Privacy Policy

• Bergline Digital OÜ (registry code 17361392)
• Tartu mnt 67/1-13b, Kesklinna linnaosa, 10115 Tallinn, Harju maakond, Estonia
• Email: contact@berglinelabs.com

Depending on how you use the Service, we may process:

• Identity and contact data: name, email address
• Account data: user ID, authentication tokens, course access status
• Transaction data: purchase history, payment status, Stripe customer/session IDs (we do not store full card numbers)
• Usage data: lesson progress, completion status, dashboard activity
• Technical data: IP address, browser type, device information, pages visited
• Communications: messages you send to support
• Marketing and analytics data: event data, referral information, session replay data where enabled

• Directly from you when you sign up, purchase, or contact support
• Automatically through cookies, logs, and analytics when you use the website
• From payment provider Stripe when you complete checkout
• From authentication provider Supabase when you create or sign in to your account

We process personal data for the following purposes:

Where we rely on legitimate interests, we balance those interests against your rights. You may object to processing based on legitimate interests as described in Section 9.

We use essential cookies and similar technologies required for authentication, security, and checkout. We also use analytics and session replay tools that may store identifiers in your browser or local storage.

Non-essential analytics cookies and session replay may require your consent under the ePrivacy Directive and Estonian Electronic Communications Act, depending on your jurisdiction and browser settings. You can limit tracking through browser controls and ad-blockers, though some features may not function correctly.

We use PostHog session replay to understand how users interact with the Service and to improve usability. Inputs are masked by default and sensitive checkout areas are excluded from capture where technically possible. Replays are retained according to our PostHog project settings (currently up to 30 days unless changed).

We share data with trusted service providers only as needed to operate the Service:

• Supabase — authentication, database, and account storage (EU/US depending on project region)
• Stripe — payment processing
• PostHog — analytics and session replay (EU hosting available)
• Resend — transactional email delivery
• Vercel — website hosting and infrastructure

These providers act as data processors under GDPR Article 28 where applicable. We use contractual safeguards and, where relevant, Standard Contractual Clauses for transfers outside the European Economic Area.

We may also disclose data if required by law, court order, or to protect our rights, users, or the public.

Your data may be processed in the European Economic Area and, where necessary to deliver the Service, in countries that may not provide the same level of data protection. When we transfer data outside the EEA, we implement appropriate safeguards such as the European Commission's Standard Contractual Clauses or equivalent mechanisms.

• Account data: retained while your account is active and for a reasonable period after closure
• Purchase records: retained for up to 7 years where required for accounting and tax law
• Analytics and session replay: retained according to provider settings, typically up to 30 days for replays
• Support correspondence: retained as long as needed to resolve the matter and for legal compliance

Under the GDPR and Estonian law, you may have the right to access, rectify, erase, restrict, or port your personal data, and to object to certain processing. Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

To exercise your rights, email contact@berglinelabs.com. We may need to verify your identity before responding. We aim to respond within one month as required by GDPR.

You also have the right to lodge a complaint with a supervisory authority. In Estonia, this is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) (https://www.aki.ee/en). You may also complain to the authority in your EU/EEA country of residence or work.

The Service is not directed at children under 18. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided data to us, contact contact@berglinelabs.com and we will delete it promptly.

We implement appropriate technical and organizational measures to protect personal data, including encryption in transit, access controls, and secure payment handling via Stripe. No method of transmission over the internet is completely secure; we cannot guarantee absolute security.

We do not use automated decision-making or profiling that produces legal or similarly significant effects within the meaning of GDPR Article 22.

We may update this Privacy Policy from time to time. The "Last updated" date at the top will change when we do. Material changes will be communicated where required by law.

Privacy enquiries: contact@berglinelabs.com

See also our Terms of Service.