Keystone Privacy Notice

Scope

This notice explains how AI BEAVERS processes personal data when you apply for the Keystone course at ai-beavers.com/keystone, confirm your application by email, receive a seat offer, get invoiced, take part in a cohort, or contact us about the course (for example about subsidized seats).

It supplements the main Privacy Policy. If the two documents conflict for a Keystone flow, this notice applies to that flow.

Controller

Alexander Zakharov
Turmweg 31
20148 Hamburg, Germany
Email: [email protected]

Data We Collect

• Application answers: full name, email address, function or role (including a written detail if you pick “Other”), optional AI-usage answer, and how you heard about us.
• Billing details: bill-to name, street and number, postal code, city, country, and an optional VAT or tax ID. These are collected so we can issue an invoice if you enroll.
• Consent and confirmation records: consent timestamp and version, double-opt-in confirmation tokens and their expiry, and confirmation status.
• Technical metadata: IP address used for rate limiting and abuse prevention, and submission timestamps.
• Correspondence: emails you send us about the course, including subsidized-seat requests and any context you share in them.

Purposes and Legal Bases

• Application review and seat offers: assessing fit and contacting you about the outcome. Legal basis: pre-contract steps under Art. 6(1)(b) GDPR.
• Confirmation and application emails: sending the double-opt-in confirmation email and updates about your application and cohort dates. Legal basis: consent under Art. 6(1)(a) GDPR, which you can withdraw at any time for future emails.
• Enrollment and invoicing: issuing the course invoice to you or your company, processing payment, and providing the course. Legal basis: contract under Art. 6(1)(b) GDPR and legal obligation under Art. 6(1)(c) GDPR for tax and accounting records.
• Abuse prevention: honeypot checks, IP rate limiting, and duplicate detection to keep the application flow working. Legal basis: legitimate interests under Art. 6(1)(f) GDPR.
• Course correspondence: answering questions and reviewing subsidized-seat requests. Legal basis: pre-contract steps under Art. 6(1)(b) GDPR and legitimate interests under Art. 6(1)(f) GDPR.

Required or Optional

Fields marked required on the application form (name, email, function, referral source, and billing address) are needed to review your application and prepare an invoice-ready record. The AI-usage answer and VAT or tax ID are optional. Applying does not commit you to enrolling or paying.

Recipients and Processors

• Firebase / Google Cloud: hosting and storage of application records.
• Resend: confirmation and application emails.
• Telegram: limited operational notifications to the course team when a new application arrives.
• Payment providers: where used to complete enrollment payments, under the payment section of the main Privacy Policy.

Transfers outside the EEA rely on the safeguards described in the main Privacy Policy, such as adequacy decisions or standard contractual clauses.

Retention

• Unconfirmed applications and expired confirmation tokens may be deleted after a reasonable period.
• Application records are kept while your application or cohort participation is active and then as needed for audit, dispute resolution, and legal claims.
• Invoice, payment, and accounting records are retained for statutory periods, including up to 10 years where German accounting and tax rules require it.

Your Rights

You have the rights described in the main Privacy Policy, including access, rectification, erasure, restriction, objection, and withdrawal of consent for future processing. To exercise them, email [email protected]. You may also lodge a complaint with a supervisory authority; the Hamburg authority is listed in the main policy.

Changes

We may update this notice when the course, our processors, or legal requirements change. The date at the top shows when this version was last updated.