Privacy policy — revision 2026-09-15.1

Discerya is an online learning platform for real estate professionals. For the purposes of data protection law, the data controller is Discerya, reachable at mahmoud.nassef@heirstoneconsulting.com. That address is the fastest way to reach us about this policy or about how your data is handled.

• We collect what we need to run your account, your learning, the AI tutor, payments and security. Everything is listed below.
• When you are signed in, the course pages you view, the time you spend active on the platform and your sign-ins are linked to your account.
• Questions you ask the AI tutor, and written work you submit for AI feedback, are sent to OpenAI in the United States to generate a response. Your name and email address are not sent with them.
• Payments are handled by Stripe. We never see or store your card number.
• If you accept an invitation to a company workspace, that company can see your learning activity from the day you join, and nothing from before.
• We do not sell your data, show advertising, or use third-party analytics or advertising cookies.
• You can delete your account yourself once any paid subscription has ended.

Account and profile.

• Your name, email address, password (our authentication provider stores only a secure hash of it), job title, country and language preference.
• If you sign up on behalf of a company: the company name and the number of seats you asked for.
• Your onboarding answers (career level, experience, current profession, objectives, specialism, markets, goals, time commitment, confidence and follow-up answers), used to recommend a learning path.

Learning activity.

• Your enrolments, lesson progress and completions, quiz attempts including your answers and scores, topics you found difficult, and saved resources.
• Written exercises (simulations) you submit, and the feedback on them, which may be generated by our AI reviewer.

Usage records, linked to your account.

• Active time: while the dashboard or a lesson is open and visible on your screen, your browser records each active minute and, in a lesson, which course and lesson you are on.
• The times you sign in.
• Course pages you view. When you are signed in, each view is linked to your account; when you are not, the view is counted without any identifier.
• Lesson access: which lessons you open and when, used to detect bulk copying of course content.

Security records.

• A device identifier: a random value kept in a cookie on your browser (see Cookies below). When you open lessons while signed in, a scrambled (hashed) form of it is stored with your account, together with your browser and operating-system family, so we can see how many devices use one account.
• Security events linked to your account, such as blocked attempts to copy lesson text, unusually fast lesson access, too many searches in a short time, or many devices in use at once. For search limits we record that a search happened, not what you searched for.
• Your IP address and browser details, which our authentication provider stores with your sign-in sessions. Our application also reads your IP address, in memory only, to rate-limit the contact form and the AI tutor; it does not store it. Our hosting and database providers keep short-lived technical logs of requests (such as IP address, time and the address requested) to run and secure their services.

AI tutor.

• Your questions, the tutor's answers and the conversation history, plus an automatically written summary of longer conversations so the tutor can follow them.
• A request log for each question: the question text, which lesson it was about, usage and cost figures and, when our safety checks block an answer, the blocked text and the reason.
• Your ratings of answers, and any extra question allowance an administrator grants you.

Consent records. Which version of our terms you accepted, when, in which language, and the exact wording.

Payments. Your plan, number of seats, price, subscription status and renewal dates, payment amounts and outcomes, and Stripe reference numbers for your customer record, subscription, invoices and payments. You enter card details on Stripe's own checkout page; we never see or store your card number.

Company workspaces. If you are a member: your membership, role, cohort and the learning paths assigned to you.

Notifications to the platform owner. When you sign up or enrol in a course, an event with your name (and, for sign-ups, your email address) is recorded and included in a notification email to the platform owner. Copies of those emails are kept in our email log.

Contact form. Your name, email address, organisation, the plan you are interested in and your message.

• To provide the service you signed up for (performance of a contract): your account, courses, progress, quizzes, the AI tutor and AI feedback, company workspaces, payments and account emails.
• To keep the platform secure and protect our course content (legitimate interests): sign-in sessions, device counts, security events, lesson-access and search limits.
• To understand and improve the platform (legitimate interests): which courses are viewed, active time and, for administrators, which lessons prompt the most tutor questions. For that last purpose, tutor questions from many learners are grouped automatically and summarised by our AI provider; the results may quote example questions word for word, without names.
• To keep accounting and tax records of payments (legal obligation).
• To answer messages you send us (legitimate interests, or steps you ask us to take before a contract).

