Privacy Policy

The short version

• Reading the AI lessons needs no account, and nothing is saved while you are signed out.
• If you sign in with Google, your account id, email address and learning progress are kept so you can continue on another device.
• If you buy the Verifiable Certificate Pass, the payment is processed by Polar.sh. We never see your card number.
• Analytics and advertising are off until you accept them; both are denied by default under Google Consent Mode.
• Ads are served through Google AdSense only when you allow advertising, and we never sell personal information.

About MasterAI Now

MasterAI Now is an online AI learning platform: an interactive academy for the machine learning and LLM lifecycle. The curriculum is eleven stages, and each stage mixes readable cards, a short knowledge check after every card and a browser-based simulation you can play with. Reading is free. A Google account is what saves your progress across devices, and the optional Verifiable Certificate Pass is what unlocks the certificate for a completed track. This policy covers all of it: the lessons, the account features, the checkout and the public certificate pages.

What we collect

Account details — only if you sign in

Signing in with Google creates an account handled by Supabase, our authentication and database provider. What the academy reads and keeps is the account id and the email address Google confirms, stored in your profile row. We never receive your Google password, and we ask Google for no scopes beyond the standard sign-in ones.

Learning progress — only if you sign in

Which cards you read, which knowledge checks you passed and which simulations you completed, plus a short note of where you stopped (your last stage and card) so the reader can resume. It is stored against your account, which is why the same progress appears on every device you sign in from.

Nothing at all, if you are signed out

Progress for a signed-out visitor lives in the browser tab only: it is not written to your device and it is not sent to us. Close the tab and it is gone.

Certificate details — only if you claim one

The first and last name you type, which is printed on the certificate and shown on its public page; the email address and account id the certificate belongs to; the issue date; the certificate status; the short public certificate id; and the order reference the pass was bought with.

Purchase details — only if you buy the pass

The order id, the product, the order status, the email address on the order and, once we can match it, the account it belongs to. Polar handles the payment itself, so your card details never reach us.

Analytics — only if you accept it

Google Analytics 4 records page views and lesson events — a stage opened, a card read, a quiz answered, a playground completed, a checkout started, a certificate claimed — along with the ordinary technical information a browser sends. These events are not tied to your account.

Advertising — only if you accept it

When you allow advertising, Google AdSense and its partners may set cookies and read device and usage identifiers to serve, limit and measure ads — and, where you allow it, to personalise them. We do not send your account id, email address, progress or certificate details to Google for advertising, and we never sell your information.

Technical data

As with any website, requests pass through our hosting provider, Cloudflare, which processes connection data such as the IP address, browser details and request time in order to serve the site and keep it available and secure. We also count requests to the few endpoints that start a checkout or issue a certificate, so that they can be rate limited.

Signing in with Google

One button covers sign-up and sign-in: your first use creates a MasterAI Now account, and afterwards the same button signs you back in. Google confirms which account you chose, Supabase turns that confirmation into a session in a cookie your browser sends with each request, and progress and certificates are stored against the account id. Supabase receives Google’s basic profile response when the account is created; what the academy itself stores is the account id and the email address. We cannot read your mail, files or contacts, and we cannot post to Google on your behalf. You can revoke access at any time from the third-party apps section of your Google account, and signing out from the header ends the session on a shared computer.

Where your information lives

Supabase is our authentication and database service. It holds the account records, your progress row, purchase records and certificate records, and it manages the cookie that keeps you signed in. Its row level security rules mean a signed-in learner can read their own progress and nothing else, and the database functions that write progress check who is calling. The credentials that could unlock everything — the service role key and the certificate signing secret — exist only as server-side environment variables and are never sent to a browser. Cloudflare hosts and serves the site, and Polar.sh handles payments.

Payments and Polar

The Verifiable Certificate Pass is the only thing that can be bought. Polar.sh acts as merchant of record: it collects your payment details, charges the method you choose, issues the receipt and handles applicable taxes such as EU VAT and US sales tax. What comes back to us is the order reference, the product, the order status and the email address on the order, which is how a purchase is matched to an account. We never receive or store full card numbers. If a refund is recorded, we update the order status so that access matches what was actually paid.

Advertising and Google AdSense

The lessons are free and advertising helps pay for them. Ads are delivered by Google AdSense and its advertising partners, and they only run when you allow advertising cookies in the cookie banner. Google may use cookies and device identifiers to serve, limit and measure ads and, where you allow it, to personalise them; it may also combine that data with information from other sites where you have given permission. Those cookies are described in our Cookie Policy.

We never send your account id, email address, learning progress, certificate details or order data to Google for advertising, and we do not sell personal information. Until you choose, Consent Mode v2 keeps advertising storage denied and no ad units are placed on the page. You can withdraw consent at any time from Cookie settings in the footer, or control personalised ads directly with Google Ads Settings.

Cookies and local storage

Essential, once you use a feature

The Supabase session cookies (named sb-…-auth-token) keep you signed in; without them the account features cannot work, and signing out removes them. A NEXT_LOCALE cookie remembers the language you picked, so the site does not switch back on the next page (365 days, whole site, SameSite=Lax).

On your device only

Your cookie choice, so the banner is not shown again, and the id of the last certificate you claimed. Progress is not kept here; it belongs to your account.

Analytics — only with your consent

Google Analytics 4 sets the _ga and _ga_* cookies. Until you accept, the GA4 tag is not loaded at all and no request is made to Google. Consent Mode is set with analytics storage granted and advertising storage, ad user data and ad personalization left denied.

