Introduction
Course Catalyst is a platform that lets creators build and run their own course websites. This policy explains what data we collect, why we collect it, who we share it with, how long we keep it, and the controls you have.
This policy also covers the Course Catalyst mobile app for iOS and Android, which students use to log in with their email address, watch the courses they have access to, and enroll in free courses from the Marketplace.
Two kinds of people use Course Catalyst: creators, who pay us to run their site, and students, who buy courses from those creators. When a creator uploads or manages data about their own students and contacts, the creator is responsible for that data. We process it on their behalf to run the platform.
Data we collect
- Account data. Your name, email address, and login credentials when you create a Course Catalyst account.
- Tenant content. The pages, courses, lessons, media, emails, and settings you create on your site.
- Contact and student data. The names, email addresses, subscription and consent state, and course activity of the contacts and students a creator uploads or collects through their site.
- Payment data. Payments are processed by Stripe. Card details go directly to Stripe, we do not store full card numbers. We keep records such as amount, status, and the product purchased.
- Usage data. Standard technical data such as log entries, device and browser information, and cookies used to keep you signed in and to operate the site. On our websites we also measure page visits and page performance.
- Advertising measurement on our marketing pages. The public pages of coursecatalyst.com load the Meta Pixel, which tells Meta that a browser visited, so we can measure our own ads. It is not loaded in the dashboard or in the mobile app.
- Mobile app data. When you use the Course Catalyst mobile app, we collect:
- Your email address, used to log in with a 6-digit code we email to you.
- Your name, which the app asks for the first time you log in.
- Your lesson progress, such as completed lessons and where you stopped a video.
- If you allow notifications, your device's push token, its platform (iOS or Android), the app version, and which kinds of notifications you want: announcements, which are on by default, and offers and course recommendations, which stay off unless you turn them on.
- When you enroll in a free course from the Marketplace, your name and email address are shared with the creator whose site offers that course, so they can give you access. That creator may also send you email, as the app tells you before you enroll, and every such email lets you unsubscribe.
- Feedback and content reports you choose to send from the app, including any email address you add for a reply. Feedback also carries diagnostic details: app version and build, operating system and version, device name, the site you had selected, and the screen you were on.
How we use it
- To provide and operate the platform and the sites creators build on it.
- To process purchases and give students access to what they bought.
- To send email that a creator sends or previews from their own account.
- To email you a login code when you log in to the mobile app.
- To send push notifications you have allowed in the mobile app, including occasional offers and course recommendations only if you have turned them on.
- To review feedback and content reports sent from the mobile app.
- To secure accounts, authenticate access, and prevent abuse.
- To support creators and respond to requests.
We do not sell your data. Apart from the Meta Pixel on our public marketing pages, described above, we do not use it for third-party advertising. The mobile app contains no advertising or tracking software.
Third-party processors
We use a small set of service providers to run the product. Each handles data only to provide its service to us:
- Vercel, application hosting.
- Prisma Postgres, the database that stores account and site data.
- Bunny CDN, media and video storage and delivery.
- Resend, email delivery, including the login codes for the mobile app and the email a creator sends or previews.
- Expo, push notification delivery for the mobile app. Expo's push service passes notifications to Apple Push Notification service (APNs) on iOS and to Firebase Cloud Messaging (FCM) on Android.
- Slack, where feedback and content reports sent from the mobile app are delivered to our team.
- Stripe, payment processing.
- Umami, website analytics (page visits).
- Meta, the Meta Pixel on our public marketing pages, and Instagram messaging for creators who connect an Instagram account.
- Anthropic, AI features creators choose to turn on, such as drafting page content and drafting replies to their Instagram messages. The text involved is sent to Anthropic to produce the result.
- Calendly, scheduling for booking forms that a creator adds to their site.
- PartyKit, real-time delivery of community messages.
Data retention
We keep account and site data for as long as your account is active so the platform can function. When data is deleted, it is removed from our active systems, though copies may persist for a limited time in routine backups. We keep records we are required to retain for legal, tax, or accounting reasons (for example payment records) for as long as the law requires.
When you delete your mobile app account
Deletion is immediate and cannot be undone. Any device still logged in to the app is logged out the moment it finishes.
- What it deletes: your Course Catalyst app account and its login code, every existing app token, and every push notification registration for your devices.
- What course sites keep: each course site independently controls its own Student, enrollment, lesson progress, payment, subscription, certificate, email history, and related records. App account deletion does not change those records, regardless of how you enrolled or whether you paid. When deletion finishes, we name every site you can currently access so you can contact it directly.
AI Assistants and Connected Apps
Course Catalyst offers a connector that lets creators manage their own site through AI assistants such as ChatGPT and Claude. This section describes exactly what data flows through that connector.
What the AI assistant sends us
Your identity, via OAuth. When you connect, you sign in to your own Course Catalyst account and approve access. The assistant receives short-lived tokens tied to your account. We never see or store your assistant conversations, and the assistant never receives your password.
Tool call parameters. When you ask the assistant to do something (for example "create a coupon" or "update this lesson"), the assistant sends us only the structured parameters of that action (titles, text content, email addresses of your own contacts, ids). These are processed to perform the action and are handled the same way as the same action performed in the dashboard.
What we return to the assistant
Only data from your own site, under your own account: your pages, courses and lessons, your contacts and their subscription state, your broadcasts, coupons, and related settings. The connector is strictly scoped to one site. It can never read another creator's site or another creator's customers.
Storage
- OAuth access and refresh tokens are stored hashed. The plaintext token is never saved.
- We do not store your assistant conversations. The only records we keep are the same application records any dashboard action would produce.
Token lifetimes and revocation
- Access tokens expire after 1 hour.
- Refresh tokens expire after 30 days.
- You can revoke a connected assistant at any time in your Course Catalyst settings, which invalidates its tokens immediately.
Recipients and third parties
The connector introduces no new third parties. Data touched through it flows only through the infrastructure Course Catalyst already uses (Vercel, Prisma Postgres, Bunny CDN, Resend, and Stripe), described above. The AI assistant provider (for example OpenAI or Anthropic) handles your conversation under its own privacy policy. We only receive the tool calls described here.
Purposes
Data sent through the connector is used solely to perform the action you requested on your own site and to secure the connection (authentication, authorization, abuse prevention). It is not used for advertising and is not sold.
Your rights and controls
- Access and correction. You can view and edit your account and site data from the dashboard, or contact us for help.
- Deletion. You can delete data you created. You can delete your mobile app account yourself, in either of two ways: in the app, open the Settings tab, tap Account, then Delete your learner account; or, without the app, in a browser at coursecatalyst.com/account/delete. See Data retention above for what deleting an app account removes and what it keeps. To delete a creator account, contact us using the details below.
- Revoking connected apps. You can revoke any connected AI assistant at any time in your Course Catalyst settings, which invalidates its tokens immediately.
Note for students: Course creators are independent businesses. They may have their own privacy policies and marketing practices, and we do not control what they do with the data they collect through their site. A creator can also add their own analytics or advertising tracking, such as a Meta Pixel, to their site.