Politika e privatesise

Kategorite e të dhenave

• IP address
• hashed IP-derived visit key where available
• browser and device details
• requested URLs and timestamps
• approximate country, region, city, and location tag where hosting headers provide it
• first-party page visit counts linked to an account or hashed IP-derived visit key
• referrer and response diagnostics
• cookie-consent state

Baza ligjore

Legitimate interests in operating a secure public website and documenting security-relevant events.

Marresit dhe ruajtja

• Dark Blue Cave Academy admins and operators
• hosting, database, and infrastructure processors

Operational logs and first-party visit counters stay only as long as reasonably needed for security, uptime, support diagnostics, debugging, backups, and recovery.

Kategorite e të dhenave

• name
• email address
• profile image
• role and approval status
• account identifiers
• authentication and anti-forgery cookies

Baza ligjore

Steps requested by the user to access the service, performance of the account service, and legitimate interests in account security.

Marresit dhe ruajtja

• Google as authentication provider
• Dark Blue Cave Academy admins
• Vercel Blob as managed object-storage processor for custom profile images where uploads are used
• hosting, database, and session processors

Account records stay while the account is active and afterward only for legitimate operational, security, dispute, backup, or audit needs.

Kategorite e të dhenave

• name
• email address
• phone number
• application answers
• selected program details
• review notes and timestamps

Baza ligjore

Steps taken at the user's request before entering a training relationship, plus legitimate interests in reviewing admissions and managing academy operations.

Marresit dhe ruajtja

• Dark Blue Cave Academy admins and reviewers
• hosting and database processors

Admissions records stay while the review, follow-up, support, dispute, and reasonable archive windows remain necessary.

Kategorite e të dhenave

• enrollment records
• lesson and progress data
• optional student learning interests, skill level, and learning goal
• AI-generated learning path titles, steps, goals, duration, difficulty, visibility, and source metadata
• official course draft promotion metadata copied from eligible public generated learning paths, including original path identifiers, creator attribution, topics, generated steps, and source references
• AI-generated quiz, practice session, answer, score, pass/fail, weak-area, learning point, and badge records
• learning improvement signals, public generated-content ratings, generated quiz outcome signals, weak-topic aggregates, low-rated content indicators, and admin improvement feedback
• learning research center topics, background research job status, research briefs, reusable retrieval chunks, skill maps, learning curves, suggested game modes, quality and coverage scores, admin source notes, source URLs, pasted source text, uploaded research file metadata, extracted text from supported text/PDF files, license labels, usage-right notes, and attribution records
• generated learning moderation flags, quality and risk scores, moderation summaries, user report reasons, report details, priorities, statuses, and review timestamps
• admin learning cockpit aggregate reports, source-reference coverage metrics, top learning topic signals, content promotion indicators, and moderation queue metadata
• external educational source lookup topics, source titles, URLs, summaries, provider names, licenses, attribution text, reuse counts, and generated-content reference metadata
• certificate metadata
• public learning proof item titles, summaries, source labels, visibility state, and related timestamps
• event and session participation
• role and access status

Baza ligjore

Performance of the learning service and legitimate interests in operating the academy, documenting completions, and resolving support issues.

Marresit dhe ruajtja

• Dark Blue Cave Academy admins and mentors where needed
• hosting and database processors
• Vercel Blob as managed object-storage processor for admin-uploaded learning research files where research file uploads are used
• public educational source APIs such as Wikimedia projects, OpenStax, Open Library, arXiv, OpenAlex, and Internet Archive when AI learning source lookup is used

Learning records stay as long as needed to operate programs, document completions, support alumni requests, and maintain reasonable archive and backup copies.

Kategorite e të dhenave

• account identity and role
• friend invitation email addresses and friend request status
• accepted friend list metadata and public proof visibility shown inside social learning surfaces
• conversation participants
• message and support conversation content
• read, archive, assignment, and status metadata
• related course, session, or operational record references
• notification metadata

Baza ligjore

Performance of the requested account, learning, and support service, plus legitimate interests in secure communication, moderation, operational continuity, and dispute resolution.

Marresit dhe ruajtja

• conversation participants according to platform permissions
• Dark Blue Cave Academy admins, managers, and mentors where their role permits access
• hosting and database processors

Conversation, friend request, invitation, and notification records stay while needed for the active account, course operations, support history, moderation, disputes, audits, backups, and reasonable archive windows.

