Skip to main content
🎤 Luca Berton is speaking at Red Hat Summit & KubeCon EU 2026!Learn more →

Privacy Policy

Last updated: May 2026 · Version 2026-05

This policy explains how Open Empower B.V. ("CopyPasteLearn", "we", "us") processes personal data of visitors, customers, and registered users of www.copypastelearn.com (the "Service"). We comply with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and applicable national data-protection laws.

1. Data controller

The data controller is Open Empower B.V., a private limited company incorporated in the Netherlands.

  • Registered office: De Boelelaan 471, 1082 RK Amsterdam, The Netherlands
  • VAT (BTW) number: NL866954958B01
  • Phone: +31 612255399
  • Email: privacy@copypastelearn.com

For any privacy-related request, contact privacy@copypastelearn.com. We do not currently have a statutory obligation to appoint a Data Protection Officer; the same address reaches the person responsible for privacy matters.

2. Categories of personal data we collect

  • Account data: name, email address, password hash, and authentication metadata, managed through our identity provider Clerk.
  • Billing & tax data: billing name, address, country, VAT/Tax ID (optional, for B2B invoicing), and payment method tokens — processed by Stripe; we never receive your full card number.
  • Order & entitlement data: products purchased, order IDs, invoices, refund history, downloaded files, and access entitlements.
  • Learning & usage data: courses viewed, lessons completed, video playback positions, lab launches, and progress timestamps.
  • Lab session data:ephemeral container metadata (start/stop time, resource usage). The lab's internal state is destroyed when the session ends and is not retained.
  • Support correspondence: messages you send us by email or via the contact form.
  • Technical data: IP address, user agent, language preference, timestamps, and crash diagnostics, collected via server logs and limited first-party analytics.

3. Legal bases for processing (Art. 6 GDPR)

  • Performance of a contract (Art. 6(1)(b)) — to create your account, deliver purchases, run lab sessions, track progress, and provide support.
  • Legal obligation (Art. 6(1)(c)) — to keep invoices and tax records for the period required by Dutch and EU VAT law.
  • Legitimate interests (Art. 6(1)(f)) — to secure the Service against abuse and fraud, debug failures, prevent cryptocurrency mining or credential-stuffing in lab environments, and produce aggregate, anonymized product metrics.
  • Consent (Art. 6(1)(a)) — for optional marketing emails, newsletters, or any non-essential cookies. You can withdraw consent at any time.

4. How we use your data

  • Provide, maintain, and improve the Service.
  • Authenticate you and protect your account.
  • Process payments, deliver digital products, issue invoices, and comply with tax/VAT obligations.
  • Track learning progress and surface course recommendations.
  • Detect and block abuse of lab environments (mining, scanning, malware execution, network abuse).
  • Respond to your support requests and send transactional emails about your account or purchases.
  • Send marketing emails only if you have opted in; every marketing message includes an unsubscribe link.

5. Sub-processors

We rely on the following sub-processors. Each is bound by a Data Processing Agreement (DPA) and operates either inside the EU/EEA or under EU-approved Standard Contractual Clauses (SCCs).

  • Clerk— identity & authentication (USA, SCCs).
  • Stripe Payments Europe Ltd — payment processing (Ireland).
  • Mux, Inc. — video encoding and streaming (USA, SCCs).
  • Amazon Web Services EMEA SARL — file storage and digital delivery (EU regions).
  • Vercel Inc. — application hosting and edge delivery (USA, SCCs).
  • Cloudflare, Inc. — DNS, DDoS protection, and caching (USA/EU, SCCs).
  • Resend — transactional email delivery (USA, SCCs).
  • Plausible Analytics — privacy-friendly, cookieless website analytics (EU).

A current list of sub-processors is available on request from privacy@copypastelearn.com.

6. International data transfers

Where personal data is transferred outside the EU/EEA, we rely on the European Commission's Standard Contractual Clauses and, where appropriate, supplementary measures such as encryption in transit and at rest. You can request a copy of the transfer safeguards in place by contacting us.

7. Retention

  • Account data: retained while your account is active; deleted within 30 days after you close your account, except where retention is required by law.
  • Invoices & tax records: retained for 7 years as required by Dutch tax law (Algemene wet inzake rijksbelastingen, art. 52).
  • Server & security logs: retained for up to 90 days, then deleted or anonymized.
  • Lab session data: ephemeral; runtime state is destroyed at session end. Metadata is retained for up to 90 days for fraud/abuse review.
  • Support correspondence: retained for up to 24 months after the case is closed.

8. Your rights under the GDPR

You have the right to:

  • Access your personal data (Art. 15).
  • Request correction of inaccurate data (Art. 16).
  • Request erasure of your data (Art. 17).
  • Restrict or object to processing (Art. 18, 21).
  • Receive your data in a portable format (Art. 20).
  • Withdraw consent at any time, without affecting prior lawful processing (Art. 7(3)).
  • Lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or the supervisory authority in your country of residence.

To exercise any of these rights, email privacy@copypastelearn.com. We respond within one month, in accordance with Art. 12(3) GDPR.

9. Automated decision-making

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects on you.

10. Children

The Service is not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

11. Security

We apply industry-standard technical and organizational measures, including TLS 1.2+ for all traffic, encryption at rest for storage and database backups, the principle of least privilege for administrative access, regular dependency updates, and isolated, non-privileged lab sandboxes. No system is 100% secure; if you discover a vulnerability, please report it responsibly to security@copypastelearn.com.

12. Cookies and similar technologies

We use a small number of strictly-necessary first-party cookies for authentication and session integrity. We do not use third-party advertising or cross-site tracking cookies. Our analytics provider (Plausible) is cookieless and does not fingerprint visitors.

13. Changes to this policy

We may update this policy from time to time. Material changes will be announced on this page and, where you have an account, by email at least 14 days before they take effect. The "Last updated" date at the top of this page indicates the current version.

14. Contact

Open Empower B.V. — Privacy
De Boelelaan 471, 1082 RK Amsterdam, The Netherlands
VAT: NL866954958B01
Phone: +31 612255399
Email: privacy@copypastelearn.com
General contact: hello@copypastelearn.com