Privacy Policy

We collect the following categories of information when you use Coursepacker:

• Account information: name, email address, institution, faculty profile URL, and role (instructor, student, or admin).
• Payment information: payment transactions are processed by Stripe. We do not store credit card numbers or full payment account details on our servers. Stripe may collect and store payment information in accordance with their privacy policy.
• Content: teaching cases, teaching notes, reviews, feedback, and other materials you upload or submit to the platform.
• Usage data: pages visited, features used, device information (browser type, operating system), IP address, and interaction patterns.
• Cookies: session cookies for authentication and preference cookies for user settings. See Section 10 for more details on our cookie practices.

We use the information we collect for the following purposes:

• Operate and maintain the Coursepacker marketplace.
• Process transactions, including purchases, payouts, and revenue splits between authors and the platform.
• Verify instructor identity and institutional affiliation.
• Apply PDF watermarks and digital rights management (DRM) for content protection.
• Send transactional emails, including purchase confirmations, payout notifications, and account alerts.
• Improve the platform, develop new features, and enhance user experience.
• Enforce our Terms of Service.
• Comply with applicable legal obligations, including tax reporting and regulatory requirements.

We share your information with the following categories of third parties:

• Stripe: payment processing, including transaction handling and payouts. Your payment data is subject to Stripe's privacy policy.
• Supabase: database hosting, authentication infrastructure, and file storage.
• Vercel: application hosting and deployment infrastructure.
• Public author information: when you publish a teaching case, your name, institution, and bio (as configured by you) are displayed publicly on the platform.

We do NOT sell your personal information to third parties. We have not sold personal information in the preceding 12 months and have no plans to do so.

We may disclose your information if required to do so by law, subpoena, court order, or other governmental request, or when we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.

• Active accounts: account data is retained for as long as your account remains active.
• Account deletion: upon account deletion, your personal data will be removed within 30 days, except for transaction records which are retained for up to 7 years for tax and legal compliance purposes.
• Distributed content: teaching cases and materials that have already been distributed to purchasers remain accessible to those purchasers in accordance with their license terms.
• Aggregated data: anonymized and aggregated data may be retained indefinitely for analytics and platform improvement purposes. This data cannot be used to identify individual users.

Depending on your location, you may have the following rights regarding your personal information:

CCPA Rights (California Residents)

• Right to know: you may request details about the categories and specific pieces of personal information we have collected about you.
• Right to delete: you may request deletion of your personal information, subject to certain exceptions.
• Right to opt-out of sale: we do not sell personal information, so this right is already satisfied.
• Right to non-discrimination: we will not discriminate against you for exercising any of your CCPA rights.

GDPR Rights (EU/EEA Residents)

• Right of access: obtain confirmation of whether we process your data and request a copy of your personal data.
• Right to rectification: request correction of inaccurate or incomplete personal data.
• Right to erasure: request deletion of your personal data under certain circumstances.
• Right to restrict processing: request that we limit processing of your personal data in certain situations.
• Right to data portability: receive your personal data in a structured, commonly used, machine-readable format.
• Right to object: object to processing of your personal data for certain purposes.
• Right to withdraw consent: withdraw your consent at any time where processing is based on consent.

How to exercise your rights: email us at privacy@coursepacker.com with your request.

Response time: we will respond to CCPA requests within 45 days and GDPR requests within 30 days. If we need additional time, we will notify you of the extension and the reason.

Verification: to protect your privacy, we may need to verify your identity before processing your request. We may ask you to confirm information associated with your account.

Coursepacker is designed for use by college and university instructors and students. Our platform is not directed at children under the age of 13.

We do not knowingly collect personal information from children under 13. If we become aware that we have inadvertently collected personal information from a child under 13, we will take steps to delete that information as quickly as possible.

If you are a parent or guardian and believe that your child has provided us with personal information, please contact us at privacy@coursepacker.com so we can take appropriate action.

Coursepacker is operated from the United States. Your personal data is processed and stored in the United States. By using our platform, you consent to the transfer of your information to the United States and its processing there.

We use industry-standard security measures to protect your data during transfer and storage, including encryption in transit and at rest.

For users in the European Union or European Economic Area: where required by applicable law, international data transfers are made pursuant to Standard Contractual Clauses (SCCs) approved by the European Commission, or other lawful transfer mechanisms.

We implement a range of security measures to protect your personal information:

• Encryption in transit: all data transmitted between your browser and our servers is encrypted using TLS/HTTPS.
• Encryption at rest: data stored in our database is encrypted at rest.
• PDF content protection: downloaded teaching cases are encrypted with per-user passwords and watermarked to deter unauthorized distribution.
• Database access control: we use Supabase Row-Level Security (RLS) to enforce strict database access controls.
• Regular security reviews: we conduct periodic reviews of our security practices and infrastructure.

While we strive to protect your personal information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security, and you use the platform at your own risk.

Coursepacker does not receive student education records as defined under the Family Educational Rights and Privacy Act (FERPA).

Coursepacker is an independent marketplace platform. We do not maintain agreements with educational institutions to receive, process, or store FERPA-protected data. Instructors use Coursepacker to distribute teaching materials independently of their institution's student information systems.

Student usage data collected on our platform (such as purchase history and coursepack access) is not considered part of a student's education record. This data is generated by the student's direct, voluntary interaction with our commercial platform, not through an institutional relationship.

Coursepacker uses a limited set of cookies to operate the platform:

• Essential cookies: required for authentication, session management, and core platform functionality. These cookies are necessary for the platform to work and cannot be disabled.
• Functional cookies: used to remember your preferences, such as user role selection and display settings. These cookies improve your experience but are not strictly necessary.

We do not use third-party advertising cookies. We do not engage in cross-site tracking or share your browsing activity with advertising networks.

You can control and manage cookies through your browser settings. Please note that disabling essential cookies may prevent you from using certain features of the platform, including authentication.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

If we make material changes, we will notify you by email (using the address associated with your account) or by posting a prominent notice on the platform prior to the changes taking effect.

Your continued use of Coursepacker after notice of changes constitutes your acceptance of the updated Privacy Policy.

Previous versions of this Privacy Policy are available upon request. Contact us at privacy@coursepacker.com if you would like to review earlier versions.

If you have questions about this Privacy Policy or our data practices, please contact us:

• Privacy inquiries: privacy@coursepacker.com
• General legal inquiries: legal@coursepacker.com
• Mailing address: 565 TNRB, Brigham Young University, Provo, UT 84602
• For copyright or DMCA-related issues, please see our DMCA Policy.