Privacy notice

Updated October 28, 2026

1. Who is responsible and how to contact us

PracticalAIAssistant operates https://practicalaiassistant.com.

Business mailing address: 1933 Riverside Drive West, Windsor, Ontario, N9B 1A7, Canada.

Contact for privacy requests and complaints: kayden.knight1850@gmail.com; telephone 519 350 4539.

2. Information processed and purposes

• Visits and technical information: hosting providers process requests, including IP addresses and browser/network information, to deliver and protect the website. The application uses a country indication supplied by Cloudflare to choose a default CAD/USD currency; you can change the currency.
• Checkout and orders: we store Stripe checkout identifiers, edition, currency, amounts, timestamps, and the accepted access-policy version to fulfill purchases and enforce the purchased access rules. Tax-enabled orders separately record subtotal and tax.
• Access emails: payment confirmation supplies the checkout email address for delivery of the course code through Resend. The application clears the email from its paid-order record after Resend accepts the access email. Acceptance by Resend is not proof of inbox delivery or deletion from its systems. Failed or pending delivery can leave the email in the order record while the delivery problem remains unresolved.
• Sign-in and access: the database stores hashed access codes and session tokens, edition entitlements, and creation/redemption/expiry timestamps. The raw sign-in token is held in an essential browser cookie. The raw course code is included in the access email and processed when you sign in.
• Course progress: self-reported lesson-completion marks and timestamps are linked to the purchase's code hash. An explicit final confirmation records completion and ends access. This feature does not collect exercise documents or produce a personalized record of your work.
• Abuse prevention: sign-in attempts use keyed IP-derived identifiers, counters, and temporary lockout state. Mailing signup uses separate keyed IP/email identifiers and rate counters. These application records are not raw IP addresses, but can still be linked to other records using protected application secrets.
• Support: information you choose to send by email or telephone may be processed to answer questions, handle purchase problems, refunds, and privacy requests. Do not send passwords, full card details, or course codes.
• Local financial archives: selected website order records may be exported to the seller's computer and copied to external storage for financial recordkeeping. These copies contain payment references, edition, currency, amount, and record timestamps, but exclude checkout emails, access credentials, mailing subscriptions, and lesson progress. Payment references may still be linked to information held in Stripe; these records are not anonymous.

3. Service providers and international processing

Cloudflare provides hosting, request handling, and D1 database storage. Stripe handles payment and billing information, payment status, and its fraud/payment obligations. Resend handles course-access and requested mailing-list confirmation emails.

The course application does not receive or store full payment-card numbers or security codes. Stripe may process billing/contact information that is not copied into this application. Providers may process information outside Canada and retain their own service, security, transaction, or delivery records under their contracts, policies, and legal requirements.

Provider notices: Cloudflare, Stripe, and Resend.

4. Cookies and local activity

The essential __Host-course_session cookie maintains sign-in for up to 30 days. It is Secure, HttpOnly, and SameSite=Strict. Signing out clears it and revokes the session. A new sign-in replaces the previous session for that code; final completion also revokes access for completion-policy purchases. Blocking this cookie prevents normal signed-in course use.

Quizzes and the simulation provide browser-based learning activities; their answers are not stored in the application's course-progress database. Only the explicit lesson marks and final completion are tracked there. Downloading a study guide saves a file to your device. We cannot confirm that you saved it or control copies you keep.

5. Optional mailing list

Buying or accessing a course does not subscribe you. An unchecked signup checkbox and a separate email-confirmation action are required to subscribe to course updates and new course announcements.

The list stores the email, a keyed email identifier, subscription status, consent-text version, request/confirmation/withdrawal timestamps, and hashed link tokens. Confirmation links expire after 24 hours. Links require an explicit action; simply opening a confirmation or cancellation page changes nothing.

Unsubscribing immediately clears the email address from this list and stops the subscription. A minimal keyed identifier and consent/withdrawal record remain. Course access and necessary purchase/access emails are unaffected. Any marketing email must include unsubscribe instructions and sender contact details. The signup feature itself does not send marketing campaigns.

6. Retention and deletion

Current automated cleanup:

• Expired sign-in sessions are removed by daily cleanup.
• For completion-policy purchases, detailed lesson marks are removed by the daily cleanup once 90 days have elapsed after explicit final completion. The order, completion timestamp, and completed-code state remain; active purchases and original-policy purchases are excluded from this cleanup.
• Old sign-in-attempt records are removed after the applicable attempt window and lockout have ended, during daily cleanup.
• Unpaid/unfulfilled checkout-session records older than 30 days are removed unless linked to a paid order.
• Pending mailing-list requests expire after 24 hours and are removed by the next daily cleanup; expired confirmation tokens on active subscriptions are also cleared.
• Mailing abuse counters are removed by daily cleanup when their window is at least 24 hours old.

Financial records are retained for five years from each transaction date, then reviewed for deletion of information no longer needed. Specific legal recordkeeping requirements, an unresolved dispute or active access can require necessary records to remain longer; those cases need a documented reason and further review. The five-year period is the seller's selected policy, not a statement that every jurisdiction requires that period. There is no automatic five-year purge.

Access-code hashes and minimum entitlement/completion state remain as needed to provide active access and prevent completed purchases from being reopened. Detailed progress remains while access is active, unless separately removed following a verified request; the 90-day completed-progress cleanup above still applies. Minimal mailing consent/withdrawal evidence is reviewed for continued necessity separately from financial records. Support correspondence is reviewed when the issue is resolved; a necessary subset may remain for a documented obligation or dispute. Ending course access alone does not delete these records. Provider-held records are separate and do not inherit application cleanup deadlines.

Local financial snapshots are separate copies and are not removed by website cleanup. The same five-year financial-record review policy applies to local and external-drive archives. Privacy requests consider these copies too. No automated annual export or email schedule is currently configured.

7. Your choices and privacy requests

You can choose whether to purchase, supply optional mailing consent, mark lessons complete, or finally end access. You can sign out and unsubscribe. Providing the checkout email and necessary transaction information is required for normal payment fulfillment and code delivery.

Contact us to request access to, correction of, or deletion of your personal information, to withdraw optional consent, or to raise a privacy concern. We may need proportionate verification of the requester's connection to the purchase without requesting passwords or full card details. Legal recordkeeping requirements or the need to fulfill an active purchase may affect what can be deleted; we will explain applicable limits. Deletion of necessary access records may prevent continued course access and must be discussed first.

Requests are handled manually, not through a self-service order-data deletion feature. We consider the verified scope, preserve unrelated purchases and subscriptions, and explain what was changed, any information retained and provider/backups limitations. Deleting detailed learning marks does not by itself revoke a purchase. We discuss any requested change that would end active access before proceeding.

8. Security and notice changes

We use HTTPS, server-side access checks, hashed sign-in identifiers, and bounded requests. No online service can guarantee absolute security. Keep your course code and downloaded materials private.

Changes to this notice should be dated and communicated where required. New uses of information that require consent must not be treated as authorized merely because this notice changes.