Política de Privacidade

1. Who controls your data

Devign LLC, 5830 E 2nd St, Ste 7000 #23016, Casper, WY 82609, United States, a limited liability company registered in the State of Wyoming, United States, is the controller of the personal data described here. For privacy questions, including any request to exercise your rights, contact info@devignlb.com.

We are a United States company serving creators in Europe, Türkiye, Latin America, Asia and the Middle East, so this policy is written to meet the GDPR and UK GDPR, Türkiye's KVKK, and United States state privacy laws at the same time. Where those give you different rights, you get whichever applies to you.

2. What we collect, and why

We collect only what the Service needs to work.

• Account: your email address, the display name and language you choose, and your password, which we store only as a one-way hash. Used to create your account, confirm your email address, send password reset links and sign you in. Legal basis: performance of our contract with you.
• Devign creators from the Devign Creator App: when you open the Site from the app, the app's server gives us a pseudonymous reference for you (never your phone number), your display name, your language and whether you are a member of the Devign agency. Used to sign you in and to decide whether every Course is free for you. Legal basis: performance of our contract with you.
• Learning progress: which lessons you started, how far you watched, your quiz answers and results, and which Courses you finished. Used to resume where you left off and to show your progress. For Devign creators, the same progress is shared with the Devign Creator App, which uses it to award Devign Points for finished courses. Legal basis: performance of our contract with you.
• Subscription, order and tax records: whether you hold a paid subscription and until when; for each order, the time you accepted the Terms and asked for the subscription to start, the amount, the VAT and your country, which the checkout asks for so that the right VAT is charged. Card details are never sent to or stored by us; they go directly to our payment processor. Legal basis: contract, and legal obligation for tax and transaction records.
• Cancellations and withdrawals: the email address and the name you enter on the cancel or withdraw page, the reason you give if you cancel with immediate effect, the time the request arrived and a keyed hash of the IP address it came from. Used to carry out the request, confirm it to you, decide on a refund (a person on our team reads the reason for an immediate cancellation made after the withdrawal period) and keep proof of when it arrived. Legal basis: contract and legal obligation.
• Your country, for the price: to show the price with your country's VAT, our server looks up the country of your IP address in a geolocation database kept on our own server (IP to Country Lite by DB-IP, db-ip.com, licensed under CC BY 4.0). Nothing is sent to anyone else for this, and the country is not stored with your account. Legal basis: legal obligation to show prices including VAT, and our legitimate interest in showing you the price you will actually pay.
• Support correspondence: anything you send us. Legal basis: our legitimate interest in answering you.
• Security and abuse signals: for each signed-in session, a hash of its token, a keyed hash of your IP address and your browser's user agent; rate-limit counters kept under keyed hashes; an audit trail of security and billing events; and, for failed sign-ins only, the IP address in a log our firewall reads to block repeated attacks. Legal basis: our legitimate interest in keeping the Service and your account secure.

You need an email address to have an account; without one we cannot provide the Service. We do not make decisions about you by automated means that have legal or similarly significant effects on you.

3. Cookies

The Site uses no advertising or analytics cookies and no third-party trackers, so there is no consent banner. It sets only these strictly necessary cookies, all limited to this Site, sent only over a secure connection and not readable by scripts:

• a session cookie that keeps you signed in (up to 60 days, or until you sign out);
• a security cookie that protects the forms you send from forgery (until you close the browser);
• a language cookie that remembers the language you picked (one year);
• a short message cookie that shows a confirmation after an action (two minutes).

The fonts and the video player are served from our own server, so loading a page does not make your browser contact Google or any other provider.

4. Who we share it with

We do not sell personal data. We share it only with those who help us run the Service:

• Stripe: to take the monthly subscription payment, calculate the VAT on it, store your payment method for renewals, and handle cancellations and refunds. Stripe receives your email address, your billing address and your payment details and acts as an independent controller for payment data; we never receive or store your card number.
• The Devign Creator App's server (operated by us): only for Devign creators who open the Site from the app, as described in section 2.
• Our hosting and email infrastructure: servers we operate, which store your account and send verification, confirmation and support email from our own mail server.
• Authorities: where we are legally required to disclose, and only to the extent required.

5. Where your data goes

Devign is a United States company. When you use the Service you give your data directly to us, and it is stored on servers we operate. Stripe may process it in the United States and in other countries.

If you are in the EEA, the UK or Switzerland, your data therefore goes to the United States, and the GDPR still applies to how we handle it. When we pass it to a provider outside the EEA, we rely on the European Commission's adequacy decision where that provider is certified under the EU-U.S. Data Privacy Framework, and otherwise on the Commission's Standard Contractual Clauses (with the UK Addendum where relevant), together with the security measures described in section 10. You can ask us for a copy of these safeguards at info@devignlb.com.

6. How long we keep it

• Account and learning progress: for as long as your account exists. When you delete your account, we delete them, except what we must keep for the reasons below.
• Email links: verification links expire after 48 hours and password reset links after an hour; neither works after it has been used.
• Sessions: until you sign out, or 60 days at most.
• Payment, order and refund records: as long as tax and accounting law requires, which can be up to 10 years.
• Cancellation and withdrawal requests: 3 years after the end of the year in which the subscription ended.
• Support correspondence: up to 24 months.
• Security logs and rate-limit counters: rate-limit counters for at most two days; failed sign-in logs and the audit trail for up to 12 months.

7. Your rights

Depending on where you live, in particular under the GDPR in the EEA, the UK GDPR, and Türkiye's KVKK, you have the right to access the personal data we hold about you, to correct it, to delete it, to restrict processing, to receive it in a portable format, and to withdraw consent where processing is based on consent. Where we rely on our legitimate interests, you may object at any time on grounds relating to your particular situation.

To exercise any of these, email info@devignlb.com. We will respond within one month. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work or where you believe the law was broken.

8. If you are in the United States

Residents of California and of other states with comprehensive privacy laws (including Colorado, Connecticut, Virginia, Texas and Utah) have the right to know what personal information we collect and why, to request a copy of it, to correct it, to request deletion, and not to be discriminated against for exercising any of those rights.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We run no advertising or analytics trackers on this Site, so there is nothing to opt out of, but you may still submit any of the requests above.

To make a request, email info@devignlb.com. We will verify it against the email address on the account before acting, and respond within 45 days. You may use an authorised agent.

9. Children

The Service is not directed at anyone under 18 and we do not knowingly collect personal data from anyone under 18. If you believe a minor has given us personal data, contact us and we will delete it.

10. Security

Passwords are stored only as a one-way hash, never in readable form, and changing or resetting one signs every other device out. Session cookies are random and we store only a hash of them. The parts of the Site that handle payments use a separate database account that the rest of the Site cannot use. Traffic between your browser and our servers is encrypted. No system is perfectly secure; if a breach affects your personal data and poses a risk to you, we will notify you and the relevant authority as the law requires.

11. Changes

If we change this policy materially we will update the date at the top and notify account holders before the change takes effect.