Privacy Notice

Last updated: 13 November 2026

This notice covers the course platform at learn.belderbos.dev, which serves the courses sold on belderbos.dev and pythonagenticai.com. Each of those sites has its own notice: the belderbos.dev privacy notice covers belderbos.dev, its newsletter and coaching, and the pythonagenticai.com privacy notice covers pythonagenticai.com and its newsletter. No advertising, no third-party trackers, no selling data.

Who is responsible

The controller is Bob Belderbos. Contact: bob@belderbos.dev.

What I collect, why, and on which legal basis

Purchases

Checkout runs on Stripe, which sells the course as merchant of record: it takes your payment and billing details, charges VAT and sends your receipt under its own privacy policy. The platform receives and stores your email, the course and tier you bought, the amount, the purchase date and whether it was refunded. To give or remove your access, Stripe notifies the platform of each payment and refund. The platform keeps a copy of each notice reduced to the payment's IDs, amount, currency, course, status and date, to look into a purchase that went wrong; the name, email, address and card details (brand, last four digits, expiry) in those notices are not stored. The platform never receives your full card number.

Legal basis: performance of a contract (Article 6(1)(b)), and compliance with legal obligations for accounting records (Article 6(1)(c)).

Free access given by hand

Sometimes I give someone free access to a course, such as former students and people testing a new course. The platform then stores the same data as for a purchase, with an amount of zero, and the welcome email says why you received it.

Legal basis: performance of a contract when you asked for access (Article 6(1)(b)); otherwise legitimate interests (Article 6(1)(f)) — giving former students and testers course material relevant to them. You can ask me to remove the access and its data at any time.

Your account and sign-in

You sign in with a link sent to your email; there is no password. Sign-in links expire after an hour. Login links and module unlock emails are sent through Resend, my email processor. The platform keeps a copy of each email it sends you, so I can check what reached you if something goes missing.

Legal basis: performance of a contract (Article 6(1)(b)).

Your progress

For each lesson you open, the platform records when you first and last viewed it and when you mark it done. It also stores your chosen pace and your time zone so module unlocks and your day streak match your own day. This powers your dashboard and module unlocks. I also see it per learner in the admin, to spot where people get stuck and improve the course.

Legal basis: performance of a contract for your dashboard and unlocks (Article 6(1)(b)); legitimate interests (Article 6(1)(f)) for using it to improve the course.

Certificates

When you finish every lesson, the platform issues a certificate with an ID, the course, the tier and the date. You type your name onto it in your browser; the name is never sent to or stored by the platform. It records when you download the certificate or click "Add to LinkedIn", and counts how often its public verification page is opened. That page shows the course, tier, date and ID, never your name or email.

Legal basis: performance of a contract (Article 6(1)(b)) for issuing the certificate; legitimate interests (Article 6(1)(f)) for counting its use.

Lesson feedback

If you send feedback from a lesson, the platform stores your message with your email, the lesson and the date, and emails it to me in a weekly digest through Resend. I use it to answer you and to fix and improve the course.

Legal basis: legitimate interests (Article 6(1)(f)) — fixing and improving the course.

Hosting, logs and cookies

The platform runs on a Fly.io server in Frankfurt (EU). Every database change is backed up to Tigris object storage in Frankfurt, Fly.io's storage provider, and backups are kept for 14 days. Course content is pulled from private GitHub repositories; no learner data is sent to GitHub. The web server logs each request (path, time, status, referring page and browser user-agent) for debugging; Fly.io keeps these logs for 7 days. To deliver the platform, route requests and protect it from abuse, Fly.io processes request metadata including your IP address.

The platform sets three cookies, all needed for it to work: a session cookie that keeps you signed in (90 days after your last visit), a CSRF cookie that protects forms, and a tz cookie with your time zone (one year). None are used for analytics, so no consent banner is needed.

Page views are counted with checkpulse, my self-hosted analytics on Fly.io, as described in the belderbos.dev privacy notice: it records the page path, referrer, browser family and device type, sets no cookies and stores no IP address. Sign-in link pages, whose address holds your email, are not counted.

Legal basis: legitimate interests (Article 6(1)(f)) — running the platform reliably and securely.

Your dashboard offers my newsletter once. Only if you click Subscribe is your email sent to Buttondown, which asks you to confirm by email before adding you. The platform only remembers that you answered, so it doesn't ask again. Unsubscribe with the link in any newsletter email.

Legal basis: consent (Article 6(1)(a)). You can withdraw consent at any time using the unsubscribe link in any email. Withdrawal removes you from the list and does not affect processing carried out before it.

Where your data is processed

The platform, its database and backups are stored in the EU (Frankfurt). Fly.io, Tigris, Stripe, Resend and Buttondown are based in the United States, so using them transfers personal data outside the EEA and UK. The safeguards are:

Fly.io, Stripe and Resend are certified under the EU-US Data Privacy Framework (including its UK extension), and use the EU Standard Contractual Clauses as a contractual fallback.
Tigris, which stores the backups, is bound by the EU Standard Contractual Clauses.
Buttondown (only if you subscribe) processes subscriber data in the United States under a data processing agreement that gives EU, UK, and Swiss data protection law priority over US law.

How long I keep your data

Account, purchases, progress, certificates, lesson feedback and copies of emails sent to you: for as long as you have access to the course. Email me and I'll delete your account, progress, feedback, certificates, free access and those email copies; records of paid purchases are kept for as long as tax law requires.
Backups: 14 days.
Server logs: 7 days.

Your rights

You can access your data; have it corrected or erased; restrict or object to its processing; receive it in a portable form (for data processed on the basis of consent or contract); and withdraw consent at any time where processing relies on consent. You can also lodge a complaint with a data protection supervisory authority, generally the one where you live or work. To exercise any of these, email bob@belderbos.dev.