Last updated: October 13, 2026
This policy explains what information CourseIO (“we”) collects when you use CourseIO.ai, why we collect it, and the choices you have. The data controller is DevsVilla International Pvt. Ltd., the company behind CourseIO, based in India.
When you create an account, we collect your name, email address, and date of birth. When you use CourseIO, we store the course material you upload, the prompts you give us, and the courses, scripts, slides, video, audio, and quizzes we generate for you. We also keep basic security and sign-in information — sign-in timestamps and IP address — and, if you subscribe, billing details processed through Razorpay or Dodo Payments (we don’t store your card number). If you connect a YouTube channel, we store the connection’s account name and access tokens; see the Google & YouTube section below. If you connect a Vimeo account, we store its account name and access token; see the Vimeo section below. If you connect an AI assistant such as Claude or ChatGPT, we store the connection and the requests it makes on your behalf, never your conversation with it; see the AI assistants section below.
We use your information to run CourseIO: authenticating you, generating and storing your courses, processing payments, and keeping your account secure. We don’t sell your personal information, and we don’t use your course content or uploaded material to train models for anyone else.
Where the UK GDPR or EU GDPR applies, we rely on the following legal bases. Performance of a contract: creating your account, generating and storing courses, team invitations, billing, and carrying out the requests of an AI assistant you connect (you ask us to act through it) — we cannot provide the service without this. Legitimate interests: keeping the service secure (sign-in records, rate limiting, and logs of the requests connected AI assistants make), fixing errors (error reports sent to Sentry with passwords, codes and tokens removed), and sending service emails about your account. Our interest in running a reliable, secure service does not override your rights, and you can object at any time. Consent: optional analytics cookies (PostHog), which only run after you opt in through the cookie banner, and connecting a YouTube channel. You can withdraw consent at any time — from the cookie banner, or by disconnecting the channel — without affecting anything that happened before. Legal obligation: keeping invoices and payment records for tax and accounting law.
Generating a course means sending parts of your content to the services that do the work: our AI providers (for course structure, scripts, and quizzes), ElevenLabs (for voice narration), and AssemblyAI (for transcription and subtitles). Razorpay (in India) and Dodo Payments (everywhere else) process payments, and Google/YouTube handles publishing if you choose to connect a channel. Vimeo does the same if you connect a Vimeo account. If you connect an AI assistant such as Claude or ChatGPT, we send it only the answers to the requests it makes for you. Its provider (for example Anthropic or OpenAI) handles those answers, and anything you share in the conversation, as an independent controller under its own privacy policy — in that role it is not our subprocessor, even where the same company is also one of our AI providers above; see AI assistants. Behind the scenes, Amazon Web Services EMEA SARL hosts the application and your data, Amazon Simple Email Service (AWS) delivers our emails, Sentry receives error reports, and — only if you opt in — PostHog and Google Analytics receive usage analytics. The full, current list — with what each one does and what data it sees — is on our subprocessors page. We don’t sell your data to anyone, and we only share it with these providers to the extent needed to run the product.
CourseIO’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. CourseIO uses YouTube API Services. If you connect a YouTube channel, you agree to the YouTube Terms of Service, and the Google Privacy Policy applies to Google’s handling of your data.
What we access: with your permission, CourseIO reads your channel’s name and ID, your list of playlists, and the upload and processing status of the videos it uploaded. It uploads the lesson videos you choose, creates a playlist and adds videos to it when you ask, and deletes a video if you cancel its upload. We don’t read your other videos, comments, ratings, captions or analytics. We store your channel’s name and ID, encrypted access and refresh tokens, and the YouTube ID, link and playlist ID of each video CourseIO uploaded. We don’t share YouTube data with anyone, use it for advertising, or use it to train AI models.
How long we keep it: stored YouTube data is refreshed or deleted at least every 30 days. When you disconnect, we revoke our access with Google and delete the stored YouTube data straight away, and always within 7 days; videos already on your channel stay there. Disconnect from Settings → Publishing → Disconnect, or revoke access at any time in Google’s security settings at security.google.com/settings/security/permissions.
If you connect a Vimeo account, CourseIO uses the Vimeo API, with your permission, to upload the lesson videos you choose, create folders and file videos into them, add captions from your lesson subtitles, and set each video’s privacy and embed settings; it also deletes a video if you cancel its upload. We store your Vimeo account name and ID, an encrypted access token, and the Vimeo ID and link of each video CourseIO uploaded. We don’t share Vimeo data with anyone, use it for advertising, or use it to train AI models. The Vimeo Privacy Policy applies to Vimeo’s handling of your data.
Disconnect from Settings → Publishing → Disconnect: we delete the stored access token and revoke CourseIO’s access with Vimeo straight away; videos already on your Vimeo account stay there. You can also revoke access at any time on Vimeo at vimeo.com/settings/apps.
