Privacy policy
Last updated 4 October 2026
Learning Studio (“we”, “us”) is an instructional design workspace operated from India. This policy explains what personal data we collect, why, who we share it with and the choices you have. It applies to the website at this address, including public survey pages.
Contact
For privacy questions, data requests or complaints, use the privacy request form at the end of this page. It is also our grievance channel under India’s Digital Personal Data Protection Act, 2023 (DPDP Act). We reply to the email address you give, normally within 30 days.
What we collect
- Google sign-in details: your email address, name and Google account identifier, plus the times you sign in.
- Your profile: full name, organisation, job title, department, experience in learning and development, how you mainly use the service, and when you agreed to this policy.
- Your work: projects, project briefs, coach conversations, documents and their versions, trainer decks, project packs, brand settings (including any logo you upload), source files you upload or import, and surveys you create.
- Survey responses: answers submitted through your public survey links, and the respondent’s name when a survey is set to ask for it.
- Usage and security records: how many AI generations you use each day, a log of each AI or web-search request (feature, provider, model, size, duration and whether it succeeded), daily counts of security events such as blocked sign-ins or rate-limited survey submissions, and standard server logs kept by our hosting provider.
We do not sell personal data, show advertising, or use advertising or analytics trackers.
Why we use it
- To provide your private workspace, generate the materials you request and keep your saved versions.
- To pre-fill your organisation and department in new projects.
- To run the service fairly: daily AI limits, abuse prevention, security and troubleshooting.
- To understand who uses the service (for example, experience levels and organisations) and improve it.
We process this data on the basis of the consent you give when you complete your profile, and because it is needed to provide the service you asked for. You can withdraw consent at any time (see Your rights); we will then stop processing and delete your account.
AI and other service providers
To deliver the service, we share data only with these providers, and only for the purposes described:
- Cloudflare hosts the website and database and runs the main AI model (Workers AI). Your project context, uploaded sources and requests are sent to it when you generate content.
- OpenRouter is used as a backup when the main AI model is unavailable, or when you choose it. Requests are routed to free AI models whose providers may log or use prompts under their own terms. Avoid putting confidential or sensitive personal information in your requests.
- Sarvam AI may be used as an alternative AI provider if the main model is not available.
- Tavily receives only your search query when you turn on web research.
- Google provides sign-in. Google Drive and Notion connections are limited to the website owner’s account.
These providers may process data in countries other than yours, including outside India. We do not ask AI providers to train on your content, but we cannot control each provider’s own practices beyond their published terms.
Who can see your data
Your workspace is private to your account. The website owner can view account details, profiles, usage records and workspace content to operate, support and secure the service, and to handle legal requests. Every time the owner opens someone’s content, it is recorded in an internal audit log. Survey responses are visible to the person who created the survey.
Cookies
We use only cookies that the service needs to work:
- Sign-in session (up to 7 days) keeps you signed in.
- Sign-in check (10 minutes) protects the Google sign-in step.
- Sidebar preference remembers whether the menu is open.
How long we keep data
We keep your account and workspace until you or the website owner delete them. When an account is deleted, its projects, documents, decks, surveys, responses and sources are removed. AI usage records are kept without your identity so service totals stay accurate. Server logs held by our hosting provider expire under that provider’s retention schedule. Database backups used for recovery are overwritten within about 30 days.
Your rights
Under the DPDP Act and, where they apply, the EU and UK GDPR, you can:
- access a summary of your personal data, or get a copy of it;
- correct your details (you can edit your profile at any time from My profile);
- have your account and personal data deleted, or withdraw your consent;
- nominate someone to exercise these rights for you in case of death or incapacity;
- complain to us using the contact above, and then, if unresolved, to the Data Protection Board of India or your local data protection authority.
Use the privacy request form and give the email address linked to your account. Before acting on a request, we may confirm by replying to that address.
Security
The site uses HTTPS everywhere and signed, HTTP-only session cookies. Connection tokens are encrypted, and browser security protections are in place. Access to workspaces is checked on every request. No system is perfectly secure. If a breach affects your personal data, we will inform you and the authorities as the law requires.
Children
The service is intended for adults and professionals. Do not use it if you are under 18.
Changes to this policy
We will update the date above when this policy changes. We will tell you about significant changes when you next sign in, and ask for your consent again if the law requires it.