Legal
Privacy Policy
What we keep, why, who helps us run Coast, how long we keep it, and how you stay in control.
Last updated: 13 October 2026
Coast is a personal AI tutor. To teach you, it has to hold your course material and remember how you learn. This policy explains what we collect, why, who helps us run Coast, how long we keep it and what your rights are. It applies to the Coast app (app.coast.academy), our website (www.coast.academy) and the emails we send.
In short
- We keep what Coast needs to teach you: your account, what you upload and your learning progress.
- Your files are private to you and used only to teach you. We never sell your data, use it for advertising, or use it to train AI.
- Our AI providers work under business terms that exclude training. They may keep requests for up to 30 days, only to detect abuse.
- Our servers are in Frankfurt, Germany. Some providers are in the US, under EU safeguards.
- You can download or delete everything yourself, at any time, in the app.
- Questions: privacy@coast.academy. Complaints: the Autoriteit Persoonsgegevens.
1. Who we are
Coast is run by Rio Mauss, trading as Coast (a sole proprietorship, eenmanszaak), registered with the Dutch Chamber of Commerce (KvK) under number 42022723, with its address at Hoogbrugstraat 11, 6221 CN Maastricht, the Netherlands. We are the controller of your personal data under the EU General Data Protection Regulation (GDPR). For anything about your privacy, write to privacy@coast.academy.
2. What we collect
Your account. Your name and email address, and either your password (stored only as a secure hash, never readable by us) or your Google account identity if you sign in with Google. During the beta we also record which invite code you used, and your plan (for example the founder pass).
What you upload. The files you add to Coast (PDF and PowerPoint documents), and the text and figures we extract from them to build your lessons. If a page has no text layer, for example a scan, we read its text from the page image.
Your learning. Your lessons and roadmaps, your messages with Pedro and his replies, your questions in Ask sources, your answers to practice questions and their grading, your progress, your notes, and a learning profile: what you have mastered, where you got stuck and anything you tell Pedro about how you like to learn.
Usage and technical data. Which features you use, how much time you spend studying in the app, how many lessons, uploads, messages and practice sets you use each month (for the plan limits), how many AI requests your use makes (to understand our costs), and server logs that include your IP address.
Feedback you send. Your message, with the screen you were on and your browser, operating system and window size, so we can reproduce the problem.
On our website. Your email address if you join the waitlist, anything you send through the contact form, and, only if you allow it, analytics about how you use the pages (see section 9).
We do not ask for special categories of data (such as health or religion). Please don’t put them in your uploads or messages; if you do, we only use them to provide the service you asked for.
3. Why we use it, and on what legal basis
| Purpose | Legal basis (GDPR art. 6) |
|---|---|
| Running Coast for you: turning your uploads into lessons and practice, tutoring you with Pedro, answering from your sources, tracking your progress and adapting to how you learn | Performance of our contract with you (art. 6(1)(b)) |
| Account emails, such as sign-up and password reset codes | Performance of the contract (art. 6(1)(b)) |
| Monthly plan limits and preventing abuse; keeping Coast secure; server logs | Our legitimate interest in a secure, fairly shared service (art. 6(1)(f)) |
| Improving Coast, using aggregated statistics and the feedback you send | Our legitimate interest in improving the service (art. 6(1)(f)) |
| Handling copyright and other notices about content, and legal requests | Legal obligation (art. 6(1)(c)), including under the Digital Services Act, and our legitimate interest |
| Waitlist and product update emails; website analytics | Your consent (art. 6(1)(a)), which you can withdraw at any time |
Where we rely on legitimate interests, you can object (see section 8). We do not sell your data and we do not use it for advertising.
4. Your learning profile and AI
Pedro is an AI system. Coast uses your learning profile to personalise your teaching: which topics to revisit, how hard to make questions and how to explain things. This is profiling, but it has no legal or similarly significant effect on you, so it is not automated decision-making under GDPR art. 22. You can see what Pedro remembers by asking him, and you can delete it by deleting a lesson or your account.
To write Pedro’s replies, read your material and grade your answers, we send the parts of your data each request needs to the AI providers listed in section 6, under their business (API) terms. Under those terms they do not use the data to train their models, and they may keep requests for a limited period (up to 30 days for OpenAI and Anthropic) solely to detect and prevent abuse, after which they delete them. We do not train AI models on your uploads or messages.