Kategorite e të dhenave

• assistant question content sent to the configured AI provider for response generation
• assistant answer content returned to the user
• short-lived AI chat questions and answers, including sanitized Private Chat, IP address, country, region, city where provided by hosting headers, privacy mode, and a compact location tag for admin support and security review for up to 24 hours; raw IP addresses are shown only on the protected admin AI Usage page for User Aware interactions and stay hidden for Private Chat
• explicit AI assistant language preference for signed-in users or guest browser sessions, plus language labels and English admin-support translations for non-Albanian short-lived interaction logs
• AI image generation prompts, generated image URLs, revised prompts where provided, model names, and generated image metadata for guest previews, free-user previews, subscribed users, and admins
• AI video generation prompts, negative prompts where provided, queued job status, model/provider metadata, selected video settings, generated video URLs when available, and job timestamps for subscribed users and admins
• saved AI conversation titles and full message content for subscribed users and admins
• AI privacy preferences such as User Aware, Private Chat default, saved chat history, memory update settings, and explicit assistant language preference
• optional personal AI overview text entered by the user in settings for User Aware personalization
• compact personal AI context cards, source references, status, scoring, disregard, and admin governance metadata when User Aware memory is enabled
• sanitized AI context candidates from eligible saved chats and low-trust sanitized Private Chat interaction logs, source references without raw IP addresses, scoring flags, review status, promoted verified context records, and review audit events when context-dataset extraction is enabled; candidates and verified context records are not used directly in assistant prompts unless a separate retrieval feature is enabled and the configured rollout permits the requester
• selected AI debug cases that may include the user message, assistant answer, detected intent, provider, model, lookup query, candidate metadata, confidence score, and admin notes
• uploaded AI chat image, screenshot, or reference image files and attachment metadata for subscribed users and admins
• uploaded screenshots or images sent to the configured AI provider for assistant analysis when eligible users ask for visual help
• public web-search queries, public search snippets, source URLs, and short fact sheets when eligible users, including guests during promotion-week web-search access, ask for live public information and the AI Architecture runtime is enabled
• public visual-search topics, openly licensed image metadata, thumbnails proxied through the platform, source URLs, creator names, and license labels when the assistant enriches general chat or learning answers with educational image cards
• AI learning source lookup topics sent to selected public educational APIs, plus source URLs, titles, summaries, license labels, and attribution metadata returned by those sources
• AI learning research center topics, source index matches, background research job status, research briefs, reusable retrieval chunks, skill maps, suggested game modes, admin-provided source notes, pasted source text, uploaded research file metadata, extracted text from supported text/PDF files, license labels, usage-right notes, and attribution records when admins build reusable learning research
• public YouTube channel names, handles, channel IDs, lookup terms, source URLs, and public channel statistics when subscribed users or admins ask for YouTube channel information
• saved AI conversation route path, mode, archive status, and timestamps
• account or anonymous session identifier where available
• hashed IP-derived limiter key where available
• short-lived IP address and approximate request location on AI interaction logs where available
• route path where the assistant was used
• prompt and response lengths
• model name
• request status and short reason codes
• token counts and estimated cost metadata where available
• timestamps

Baza ligjore

Legitimate interests in controlling service cost, preventing abuse, and operating the assistant safely.

Marresit dhe ruajtja

• Dark Blue Cave Academy admins and operators
• hosting and database processors
• Vercel Blob as managed object-storage processor for uploaded and generated AI chat images and generated videos when video output storage is active
• OpenAI or the configured local/cloud AI provider when the assistant, screenshot analysis, AI image generation, reference-image editing, or future video generation worker is used
• Serper as public search API provider when the optional hybrid retrieval layer is enabled
• Openverse as an openly licensed image-search provider when assistant visual cards are shown
• Wikimedia project APIs, including Wikipedia and Wikibooks, OpenStax public book metadata APIs, Open Library metadata APIs, arXiv APIs, OpenAlex APIs, and Internet Archive APIs when AI learning source lookup is used
• Google / YouTube Data API as public YouTube channel lookup provider when configured
• OpenRouter or the selected model provider behind OpenRouter when the optional hybrid reasoning layer is enabled

