Celebrium — Privacy Policy
Version: v0.2
Effective date: 2026-08-15
1. Who we are
Celebrium is an AI-native learning web application available at celebrium.ai (the "Service"). This Privacy Policy explains what personal data we collect, why, and what rights you have.
The data controller (the party responsible for your personal data) is:
- WFJ Lombard, sole proprietor (operator of Celebrium), South Africa
- Privacy contact: contact@celebrium.ai
- General contact: contact@celebrium.ai
We are based in South Africa, so the Protection of Personal Information Act, 2013 (POPIA) applies. Because our current users include people in the UK and EU, the UK GDPR and EU GDPR also apply. We aim to meet the requirements of all three.
We are currently running a private, invite-only trial with a small group of invited users.
2. What personal data we collect
We collect the following categories of personal data:
2.1 Account information
- Your name and email address.
- Authentication details (for example a password or sign-in identifier).
2.2 Learning and usage data
- Your course and lesson progress.
- Notes you create.
- Chats with the AI tutor (your prompts and the responses).
- Preferences and settings.
2.3 User content and uploads
- Courses you create.
- Materials you upload, such as PDFs or EPUBs, and the content generated from them.
2.4 Payment information
- When you make a payment, our payment provider (Paddle, planned) handles your card details as Merchant of Record. We do not store full card numbers. We may receive limited billing information such as your name, the last four digits of your card, and transaction status.
2.5 Device and log data
- Technical data such as IP address, browser and device type, app version, and timestamps.
- Log and diagnostic data about how the Service is used and any errors that occur.
- Data stored locally on your device (for example browser local storage) — see Section 11.
We do not intentionally collect special-category / sensitive personal data, and we ask you not to upload such data unless necessary.
3. How and why we use your data
We use your personal data to:
| Purpose | Examples |
|---|---|
| Provide the Service | Create and manage your account; save your progress, notes, and courses; let you publish public courses. |
| AI tutoring and generation | Send your prompts, uploads, and course content to our AI sub-processors to generate lessons, infographics, and tutoring responses, and to verify content. |
| Improve the product | Understand how features are used, fix bugs, and improve quality and reliability. |
| Billing | Process subscriptions, metered usage, and donations through our payment processor. |
| Communication | Send service, security, and account messages, and (where permitted) product updates. |
| Safety, security, and legal | Detect and prevent abuse, fraud, and security incidents; moderate content; comply with legal obligations. |
We do not sell your personal data.
4. Legal bases for processing
Where the law requires a legal basis to process your personal data, we rely on the following.
Under POPIA, we process personal information where it is:
- necessary to perform our contract with you (providing the Service);
- done with your consent (which you can withdraw);
- in our or a third party's legitimate interest (balanced against your rights);
- necessary to comply with a legal obligation.
Under UK/EU GDPR, the equivalent legal bases are:
- Contract (Art. 6(1)(b)) — to provide the Service you've signed up for.
- Consent (Art. 6(1)(a)) — for example for certain marketing or optional features.
- Legitimate interests (Art. 6(1)(f)) — to secure, improve, and operate the Service, where not overridden by your rights.
- Legal obligation (Art. 6(1)(c)) — to comply with applicable law.
Where we rely on consent, you can withdraw it at any time (see Section 8).
5. Third-party sub-processors
We use trusted third-party providers ("sub-processors") to run the Service. Each receives only the data needed for its role. The categories of sub-processor we use are:
| Category | What it receives | Why |
|---|---|---|
| AI model providers | Your prompts, uploaded or course content, and the source material a course is built from | To generate and verify lessons, assessments, images and tutoring responses |
| Database and file storage provider | Account data, learning and usage data, notes, courses, and uploads | To store and retrieve your data |
| Application hosting provider | Technical and log data needed to serve the app | To host and deliver the Service |
| Email delivery provider | Your email address and the message being sent | To send sign-in, security and account emails |
| Paddle, our Merchant of Record | Billing and payment details you give at checkout | To sell and process subscriptions and top-ups, and to account for sales tax or VAT |
We name Paddle because you contract with them directly at checkout and their name appears on your statement. For the others we identify the category rather than the supplier. If you want the current named list, ask us at contact@celebrium.ai and we will send it. Business customers who need a data-processing agreement receive the named list as part of it.
We may add or change sub-processors as the Service develops; we will update this list and, where required, notify you.
