Privacy Policy

1. Who is the controller

Coursify.me (“Coursify”, the “platform” or the “Service”) is operated by Envixo Products Studio LLC (“Envixo”, “we”, “us” or “our”), commercially headquartered at:

28 Geary St, Ste 650 #1712
San Francisco, CA 94108
United States
Phone: +1 (628) 333-3129

Coursify.me™ is a trademark of Envixo Products Studio LLC.

For purposes of the EU General Data Protection Regulation (EU) 2016/679 (GDPR), Brazil’s Lei Geral de Proteção de Dados (Law No. 13.709/2018 — LGPD) and, where applicable, the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA), Envixo Products Studio LLC is:

• the controller of personal data of platform account holders (creators, school administrators and marketing/account users), of billing data for Coursify subscriptions, and of technical usage data needed to provide and secure the Service; and
• the processor of personal data of students and other individuals whose data a school/creator uploads or collects through its school on Coursify — in those cases, the school/creator is the controller and Envixo processes that data only on the school’s instructions, to host and provide the Service.

Privacy contact
Privacy requests (access, correction, deletion, complaints or other questions) should be sent to [email protected].
Mail: Envixo Products Studio LLC — Privacy Compliance Officer, 28 Geary St, Ste 650 #1712, San Francisco, CA 94108, United States.

2. Scope of this policy

This policy applies to:

• the marketing site coursify.me and related pages;
• the Coursify LMS platform (school creation, courses, students, plan payments);
• Service-related communications (support email, account notices, our own marketing, where applicable).

It does not apply to:

• third-party sites or services linked from Coursify;
• privacy policies that each school publishes to its own students (the school is responsible for informing its students);
• processing performed solely by the school outside the platform.

3. What data we collect

3.1 Data you provide (account and billing — Envixo as controller)

• Identity and contact: name, email, phone (if provided), language.
• School/organization data: school name, custom domain (if any), configuration preferences.
• Coursify subscription billing data: billing address, country, customer identifiers at the payment provider; we do not store full card numbers (processed by Stripe).
• Support content: messages you send us.

3.2 Student and school-content data (Envixo as processor)

When a school uses Coursify, it may upload or collect, among other things:

• student name, email and other profile data;
• enrollments, progress, grades, comments and submissions;
• course content and teaching materials that identify individuals;
• course-purchase data of the student with the school (when the school sells through the platform), processed under the school’s instructions.

The school decides which student data are collected and for what purposes. Envixo does not use that data for its own marketing.

3.3 Data collected automatically

• IP address, device/browser type, operating system, pages visited, timestamps, referrer.
• Session identifiers and technical cookies (see section 8).
• Security and diagnostic logs needed for operations and abuse prevention.

3.4 Data we do not intentionally collect

We do not ask for special categories of data (racial origin, political opinions, health, etc.) to operate a Coursify account. If a school uploads such data in its school’s content or fields, the school is responsible for having a legal basis and informing the individuals; Envixo processes them only as a processor.

4. Purposes and legal bases

4.1 When Envixo is the controller

You may withdraw consent at any time and object to processing based on Envixo’s legitimate interest, including direct marketing, without affecting the lawfulness of prior processing (see sections 4.3 and 10). The right to object to direct marketing is presented clearly and separately, at the latest in the first communication (GDPR Art. 21(2)–(4); LGPD Art. 18 § 2), and can be exercised in one click in each email or in account preferences.

4.2 When Envixo is the processor (school student data)

We process student data only to:

• host the school and provide the LMS features requested by the school;
• ensure security, backups and continuity of the Service;
• follow the school’s documented instructions and applicable law.

The legal basis vis-à-vis the student is determined by the school (controller). Envixo and the school must enter into (or treat as entered under the applicable Terms/DPA) the processing terms required by GDPR Art. 28 and LGPD Art. 39.

The processing terms for school-controlled student data form part of these Terms of Service (including this Privacy Policy, insofar as it describes Envixo’s role as processor).

4.3 Tips, product-news and offer emails (our own marketing)

We send tips, product-news and offer emails only about Coursify’s own similar products and services, about twice a month (no more than two marketing emails in any 30-day period). We do not share the list with third parties for their marketing.