Service providers that process data for us:

• Supabase — our database and authentication, in the European Union (Paris, France).
• Railway — hosts the web application. Every request between your browser and Discerya passes through it.
• OpenAI (United States) — generates AI tutor answers, conversation summaries and AI feedback on written submissions, and turns text into search vectors (embeddings). It receives your question or submission, relevant lesson excerpts and recent conversation turns, but not your name or email address.
• Stripe — payments. It receives your email address, your plan and seats, and your account ID; you give your card details to Stripe directly.
• Resend (United States) — delivers the platform's notification emails. It receives the recipient, subject and content of each email.

Other people who can see your data:

• A company whose workspace you join. Once you accept an invitation, that company's workspace administrators can see your learning activity from the date you joined: progress, completions and scores. They cannot see your onboarding answers or anything from before you joined. Before you accept, the company sees nothing about you, not even whether your email address has an account with us.
• Our administrators, who can see account, learning and payment data in order to run the service and support you.
• Authorities, where the law requires us to disclose data.

We do not sell personal data.

OpenAI, Stripe, Resend and Railway are United States companies, so data they receive may be processed outside the European Union. Where that happens, the transfer relies on the safeguards in each provider's data processing terms.

We set no advertising or analytics cookies and use no third-party trackers. These are all the cookies and browser storage the platform uses:

Stripe's checkout page, on stripe.com, sets its own cookies under Stripe's privacy policy. We treat the cookies above as necessary to provide the service securely, so we do not ask for cookie consent. You can block or delete them in your browser, but you will not be able to stay signed in without the session cookie.

Our database, including your account and learning data, is hosted by Supabase in the European Union (region eu-west-3, Paris, France). The providers listed above process the data they receive on their own infrastructure.

Our providers keep the data they receive under their own policies. In particular, Stripe keeps payment records as financial law requires, and OpenAI keeps data sent through its API for a limited period for abuse monitoring.

You can delete your account yourself from your profile settings in the dashboard, or ask us to do it by email. Deletion is permanent and cannot be undone.

Cancel any paid subscription first. While you have a paid subscription that is still live (active, awaiting its first payment, retrying a failed payment, or suspended), deletion is blocked. The same applies if you own a company workspace that has a live subscription or other members. Cancel the subscription (and, for a company workspace, remove its other members); once your paid access has ended, you can delete your account.

Erased straight away: your login, profile and onboarding answers; enrolments, progress, quiz attempts, difficult topics and saved resources; written submissions and their feedback; AI tutor conversations, messages and ratings; active-time records, sign-in times, lesson-access records and device records; consent records; company workspace memberships and assignments; and your subscription record.

Kept, but no longer linked to you:

• payment records (amounts, dates, status and Stripe reference numbers), for accounting and tax purposes;
• AI usage and cost figures; the text of your questions and any blocked answers is erased;
• security events, which contain no name or email address but may contain technical details such as which lesson was involved;
• anonymous course-page view counts;
• notifications to the platform owner about your sign-up and enrolments, with your name and email address removed.

Not reached by deletion: records Stripe, OpenAI and Resend hold under their own policies; emails already delivered, including notification emails in the platform owner's mailbox; copies of those notification emails in our email log; and example questions already quoted, without names, in lesson insights for administrators.

You have the right to:

• access the personal data we hold about you;
• rectify it: you can edit your name, job title and country in your dashboard profile, and ask us to correct anything else;
• erase it (see Deleting your account);
• receive a copy in a machine-readable format (portability): there is no self-service export yet, so email us and we will send it;
• object to or ask us to restrict processing based on legitimate interests.

To exercise any of these rights, email mahmoud.nassef@heirstoneconsulting.com. You also have the right to complain to your local data protection authority.

Please do not put personal information about yourself or anyone else, client details or confidential material into AI tutor questions or written submissions.

When we change this policy we update this page and the date below. For significant changes we ask you to review and accept the updated terms before you continue using your account.