Privacy Policy

Last updated: 3 September 2026 · GDPR-friendly version, in the same plain tone as everything else we ship

1. Who handles your data

CourseSystem is the data controller for this site and the email list. Contact: coursesystem@support.example. Payments are processed by Gumroad, Inc. as an independent controller/merchant of record — their own privacy policy governs the checkout itself.

2. What we collect (the honest short list)

• Purchase data — name, email, product bought, price, timestamp. Received from Gumroad to deliver your files and your updates.
• Support conversations — if you write us, we keep the thread to help you (and, during Foundry's 30-day support window, to serve you at all).
• Newsletter/post-purchase emails — your email, with unsubscribe always one click away.

What we don't collect: this website runs no analytics, no tracking pixels, no advertising cookies. It's a static page. It couldn't track you if it wanted to.

3. Why (legal bases, GDPR)

• Contract performance — delivering the files and updates you paid for.
• Legitimate interest — support, fraud prevention, product improvement.
• Consent — optional marketing emails; withdrawable anytime via the unsubscribe link.

4. Cookies

This site sets zero cookies. Gumroad's checkout overlay (opened via our buy buttons) sets its own functional cookies under their policy.

5. Who ever sees it

Only the processors needed to run this: Gumroad (payments/delivery) and our email tool for buyer communications. We never sell, rent or trade personal data. Ever. That's a sentence we're happy to be held to.

6. How long we keep it

• Purchase records: as long as the product line exists (you bought lifetime updates) or as tax law requires, whichever is longer.
• Support threads: 24 months, then deleted.
• Marketing emails: until you unsubscribe.

7. Your rights (all of them, one email away)

Access, rectification, erasure ("right to be forgotten"), restriction, portability, objection — email coursesystem@support.example and we handle it within 30 days. EU residents may also lodge a complaint with their national DPA (in Italy: the Garante per la protezione dei dati personali).

8. Security & transfers

Data lives with the processors above, protected by their respective security programs; some processing happens on US infrastructure under the applicable safeguards (e.g. Standard Contractual Clauses). We keep the data we hold ourselves to the minimum email-and-records set described above.