You can connect CourseIO to an AI assistant such as Claude (from Anthropic) or ChatGPT (from OpenAI) so that it can work on your courses for you. You set up the connection yourself: you sign in on CourseIO’s own pages (never in the chat), choose one organization, and approve what the assistant may do — see courses (your courses, lessons and videos, your name, and the organization’s name and lesson credit balance) and, if you allow it, create and change courses (create, edit, rebuild, translate and export them). Anything that uses lesson credits needs a price quote first, and the assistant is asked to show you the price and get your agreement before it goes ahead. We process this data to perform our contract with you, and keep request logs for security on the basis of our legitimate interests (see “Our legal bases”).
What we receive and store: CourseIO only receives the requests the assistant sends on your behalf — which action to take and the details it needs, such as a course ID, the title, description or outline of a course you want, a lesson’s new script, or a language. We never receive your conversation with the assistant, and we never access its memory, your chat history, conversation summaries or files you have uploaded there. We never ask for passwords, payment details or other sensitive data, such as government IDs or health information, through the assistant. We store the connection (the app’s registration details, such as its name and, if it publishes them, its logo and website; the organization; the permissions you approved; and when it was connected and last used); the assistant’s access and refresh tokens, only as one-way hashes (when a token is refreshed, an encrypted copy of the new pair is kept so that a refresh sent twice within 60 seconds still succeeds, and is erased at the next nightly cleanup); the course price quotes it asked for (the course details and the price); and server logs of each request: the time, the IP address it came from, the action, its outcome, the user, organization and app IDs, and the app’s name and version if it sends them. We don’t log the content sent with a request, such as course outlines or lesson scripts. We use these logs only for security, abuse prevention and troubleshooting. Courses and lessons the assistant creates or changes are stored like any other course content. We send the assistant’s provider nothing beyond the answers to its requests, which can include your name, your organization’s name and credit balance, and your course content. Our hosting provider and Sentry (error reports, sent without request contents, IP addresses or tokens) process this data for us as for the rest of the service.
How long we keep it and your controls: our database cleanup runs every night, so each deletion below happens within a day of the time given. Authorization codes expire after 5 minutes and are then deleted. Access tokens expire after an hour and refresh tokens after 60 days (each refresh issues a new one); tokens are deleted 30 days after they expire or are revoked. Price quotes expire after 30 minutes; one that wasn’t used is deleted a day after it expires, and one that was used stays with the course it created. Server logs are kept for no longer than 30 days. To disconnect an assistant, go to Settings → Connected apps → Disconnect: its access stops immediately, and the connection and its tokens are deleted 30 days later. Assistants are also disconnected automatically if you change or reset your password, if your account is locked, or if you leave or are removed from the organization, and deleting your account deletes all your connections straight away. An app’s registration details are deleted once it has had no live connection and no use for 30 days. What you share with the assistant itself, and the answers CourseIO returns into that conversation, are handled by the assistant’s provider as an independent controller under its own privacy policy (for example Anthropic’s for Claude and OpenAI’s for ChatGPT); you control that data in the assistant’s own settings.
CourseIO is operated from India and hosted with Amazon Web Services EMEA SARL in Frankfurt, Germany (EU, eu-central-1). Some of the providers on our subprocessors page are in the United States (our AI, voice, transcription, analytics and email providers). If you are in the UK or the European Economic Area, this means your data is transferred outside those regions. We only do so under recognized safeguards: the European Commission’s Standard Contractual Clauses (with the UK Addendum or the UK International Data Transfer Agreement where UK data is involved), or, where a provider is certified, the EU-US Data Privacy Framework. Our own access from India is likewise covered by the Standard Contractual Clauses. You can ask us for a copy of the safeguards in place at privacy@courseio.ai.
We keep your account and course data for as long as your account is active. Connected AI assistants have shorter periods: tokens, unused price quotes, disconnected connections and request logs are deleted within the times set out in the AI assistants section. Billing records are kept for as long as applicable tax and accounting law requires, even after an account is closed. See our data deletion page for how to have your data removed.
CourseIO uses a small number of strictly necessary cookies and local storage entries to keep you signed in and remember your preferences, and — only with your consent — PostHog analytics cookies. Details, and how to change your choice at any time, are on our Cookie Policy.
You can access and update your profile information from within CourseIO at any time. To access, correct, export, or delete your data, or to object to how it’s used, see our data deletion page or email privacy@courseio.ai. We respond to verified requests within 30 days (one month under the GDPR, extendable where a request is complex, in which case we tell you). Under the UK GDPR and EU GDPR you have the rights of access, rectification, erasure, restriction, portability, and objection, and the right not to be subject to solely automated decisions with legal effects — we make none. If you are unhappy with how we handle your data you can complain to your supervisory authority: in the UK the Information Commissioner’s Office (ico.org.uk), in the EEA your national data-protection authority, and in India the Data Protection Board under the Digital Personal Data Protection Act 2023. We would appreciate the chance to resolve your concern first.
CourseIO is intended for adults creating educational content, not for use by children. We don’t knowingly collect information from children under the age required by applicable law to consent to data processing on their own.
If we make a material change to this policy, we’ll update the date at the top of this page and, where appropriate, let you know directly.
Questions about this policy or your data can go to privacy@courseio.ai or through our contact page.