format; you can learn who it has been shared with, object to processing based on legitimate interests or to decisions made solely by automated means, and claim compensation if you are harmed by unlawful processing. Write to hello@chesspulse.co with enough information to confirm it's you; we answer free of charge within 30 days. You can also complain to your local data protection authority.

10. Changes

When this policy changes, we publish the new text on this page and renew the date above. We email students about important changes.