• New sign-ups. The legal basis is consent (GDPR Art. 6(1)(a); LGPD Art. 7, I), given through an unchecked box separate from the Terms and the Privacy Policy. Sign-up works without ticking that box. Consent may be withdrawn at any time, as easily as it was given.
• Existing contacts with no recorded opt-in. Where the law allows, the basis is Envixo’s legitimate interest in promoting its own similar products and services (GDPR Art. 6(1)(f) and recital 47; LGPD Art. 7, IX and Art. 10), with an opt-out in every message. In the European Union and Portugal, email marketing to individuals is also subject to Directive 2002/58/EC, Art. 13, and, in Portugal, Law No. 41/2004, Art. 13-A: the soft opt-in covers people who provided their email in the context of a sale, for similar products or services; outside that case, we do not send marketing on the basis of legitimate interest.
• Right to object. You may object at any time, free of charge. The right is presented clearly and separately, at the latest in the first email (GDPR Art. 21(2)–(4); LGPD Art. 18 § 2). Opt-out is one click in the email itself (or in account preferences) and takes effect immediately. The address is added to a permanent suppression list, unless you expressly opt back in (for example, in account preferences), for tips, product-news and offer emails. Service emails about the account, access and billing continue to be sent.
• Records. For proof and accountability (including LGPD Art. 37), we keep the legal basis, the source, the date and the version of the text shown to you. Any IP address associated with this record is pseudonymized with HMAC and a secret salt (it is not stored in clear text). That record remains personal data. The retention period is set out in section 9.

5. Roles: school as controller, Envixo as processor

• The school/creator decides the purposes and means of processing its students’ data (whom to invite, which fields to collect, how long to keep enrollments, etc.).
• Envixo processes that data on the school’s behalf, does not sell it and does not use it for Envixo’s own marketing.
• Student rights requests about school data should, as a rule, go first to the school. If you contact us directly, we may forward the request to the school or respond to the extent we are legally required and technically able.
• If the school closes its account or is moved to the Free plan, we will handle student data according to the school’s instructions and our retention policy (section 9).

6. Who we share data with (subprocessors / categories)

We share personal data only with providers that help us operate the Service, under contract and with confidentiality and security obligations. Current categories:

We do not sell personal data. We may disclose data if legally required, or if needed to protect rights, safety or investigate Terms violations.

7. International transfers

Envixo is based in the United States. Personal data may be processed in the US and in other countries where our providers operate.

Where GDPR or LGPD require an additional safeguard for transfers from the EEA/UK/Brazil to countries without an adequacy decision, we use, as applicable:

• European Commission Standard Contractual Clauses (SCCs) (and the UK addendum, where applicable) with our processors; and/or
• other legally recognized mechanisms.

Where transfers rely on contractual safeguards, we use Standard Contractual Clauses or other legally recognized mechanisms, as applicable.

8. Cookies and similar technologies

We use cookies and similar technologies in the categories below. In the EU, United Kingdom and Brazil, analytics and advertising cookies (including Google Tag Manager / GA4, Google Ads/DoubleClick and _rx_vid / _rx_sid) are loaded only after prior opt-in consent through our consent banner. You may withdraw consent at any time via cookie preferences or by contacting us.

Risenexa. The _rx_vid and _rx_sid cookies are set by the Risenexa analytics middleware, another Envixo product (or an affiliate’s). On every request (after consent, where required), a pageview is sent to Risenexa with: the URL without the query string, the referrer, the user agent, the client IP and any utm_* parameters.

You can manage or withdraw consent in the banner / cookie-preferences link in the footer and in browser settings. Blocking essential cookies may prevent login, payment or basic features.

9. Retention

We keep personal data only as long as needed for the purposes described, including:

• Active paid-plan account, and an account created and kept on the Free plan without cancellation: for as long as the account exists and is needed to provide the Service.
• Account cancellation or closure: the 180-day period runs from the date of cancellation or closure (by the account holder or by Envixo). At the end of those 180 days, account and school data (including content and, absent contrary instructions from the school, student data processed as processor) are deleted or anonymized.
• Move to the Free plan (downgrade from a paid plan — Starter, Pro or Business — whether voluntary or for non-payment): the 180-day period runs from the date of the move to the Free plan. At the end of those 180 days, the same data are deleted or anonymized. If the account returns to a paid plan before the period ends, the 180-day period stops and the active-account rule applies again.
• Prior notice: we will email the school administrator with reasonable advance notice before deletion or anonymization, when reasonably practicable.
• Legal and tax exceptions: billing data and data we must keep to meet legal or tax obligations are retained for the statutory periods applicable in the US / California and, if relevant, other jurisdictions where we have those obligations, even after the remaining account data have been deleted or anonymized.
• Backups: residual copies may remain in backup systems until that backup cycle ends. They are not used to provide the Service or for other purposes and are deleted or overwritten when the cycle ends.
• Security logs: retained for 12 months.
• Student data (as processor): per the school’s instructions and, absent instruction, aligned with the school’s lifecycle on the Service, including the 180-day periods above.
• Marketing suppression list: retained for as long as needed to honour a request not to receive tips, product news and offer emails, unless the person expressly opts back in.
• Consent and objection records: kept for the duration of the relationship and for 5 years after it ends, for proof and accountability (including LGPD Art. 8 § 2 and Art. 37; GDPR Art. 5(2) and Art. 7(1)). The relationship ends on the date the account is deleted or anonymized, or at the end of the 180-day period after cancellation or a move to the Free plan, whichever comes first.

10. Your rights

Depending on your location, you may have rights under the GDPR, LGPD and/or CCPA/CPRA, including:

• Access to the data we hold about you;
• Rectification of inaccurate or incomplete data;
• Erasure (“right to be forgotten”), as provided by law;
• Restriction of or objection to certain processing;
• Objection to direct marketing: you may object at any time, free of charge, in one click in the email or in account preferences; we will stop sending tips, product news and offers immediately (GDPR Art. 21(2)–(3); LGPD Art. 18 § 2). Account and billing emails will still be sent;
• Portability of data, where applicable;
• Withdrawal of consent, where processing is based on consent;
• Automated decisions / profiling: we do not carry out automated decision-making or profiling that produces legal effects or similarly significant effects concerning you;
• Under CCPA/CPRA (California residents): right to know, delete, correct, opt out of sale or sharing (“Do Not Sell or Share”) for cross-context behavioral advertising, and not to be discriminated against for exercising rights. We do not sell personal data within the meaning of the CCPA/CPRA. We share identifiers and usage data with advertising partners (for example Google Ads, via GTM) for cross-context behavioral advertising. To opt out of sale or sharing, use the “Do Not Sell or Share My Personal Information” link in the site footer, email [email protected] with that subject, or enable the Global Privacy Control (GPC) signal in your browser — we honor GPC as an opt-out of sale/sharing.

How to exercise: contact the Privacy Compliance Officer at the email in section 1. We may ask for reasonable information to verify your identity. We will respond within legal timeframes (generally up to 30 days under the GDPR / LGPD and CCPA timeframes, as applicable).

Students of a school: preferably contact the school (controller). We can help forward the request.

11. Complaints to supervisory authorities

You have the right to lodge a complaint with a supervisory authority:

• EEA: the authority of your Member State of habitual residence, place of work or place of the alleged infringement (EDPB members list);
• United Kingdom: Information Commissioner’s Office (ICO);
• Brazil: Autoridade Nacional de Proteção de Dados (ANPD);
• California: California Privacy Protection Agency (CPPA) / Attorney General, as applicable.

We ask that you contact us first so we can try to resolve the issue.

12. Security

We implement technical and organizational measures appropriate to the risk, including encryption in transit (TLS/SSL), access controls, storage on protected infrastructure and industry-aligned practices. Card data is handled by PCI-DSS-compatible providers (Stripe); Envixo does not store the full PAN.

No method of electronic transmission or storage is 100% secure. In the event of a security incident affecting your data, we will notify you and/or the authorities as required by applicable law.

13. Children

Creator/administrator accounts require a minimum age of 18.

Schools that enroll minors are responsible for obtaining parental consent or another required legal basis and for configuring the school appropriately. If we learn that we collected a child’s data in violation of this policy, we will take steps to delete it or ask the school to correct it.

14. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top will be revised. If changes are material, we will notify the administrative account by email and/or by a prominent notice in the Service, with the reasonable advance notice required by law.

The version published at https://coursify.me/privacy-policy is the current version.

15. Contact

To exercise rights, lodge a complaint or ask privacy questions:

Envixo Products Studio LLC
Privacy Compliance Officer
28 Geary St, Ste 650 #1712
San Francisco, CA 94108
United States
Phone: +1 (628) 333-3129
Email: [email protected]