5. Your files stay private
What you upload is visible only to you and is used only to teach you. Coast does not share your files with other users, publish them, use them to build courses for anyone else, or use them or anything generated from them to train, fine-tune or evaluate AI models. Coast employees do not look at your files or messages except when you ask us to (for example in a support request), when we must handle a legal notice about specific content, or when it is strictly needed to keep the service secure.
6. Who helps us run Coast
These providers process data only on our instructions, under data processing agreements (GDPR art. 28):
| Provider | What they do | Where |
|---|---|---|
| Render | Hosts our servers and databases | Frankfurt, Germany |
| Cloudflare (R2) | Stores uploaded files and nightly backups, encrypted at rest | Cloudflare’s network (not limited to the EU) |
| Vercel | Hosts the website and the app; anonymous website analytics | EU and US |
| Modal | Short-lived machines that read and index uploaded files | US |
| OpenAI | AI models for Pedro, grading, practice questions and reading files | US |
| Anthropic | AI models (backup provider) | US |
| Google (Gemini) | AI models (backup provider) | US |
| Resend | Sends our emails | US |
| Zoho | Hosts our email inbox (messages you send us) | EU |
| Google sign-in (if you choose it); Google Workspace holds waitlist sign-ups and contact messages | EU and US | |
| Microsoft (Clarity) | Website analytics, only with your consent | US |
Where data leaves the European Economic Area, the transfer is covered by the EU-US Data Privacy Framework (for certified providers) or the European Commission’s Standard Contractual Clauses. You can ask us for a copy of the relevant safeguards. We may also disclose data when the law requires it, for example to a court or authority.
7. How long we keep it
| Data | How long |
|---|---|
| Account, uploads, lessons, chats, practice and learning profile | As long as you have an account |
| A file or lesson you delete | 30 days in a recovery area, then deleted |
| Everything, when you delete your account | Deleted straight away; copies in nightly backups expire within 30 days |
| Monthly usage counts and AI usage records | Linked to your account while it exists; when you delete it, AI usage totals are kept without any link to you |
| Server logs (including IP addresses) | Up to 30 days |
| Feedback reports | Until resolved, and at most 12 months, or until you delete your account |
| Waitlist emails | Until you unsubscribe or ask us to remove them |
| Copyright and other content notices | 2 years, to handle repeat cases and legal claims |
8. Your rights
You can download everything Coast holds about you, and delete your account and all its data, yourself at any time: in the app, open the menu under your name and choose Privacy & account. You also have the right to access, correct, erase or restrict your data, to object to processing based on legitimate interests, to data portability, and to withdraw consent at any time without affecting earlier processing. Write to privacy@coast.academy; we answer within one month.
You can also complain to a data protection authority. In the Netherlands that is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl); you can also go to the authority in the EU country where you live or work.
9. Cookies and browser storage
The app stores only what it needs in your browser: your sign-in, preferences and unsaved drafts. Your sign-in is a token that contains your account ID and email address and expires after 72 hours; logging out removes it. This storage is strictly necessary for the service you ask for, so it does not need consent. The app has no advertising or analytics trackers.
The website uses Vercel Analytics, which counts page views without cookies or personal profiles. Microsoft Clarity, which records how visitors click and scroll and sets cookies, only runs if you accept analytics in the cookie banner. You can change your choice at any time through the “Cookie settings” link at the bottom of every page.
10. Security
All connections use HTTPS. Passwords are stored only as secure hashes. Stored files and backups are encrypted at rest, every request is checked so you only ever see your own data, and access to our systems is limited to the Coast team. If a data breach puts your rights at risk, we will tell the Autoriteit Persoonsgegevens within 72 hours and tell you without undue delay where the law requires.
11. Age
Coast is for people aged 16 and over. In the Netherlands, 16 is the age from which you can agree to an online service on your own. If you believe someone younger has given us personal data, contact us and we will delete it.
12. Changes
If we change how we handle your data, we will update this page and its date, and tell you in the app or by email before an important change takes effect.
13. Contact
Privacy questions: privacy@coast.academy. Post: Rio Mauss, trading as Coast, Hoogbrugstraat 11, 6221 CN Maastricht.