Legal
What we collect, why, and your rights — Israel Amendment 13, GDPR, and global practice.
Account data: email, display name, locale, and (for learners) an age band — never more than needed.
Usage data: lessons, progress, exam results, and (for corporate) completion/attestation records.
We do not sell personal data. We do not place personal data in URLs or logs.
To run the product (progress, certificates, audit proof), keep accounts secure, and improve the service.
AI activity logging is optional and opt-in; it is encrypted and used only for coaching.
Access, correct, export, restrict, or delete your data. Email us to exercise any right.
Compliance completion evidence may be retained under a legal hold even after erasure, in anonymized form, where law requires an audit trail.
When we process personal data of Israeli residents, we align with the Privacy Protection Law, 5741-1981, as amended — including Amendment 13 (תיקון 13) — and the Information Security Regulations (2017).
In plain terms: we collect for defined purposes, limit access by role, keep security measures appropriate to risk, review vendors, and do not sell personal data.
Israeli data subjects may request access, correction, deletion, or restriction, and may complain to the Privacy Protection Authority (רשות הגנת הפרטיות). Privacy requests: [email protected].
We review whether we hold excess personal data at least annually and delete or anonymize what we no longer need.
This summary is not legal advice — counsel should review before regulated claims.
If you are in the EEA, UK, or Switzerland, GDPR-style rules may apply. Lawful bases we rely on: contract (delivering the service you signed up for) and consent (optional AI logging and any non-essential cookies, if enabled).
You may request access, rectification, erasure, restriction, portability, or object to certain processing. Contact [email protected]. You may lodge a complaint with your local supervisory authority.
Hosting and core infrastructure run on Cloudflare. Billing may use Stripe. AI providers (when enabled) process prompts under our accounts.
Transfers use provider terms and safeguards appropriate to the destination. Details and DPAs are available on request.
Learner accounts for under-18s are household-gated. We keep minimal identifiers (display name, locale, optional age band) and avoid invasive age-assurance methods that collect government IDs by default.
See also Children & Family Safety.
Cloudflare (hosting), Stripe (billing), and an email provider. Data residency and DPAs available on request.
We keep data only as long as needed for the purpose or as law requires, then delete or anonymize it.
This is a plain-language summary. The binding consent version used in the app is at app.thelibraryapp.co/legal. Questions: [email protected].