Advertising — only with your consent

Google AdSense and its advertising partners may set cookies and similar identifiers to serve, limit and measure ads, and — where you allow it — to personalise them. Until you allow advertising, Consent Mode denies ad storage, ad user data and ad personalization, ad-click identifiers are redacted from measurement pings, and no ad unit is placed on the page. The Cookie Policy has the detail.

You can change your mind whenever you like: Cookie settings, at the bottom of every page, reopens the banner, and switching a category off applies immediately. Refusing analytics or advertising restricts nothing — every lesson, knowledge check, playground and certificate works without them.

How we use your information

• Signing you in and keeping the session alive while you learn.
• Saving your progress and syncing it across the devices you sign in from, so a stage finished on a phone is finished on a laptop.
• Showing what you have completed, and unlocking each simulation once the stage reader is done.
• Confirming, from the progress stored in the database, that all eleven stages are finished before a certificate is issued.
• Issuing your certificate, publishing its verification page and keeping that page resolving for anyone you share it with.
• Checking whether the Certificate Pass has been paid, and keeping your access in step with the order status.
• Protecting the service: rate limiting the endpoints that start a checkout or mint a certificate, and keeping purchase records for accounting and disputes.
• Understanding which lessons and simulations actually help people learn — only when you have allowed analytics.
• Keeping the lessons free by showing ads through Google AdSense — only when you have allowed advertising.
• Answering your questions and acting on your requests.

We do not sell your information and we do not use your account, progress, certificate or order data to target ads. Advertising is delivered by Google AdSense as a third party, only after you allow it, as described under “Advertising and Google AdSense”.

How long we keep it

Account and progress

For as long as the account exists. There is no self-service delete button yet, so a deletion is a request to us (see below); deleting the account removes the profile row and your saved progress with it.

Certificate records

Kept so the public verification page keeps resolving for whoever you share it with. If you ask us to erase the record, the certificate id stops verifying.

Purchase records

Kept after an account is deleted, but unlinked from it — the account reference is emptied, leaving the order reference, the email address and the status. Polar, as merchant of record, and our own accounting must be able to explain a sale, and that is the minimum needed to do so.

Your cookie choice

It stays in your browser until you clear it or change it; we do not hold a copy.

Analytics

Kept by Google according to the retention setting on the Analytics property we use, not by us on our own servers.

Advertising

Advertising cookies, when you allow them, are set and kept by Google and its partners under their own retention rules; we never hold advertising data on our own servers. Withdrawing consent denies further advertising storage.

Nothing extra is kept for the sake of it. We do not build advertising profiles from your account data and we do not sell it, so there is no reason to.

Your choices and rights

Depending on where you live, you may have rights over the personal information we hold: to know what it is, to receive a copy, to have mistakes corrected, to have it deleted, or to object to certain uses. Every one of those requests starts with an email to us.

• See it: your progress is visible in your account as you learn, and the certificate endpoint /api/certificates/<id> returns exactly the public fields held for a certificate.
• Correct it: the name printed on a certificate is the one you typed when claiming it — email us and we will correct or re-issue it. The email address on the account comes from Google.
• Delete it: ask us and we will delete the account with its profile row and saved progress, plus the certificate record if you ask for that too. The purchase trail described above stays, but unlinked from you.
• Withdraw consent: Cookie settings in the footer reopens the banner, and switching analytics or advertising off takes effect immediately.
• Do not sell or share: we do not sell personal information, and the only advertising is Google AdSense under the choice you make in the banner.
• No side effects: refusing or withdrawing analytics or advertising does not restrict any lesson, knowledge check, simulation or certificate.
• Complain: if our answer does not satisfy you, you can raise the matter with the data protection authority in your country.

Security

Sign-in happens at Google, so there is no password on our side to leak. Sessions are managed in cookies by Supabase, database access is governed by row level security, and the secrets that could grant broad access — the service role key and the certificate signing secret — exist only as server-side environment variables and are never bundled into the browser. Certificate tokens are signed with HMAC-SHA256 and verified with a constant-time comparison, so an edited token fails. The endpoints that start a checkout or issue a certificate are rate limited, and every response carries standard security headers (content-type sniffing protection, a strict referrer policy, clickjacking protection and a restrictive permissions policy). No service is perfectly secure, so we keep what is worth stealing to a minimum: no card data, no passwords, and no advertising profiles built on our side. If we ever learn of a breach affecting your information, we will notify the people affected and the relevant authority as the law requires.

Children

MasterAI Now is learning material for a general audience: it is written for people who want to understand how AI systems are built. It is not directed at children under 13, we do not knowingly create accounts for children under 13, and we never ask for a date of birth. Where the law in your country sets a higher age for consenting to online services, that age applies here too. If you believe a child has created an account, email us and we will delete the account and its data.

International users

The academy is available worldwide and published in eight languages, so information may be stored or processed in countries other than your own, including the European Union and the United States. The providers named in this policy operate globally and are responsible, under their own terms, for the safeguards that apply when they move information across borders; each of them publishes those safeguards in its own privacy documentation. Advertising data, when you allow it, is handled by Google and its partners under their own terms — we do not move your account, progress or certificate data anywhere for advertising purposes.

Changes to this policy

This page describes the product as it currently works. If we change what we collect or how we use it, this page is updated with the change: anything genuinely new — a new provider, a new field — is described here rather than added quietly in the background. Continuing to use MasterAI Now after an update means you accept the updated policy.

Contact

Email admin@masterainow.com for anything in this policy: a copy of your information, a correction, a deletion, or a question about how the academy handles data. We aim to reply within 30 days. When you ask us to delete an account, tell us as well whether the certificate record should be erased.