Usage metadata stays only as long as reasonably needed for cost control, abuse prevention, operational diagnostics, backups, and aggregate reporting. Full prompts and full responses are not stored in usage telemetry. Short-lived AI interaction logs, including sanitized Private Chat content, available IP address, privacy mode, assistant language label, optional English support translation for non-Albanian logs, and approximate request location, expire after 24 hours and are used only for admin support and security review; raw IP addresses are shown only on the protected admin AI Usage page for User Aware interactions and stay hidden for Private Chat. Explicit assistant language preferences stay until changed or account/session cleanup. Guest preview image metadata and files stay only as long as reasonably needed for delivery, cost control, abuse prevention, backups, and operational cleanup. Saved AI chat history, sanitized context candidates, promoted verified context records and review events, personal context cards and governance events, selected debug cases, uploaded AI chat attachments, generated AI image metadata, and AI video job metadata for signed-in users and admins stay while needed for account continuity, support, user-requested archive/delete flows, debugging, model-quality review, backups, and reasonable operational retention. Provider processing follows the configured AI provider account terms and operational retention.

Kategorite e të dhenave

• account and entitlement status
• requested tutorial and lesson identifiers
• IP address
• browser and device details
• short-lived playback-token request metadata and delivery diagnostics

Baza ligjore

Performance of the requested learning service and legitimate interests in secure access control, protected media delivery, and operational troubleshooting.

Marresit dhe ruajtja

• Cloudflare Stream as protected video hosting and delivery processor
• Dark Blue Cave Academy admins and operators where needed for support
• hosting and database processors

Short-lived playback tokens are generated on demand and expire quickly. Operational delivery and support diagnostics stay only as long as reasonably needed for troubleshooting, security, and backup or recovery needs.

Kategorite e të dhenave

• name
• email address
• notification subject and transactional message content
• delivery state, timestamps, and failure diagnostics

Baza ligjore

Performance of the requested service where the email is part of account or learning operations, plus legitimate interests in reliable operational communication, support, and auditability.

Marresit dhe ruajtja

• configured SMTP or email-delivery processor
• Dark Blue Cave Academy admins
• hosting and database processors

Queued notification records and delivery metadata stay as long as reasonably needed for support, operational troubleshooting, audits, and backup or recovery needs.

Kategorite e të dhenave

• uploaded image files
• file names and content-type metadata
• related user or content-record references
• browser IP address and upload diagnostics handled by the storage processor

Baza ligjore

Performance of the requested service for profile and editorial updates, plus legitimate interests in reliable media hosting and safer public asset delivery.

Marresit dhe ruajtja

• Vercel Blob as managed object-storage processor
• Dark Blue Cave Academy admins and mentors where needed
• hosting and database processors

Managed uploads stay until replaced or removed from the relevant record, with reasonable backup and recovery windows retained only as operationally necessary.

Kategorite e të dhenave

• public titles and summaries
• public generated learning path and quiz titles, topics, categories, difficulty, creator attribution, ratings, reuse counts, source references, and publication timestamps
• approved profile, portfolio, and user-controlled public learning proof content
• public image and media assets
• publication timestamps and slugs
• visitor IP address and browser details when externally hosted media assets are loaded

Baza ligjore

Legitimate interests in publishing the academy's public content and, where applicable, fulfilling public-profile or portfolio visibility requested by the user.

Marresit dhe ruajtja

• site visitors
• search engines and public web crawlers
• hosting, CDN, and managed object-storage processors where used
• external asset hosts when admins intentionally configure remote media URLs

Public content stays live until removed, archived, or replaced, with backups and operational archives retained as reasonably necessary.

Kategorite e të dhenave

• IP address
• browser and device details
• player interaction data
• cookies or online identifiers set by YouTube or Google

Baza ligjore

Consent.

Marresit dhe ruajtja

• YouTube / Google
• Dark Blue Cave Academy only for the local consent record

Consent preference is stored for 180 days. Any third-party retention applied by YouTube or Google is governed by their own policies.

Kategorite e të dhenave

• account identity and email
• order reference
• course identifier
• subscription plan identifier
• amount and currency
• payment callback metadata
• purchase, subscription status, and timestamps
• visitor IP address, browser, and device details when the Paysera Trust Badge script loads

Baza ligjore

Steps requested by the user to buy a course or subscription, performance of the purchase flow, and legitimate interests in fraud prevention, support, accounting, and reconciliation.

Marresit dhe ruajtja

• Paysera as payment processor
• Dark Blue Cave Academy admins
• hosting and database processors

Payment and reconciliation records stay as long as reasonably required for accounting, support, fraud prevention, and audit obligations. Browser-side Trust Badge diagnostics are handled by Paysera according to its own service and privacy terms.