Privacy Policy

We collect the minimum data needed to deliver the program and operate the Portal:

• Account and profile data: full name, email address, phone number, country of residence, and your chosen password (stored as a salted hash — we never see or store your plaintext password).
• Enrollment and cohort data: application details, cohort assignment, enrollment status, and role (student, teaching assistant, instructor, admin).
• Learning activity data: homework submissions, grades and instructor feedback, lesson and recording watch progress, resource bookmarks and personal notes, live-class attendance, and interview-practice answers.
• AI-advisor analysis: automated, rule-based assessments of your progress (e.g. missed deadlines, at-risk indicators) generated from your own learning activity data, used to notify you and your instructors so they can intervene early.
• Payment data: for the enrollment deposit, we use Stripe's hosted Checkout. We store only the resulting Stripe customer ID, payment intent ID, and payment status — we never receive, transmit, or store your card number, expiry date, or CVC (PCI DSS SAQ-A scope).
• Communications data: support messages, in-portal chat with the AI assistant, and email delivery/engagement metadata (e.g. whether a notification email was sent).
• Technical data: authentication session identifiers, IP address and basic device/browser information collected for security (fraud prevention, rate limiting, audit logs).

We process personal data on the following legal bases: performance of the enrollment contract between you and Saraya Tech, our legitimate interest in operating and securing the Portal, your consent where required (e.g. optional communications), and compliance with legal obligations.

• To provide the core learning experience: live classes, recordings, resources, homework, grading, and interview practice.
• To run the daily AI advisor, which analyzes your own progress data to flag risk indicators and prompt timely instructor support.
• To process your enrollment deposit and track your tuition balance.
• To send you transactional and program-related notifications (grades posted, class reminders, deadline reminders) and, where you have opted in, other communications.
• To secure the Portal: authentication, fraud and abuse prevention, audit logging of sensitive actions.
• To improve the program based on aggregated, de-identified usage patterns.

We do not sell personal data. We share data only with service providers ("processors") who process it on our behalf, under contract, and only to the extent needed to provide the Portal:

• Supabase — database, authentication, and file storage (Postgres with row-level security enforced on every user-scoped table).
• Vercel — application hosting and content delivery.
• Stripe — payment processing for the enrollment deposit (hosted Checkout; PCI DSS SAQ-A).
• Anthropic (Claude) — the AI models that power the in-portal learning assistant and the daily advisor. Requests are scoped to your own data and are not used by Anthropic to train their models under our commercial terms.
• Resend — transactional email delivery (grade notifications, deadline reminders, account emails).

We retain personal data for as long as your account is active and for a limited period afterward to satisfy legal, accounting, and program-completion (e.g. alumni verification, employer reference) purposes. Payment records are retained as required by applicable financial record-keeping obligations. When data is no longer needed, it is deleted or anonymized.

We apply defense-in-depth security controls appropriate to the sensitivity of the data:

• Row-level security (RLS) enforced at the database layer, so every query runs under your identity and can only return data you are authorized to see.
• Encryption in transit (TLS/HTTPS) for all traffic, and encryption at rest for stored data.
• Multi-factor authentication available to all users and required for administrator accounts.
• Signed, short-lived URLs for private files (homework, recordings) instead of public links.
• Audit logging of sensitive actions, and continuous monitoring for anomalies.

Depending on your jurisdiction, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise any of these rights today, contact us using the details below and we will respond within a reasonable time.

A self-serve data export and account-deletion flow within the Portal is planned and coming soon (tracked as STP-103). Until it ships, all such requests are handled manually by our team.

Because our service providers operate globally, your data may be processed in countries other than your own, including the United States and the European Union. Where required, we rely on appropriate safeguards (such as standard contractual clauses) offered by our processors for cross-border transfers.

The Full-Stack Java Developer program and the Portal are intended for adult learners only. We do not knowingly collect personal data from anyone under the age of majority in their jurisdiction. If you believe a minor has provided us with personal data, please contact us and we will delete it.

We may update this Privacy Policy from time to time. We will update the "Last updated" date above and, for material changes, provide additional notice (e.g. by email or an in-portal announcement).

For any privacy question or to exercise your rights, contact us at privacy@sarayatech.com.