Privacy Policy

1. Who this covers

This policy explains what Corsai does with personal information when you visit corsai.co, when you use the creator workspace, and when you join a creator's community or course as a student.

Two different relationships run through Corsai, and it matters which one you are in. For your own account we decide how your information is used. For information a creator collects about their students through Corsai, the creator decides — we process it on their behalf, and their own privacy notice governs it.

2. What you give us

Only what the product actually needs:

• Account details — your email address, a hashed password if you set one, and your name. If you sign in with Google or Apple we receive your email, name, and profile picture from them, never your password.
• Profile details you choose to add — a username, bio, avatar and banner images, and links to your website or social accounts. All of this is optional, and what you put here is visible to other members of communities you belong to.
• Onboarding answers — what you teach, who your audience is, your niche, roughly how large your following is, and what you want to build. This is what the course-building stages work from.
• Voice samples — writing of your own that you paste in or upload, so the lessons come out sounding like you.
• Content you create — courses, lessons, storefront copy, resources, events, and community messages.
• Files you upload — images, video, audio, and documents for your storefront, your lessons, your resource library, and chat.
• Messages you send us — through the contact form or by email, including your name, address, and what you wrote.

We never see your card. Subscription payments are taken on Stripe's own hosted checkout and billing pages: your card details go to Stripe and never reach our servers. What we store is Stripe's customer and subscription identifiers, the plan you are on, and its status — enough to know what your account is entitled to, and nothing that could be used to charge a card.

3. What we collect automatically

Very little, and less than most products of this kind.

• Session cookies that keep you signed in, and a cookie remembering which workspace you had open. These are necessary for the product to work.
• A cookie set by our product-analytics provider, holding a random identifier so repeat visits count as one person rather than several. It is set on corsai.co and the creator workspace only — never on a published creator storefront or anywhere your students go. There is no advertising or cross-site tracking cookie on Corsai.
• A last-seen timestamp when you are active in a community, so unread counts and the member list work.
• Server logs from our hosting and database providers, which include IP addresses and request details, kept for security and debugging.

We run product analytics on corsai.co and on the creator workspace, and this is what it records: which page was viewed, and a fixed list of milestones in building a course — an account being created, an interview finished, a build started or completed, a site published, a subscription started or cancelled. Each carries the page path, an account identifier, and counts or timings. None of it carries what you wrote: not your interview answers, not lesson content, not community messages, not your email address.

It is not advertising, it does not follow you to other websites, and it is switched off entirely on published creator storefronts — your students are not measured by us at all. We use it to see where people get stuck in building a course, which is a question about the product rather than about any one person.

4. Why we use it

To operate your account and workspace; to run the AI agents that research, structure, and write your course in your voice; to render your storefront to visitors; to deliver lessons and community access to your students; to reply when you contact us; to keep the service secure and diagnose faults; and to comply with legal obligations.

We do not sell personal information. We do not share it with advertisers, and we do not use it to build profiles for anyone else's marketing.

5. AI processing, and what we do not do with your content

Building a course means sending your material — your onboarding answers, your voice samples, and your drafts — to AI model providers to be processed. That is the product working as intended, and it is the only reason your content leaves our own systems for this purpose.

We do not use your content to train shared or general-purpose AI models, and we ask the model providers we use to contractually commit to the same.

There is no separate stored 'voice profile' today. The voice samples you give us are kept with the rest of your workspace content and passed to the model as part of the request each time something is written for you — so deleting them from your workspace is what removes them, and they go when the workspace goes. If that changes and we start building a durable per-creator voice model, we will say so here before we do.

6. Who else processes it

We keep the list of companies that touch your data short, and each one is there because the product needs it:

• Neon, our database provider, which stores the application's data.
• Vercel, our hosting provider, which runs the application and serves published storefronts.
• Our object-storage provider, which stores the files you upload.
• Anthropic, whose models process the material described in the previous section.
• Stripe, which runs subscription checkout and billing and holds the card details we never see. When you sell to your own students it is also the provider behind your own connected account, and there it acts for you rather than for us.
• Resend, our email provider, which delivers the mail the product sends — password resets, welcome and access emails, and purchase and refund notices. It receives the recipient's email address and the contents of that message. This one also applies to your students, because those emails go to them.
• PostHog, our product-analytics provider, which receives the page paths and product milestones described above. It never receives your content, and it is not loaded on published creator storefronts.
• Google and Apple, if you choose to sign in with them.

Each acts on our instructions under a written agreement, and none of them is permitted to use your data for their own purposes. We update this policy when the list changes.

7. Where your data is held

Corsai's database and file storage are hosted in the United States. If you are elsewhere, using Corsai means your information is transferred there and to the other providers listed above, some of which operate in other countries too.

Where those transfers involve personal information protected by UK or EU law, we rely on the appropriate safeguards for international transfers, including standard contractual clauses where they apply.

8. How long we keep it

Account and content data is kept for as long as your account is open. Deleting a workspace deletes the content in it — its community and messages, and the files uploaded to it — and that cannot be recovered. Deleting your account removes your profile and your content on the same terms.

Neither is a self-serve control in the product yet: ask us and we will do it. We will not make you go through a process designed to discourage you, and we do not treat a deletion request as a chance to talk you out of it.

Backups may retain copies for a short additional period before they cycle out.

Messages you send through the contact form are kept while we deal with them and for a reasonable period afterwards, so we have a record of what was asked and answered.

Some records are kept longer where the law requires it, for example accounting records once paid plans exist.

9. Your rights

Depending on where you live you may have the right to ask for a copy of the personal information we hold about you, to have it corrected, to have it deleted, to object to or restrict how we use it, and to receive it in a portable format.

You can change most of it yourself in your account settings. For anything else, write to us and we will action it — we will not make you go through a process designed to discourage you.

If you are a student in a creator's community and you want your information removed, ask the creator first, since they decide what happens to it. If you cannot reach them, contact us and we will help.

If you are in the UK or EU you also have the right to complain to your data protection authority.

10. Security

Passwords are stored hashed, never in plain text. Traffic to Corsai is encrypted in transit. Access to production data is limited to the people who need it to run the service.

Corsai is early-stage software and has not been through an independent security audit or certification. We would rather tell you that than imply a level of assurance we have not earned. If you find a security problem, please write to us before disclosing it publicly and we will treat it as a priority.

11. Children

Corsai is not for children. You must be at least 18, or the age of majority where you live, to hold an account. We do not knowingly collect information from children, and if we learn we have, we will delete it.

12. Changes to this policy

We will update this policy as the product changes. Analytics, email, and payments have all since been added, and this page describes each of them; the next thing likely to change it is a durable voice profile, which does not exist yet.

The effective date at the top always reflects the current version. Where a change materially affects you, we will give notice in the product and by email where we hold a working address.