Privacy Policy

Status: Draft — legal review required before first EU user signup.
Last updated: 2026-05-13

This is a structured placeholder pending review by licensed counsel. It does not constitute legal advice or a legally effective privacy policy.

1. Who We Are

Yoshuko (“Yoshuko,” “we,” “us,” “our”) is operated by [LEGAL ENTITY NAME, ADDRESS]. We operate the platform at yoshuko.com and associated subdomains.

For EU/UK users: Yoshuko is the data controller for platform data. Course creators who collect learner data are independent data controllers; Yoshuko acts as a data processor for creator-specific data under a Data Processing Addendum (DPA).

Contact: privacy@yoshuko.com

2. Data We Collect

2.1 Account data

Email address (required)
Display name and avatar URL (optional)
Timezone and locale preference
Phone number (Free-tier Stripe Connect only)
Password hash (Argon2id; never stored in plaintext)

2.2 Billing data

Stripe customer ID and Stripe Connect account ID (creators only)
Transaction records (amount, currency, fee, date — 7-year financial retention)
Payment instrument details: never stored by Yoshuko; handled by Stripe

2.3 Course and learning data

Courses, chapters, and lessons created by creators
Enrollment records and lesson progress

2.4 Technical data

IP address (anonymised in logs after 30 days)
Session identifiers (cookie-based; 14-day TTL)
Request logs (retained 90 days)

3. Legal Bases for Processing (EU/UK)

Contract — account creation, course delivery, payments
Legitimate interests — fraud prevention, security, analytics
Legal obligation — financial records retention (7 years)
Consent — marketing emails (opt-in only); analytics cookies

4. Your Rights

EU/UK/California residents may exercise the following rights by contacting privacy@yoshuko.com:

Access — request a copy of your data (Art. 15 GDPR)
Portability — export your data in machine-readable format (Art. 20 GDPR) via Account › Data Export
Erasure — request deletion/anonymisation (Art. 17 GDPR) via Account › Delete Account
Rectification — update your data via account settings
Objection — object to processing based on legitimate interests
Withdraw consent — for marketing emails via unsubscribe link; for cookies via Cookie Settings
Do Not Sell (California) — Yoshuko does not sell personal information

We respond within 30 days. Users with financial records are anonymised rather than deleted per financial-record retention requirements.

5. Data Retention

Account data: retained while account is active + 30-day soft-delete grace period
Financial records: 7 years (legal obligation)
Request logs: 90 days
IP addresses in logs: anonymised after 30 days

6. Cookies

We use strictly necessary cookies (session, CSRF) and optional functional, analytics, and marketing cookies. You can manage your preferences via the cookie banner or Cookie Settings.

7. Subprocessors

We use third-party services to operate the platform. See our full Subprocessor List.

8. Contact

Data protection enquiries: privacy@yoshuko.com
Supervisory authority (EU): your local data protection authority.