6. AI processing note
To deliver AI features, we send your prompts and relevant content (including text from your uploads, notes, and chats) to specialist AI model providers so they can generate or verify responses, lessons, and images. All of them are established providers operating under commercial terms.
- This means your content leaves our systems and is processed by these providers under their own terms and security measures.
- Please avoid putting sensitive personal data, confidential information, or anything you don't want processed by third-party AI into prompts or uploads.
- AI output can be inaccurate; it is for educational purposes only and is not professional advice (see our Terms of Service).
We use these providers under their commercial API terms, which state that content sent through the API is not used to train their models by default. We do not opt in to any training programme on your behalf.
7. Data retention
We keep personal data only for as long as we need it for the purposes in this policy, or as required by law:
- Account and learning data: while your account is active, and for a reasonable period afterwards.
- Uploads and user content: until you delete them or close your account (published public courses may persist for other users until removed).
- Backups: retained for a limited period and then deleted or overwritten.
- Billing records: kept as long as required by tax and accounting law.
When data is no longer needed, we delete or anonymise it. You can ask us to delete your account and its data at any time at contact@celebrium.ai.
8. Your rights
You have rights over your personal data under both POPIA and GDPR. These include the right to:
- Access the personal data we hold about you.
- Correct inaccurate or incomplete data.
- Delete your data ("right to be forgotten" / erasure), subject to legal limits.
- Export / port your data in a portable format.
- Object to or restrict certain processing, including processing based on legitimate interests, and to opt out of direct marketing.
- Withdraw consent at any time, where we relied on consent (this won't affect processing already carried out).
Under POPIA, you may also object to processing and lodge a complaint with the Information Regulator (South Africa).
Under UK/EU GDPR, you may lodge a complaint with your local supervisory authority (for example the UK Information Commissioner's Office, or your EU member-state authority).
To exercise any of these rights, contact us at contact@celebrium.ai. We will respond within the timeframes required by applicable law. We may need to verify your identity first.
9. International data transfers
We are based in South Africa, and some of our sub-processors — including our AI model providers and our hosting provider — process data in the United States or other countries outside South Africa, the UK, and the EU. Paddle, our payment provider, processes data in the United Kingdom.
This means your personal data may be transferred to and processed in countries whose data-protection laws differ from your own. Where we make such transfers, we put appropriate safeguards in place, which may include:
- Standard Contractual Clauses (EU and UK versions) or equivalent contractual protections;
- relying on the relevant lawful-transfer mechanisms under POPIA (Section 72) and GDPR;
- choosing providers that maintain recognised security and compliance standards.
10. Security
We take reasonable technical and organisational measures to protect your personal data, including encryption in transit, access controls, and use of reputable hosting and infrastructure providers.
No system is completely secure, so we cannot guarantee absolute security. If a data breach affects your personal data and the law requires it, we will notify you and the relevant regulator(s) as required under POPIA and GDPR. Please also help by keeping your password safe and reporting concerns to contact@celebrium.ai.
11. Cookies and local storage
The Service uses cookies and similar technologies, including your browser's local storage, to:
- keep you signed in and remember your settings;
- store some of your data on your device (for example progress and notes), which is being migrated to cloud accounts;
- understand and improve how the Service is used.
You can control cookies through your browser settings, but disabling some may affect how the Service works. Clearing your browser storage may delete locally stored data that has not yet synced to the cloud.
12. Children
The Service is currently a private, invite-only trial. Some invited learners are school-age, and a learner under 18 may take part only with the knowledge and permission of a parent or legal guardian.
A parent or legal guardian may contact us at any time at contact@celebrium.ai to see what personal data we hold about a learner in their care, to have it corrected, or to have the account and its data deleted. We will act on such a request without requiring a reason.
Before we open the Service beyond this invite-only trial, we will introduce formal age verification, age-appropriate design, and parental-consent mechanisms as required by POPIA and the GDPR.
13. Changes to this policy
We may update this Privacy Policy from time to time. If we make material changes, we will take reasonable steps to notify you (for example by email or an in-app notice). The "Effective date" at the top shows when the current version applies. Please review this policy periodically.
14. How to contact us / exercise your rights
For any privacy question, or to exercise your rights, contact us at:
- WFJ Lombard, sole proprietor (operator of Celebrium), South Africa
- Privacy contact: contact@celebrium.ai
- General contact: contact@celebrium.ai