Privacy Policy

Introduction

Course Catalyst is a platform that lets creators build and run their own course websites. This policy explains what data we collect, why we collect it, who we share it with, how long we keep it, and the controls you have.

Two kinds of people use Course Catalyst: creators, who pay us to run their site, and students, who buy courses from those creators. When a creator uploads or manages data about their own students and contacts, the creator is responsible for that data. We process it on their behalf to run the platform.

Data we collect

• Account data. Your name, email address, and login credentials when you create a Course Catalyst account.
• Tenant content. The pages, courses, lessons, media, emails, and settings you create on your site.
• Contact and student data. The names, email addresses, subscription and consent state, and course activity of the contacts and students a creator uploads or collects through their site.
• Payment data. Payments are processed by Stripe. Card details go directly to Stripe, we do not store full card numbers. We keep records such as amount, status, and the product purchased.
• Usage data. Standard technical data such as log entries, device and browser information, and cookies used to keep you signed in and to operate the site.

How we use it

• To provide and operate the platform and the sites creators build on it.
• To process purchases and give students access to what they bought.
• To send email that a creator sends or previews from their own account.
• To secure accounts, authenticate access, and prevent abuse.
• To support creators and respond to requests.

We do not sell your data, and we do not use it for third-party advertising.

Third-party processors

We use a small set of service providers to run the product. Each handles data only to provide its service to us:

• Vercel, application hosting.
• Prisma Postgres, the database that stores account and site data.
• Bunny CDN, media and video storage and delivery.
• Resend, email delivery, used only when a creator sends or previews an email.
• Stripe, payment processing.

Data retention

We keep account and site data for as long as your account is active so the platform can function. When data is deleted, it is removed from our active systems, though copies may persist for a limited time in routine backups. We keep records we are required to retain for legal, tax, or accounting reasons (for example payment records) for as long as the law requires.

AI Assistants and Connected Apps

Course Catalyst offers a connector that lets creators manage their own site through AI assistants such as ChatGPT and Claude. This section describes exactly what data flows through that connector.

What the AI assistant sends us

Your identity, via OAuth. When you connect, you sign in to your own Course Catalyst account and approve access. The assistant receives short-lived tokens tied to your account. We never see or store your assistant conversations, and the assistant never receives your password.

Tool call parameters. When you ask the assistant to do something (for example "create a coupon" or "update this lesson"), the assistant sends us only the structured parameters of that action (titles, text content, email addresses of your own contacts, ids). These are processed to perform the action and are handled the same way as the same action performed in the dashboard.

What we return to the assistant

Only data from your own site, under your own account: your pages, courses and lessons, your contacts and their subscription state, your broadcasts, coupons, and related settings. The connector is strictly scoped to one site. It can never read another creator's site or another creator's customers.

Storage

• OAuth access and refresh tokens are stored hashed. The plaintext token is never saved.
• We do not store your assistant conversations. The only records we keep are the same application records any dashboard action would produce.

Token lifetimes and revocation

• Access tokens expire after 1 hour.
• Refresh tokens expire after 30 days.
• You can revoke a connected assistant at any time in your Course Catalyst settings, which invalidates its tokens immediately.

Recipients and third parties

The connector introduces no new third parties. Data touched through it flows only through the infrastructure Course Catalyst already uses (Vercel, Prisma Postgres, Bunny CDN, Resend, and Stripe), described above. The AI assistant provider (for example OpenAI or Anthropic) handles your conversation under its own privacy policy. We only receive the tool calls described here.

Purposes

Data sent through the connector is used solely to perform the action you requested on your own site and to secure the connection (authentication, authorization, abuse prevention). It is not used for advertising and is not sold.

Your rights and controls

• Access and correction. You can view and edit your account and site data from the dashboard, or contact us for help.
• Deletion. You can delete data you created, and you can request deletion of your account by contacting us.
• Revoking connected apps. You can revoke any connected AI assistant at any time in your Course Catalyst settings, which invalidates its tokens immediately.

Contact

Questions about this policy or a request about your data? Email us at hello@coursecatalyst.com.