Privacy Policy

1. Who we are and how to contact us

• Data controller: Mr Hassan Serjieh, London, United Kingdom, who owns and operates the Money Luster service (the "Academy"). The controller decides why and how your data is processed.
• Store publisher: the data controller himself, Hassan Serjieh, who publishes the app on Google Play and the App Store through his personal developer account.
• Privacy contact: privacy@moneyluster.com — postal address: POSTAL_ADDRESS.

In this policy, "we" means the data controller and "you" means the app user.

2. Summary

• We collect only what we need to run the academy, protect the courses from leaks, and run the community.
• We do not sell your data, use it for advertising, or track you across other apps or websites.
• To protect the courses, every video carries visible, invisible and inaudible watermarks linked to your account, and we log screen-capture attempts.
• You can delete your account at any time from inside the app.
• The AI assistant ("Ask the assistant") sends your question and excerpts from the lesson to Anthropic (the company behind Claude) to generate an answer, only after you agree. We don't send your name or email.
• We record how you use the app (time spent, lessons, searches, quizzes) to show you your progress and improve the courses. We don't use it for advertising or to track you outside the app.
• The app is for people aged 16 and over.

3. Data we collect

Is providing data required? Name, email, age and password are required to create an account under the Terms of Use; without them we cannot provide the service. Phone number: REQUIRED_OR_OPTIONAL. Device data and security events are collected automatically and are a condition of watching protected courses.

What we don't collect: precise location, contacts or photos; we don't use the camera or microphone. We don't use the advertising ID (Advertising ID / IDFA). We collect no payment data in the app.

4. Why we use your data and our lawful basis

Where we rely on legitimate interests, we have balanced them against your rights, and you have the right to object (section 9).

Automated decisions: if the system detects unusual activity, such as requesting very many lessons unusually fast, it suspends the account temporarily and automatically. No account is permanently terminated without human review. You can ask for any suspension to be reviewed, give your view and contest it, via privacy@moneyluster.com.

5. Watermarks and leak protection

Because the courses are copyrighted, we use:

1. A visible watermark: moving text over the video showing information linked to your account, such as NAME_OR_PARTIAL_EMAIL.
2. An invisible watermark in the picture and an inaudible watermark in the sound. They carry a unique code linked to your account, not your name or email directly. Only we can link the code to your account, using a protected table on our server.
3. Blocking or detection of screen recording and screenshots, pausing the video and logging the event.

How we use them: if a leaked copy of a lesson appears, we extract the code to identify the account it came from. This may lead to account termination and legal action under the Terms of Use. We don't use this data for anything else, such as advertising or profiling.

5A. The AI assistant and AI-generated content

What we send, and to whom: when you use "Ask the assistant", we send Anthropic (the company behind the Claude model):

• your question, and up to 4 earlier messages from the same conversation;
• short excerpts from the lesson's transcript and summary, so the assistant answers from the course content.

We don't send your name, email, phone number or account ID. CONFIRM_WITH_BACKEND Whatever you type in the question is sent as written, so please don't include personal information.

Your consent: before you first use the assistant, we show a screen explaining this, and nothing is sent until you tap "Agree". You can stop using the assistant at any time. AND_WITHDRAW_IN_ACCOUNT

Anthropic's role: Anthropic processes the data on our behalf and on our instructions (as a processor), under its commercial terms and data processing agreement. According to its official page (1 July 2026), it deletes inputs and outputs from its systems within 30 days, except content flagged under its Usage Policy, which may be kept for up to 2 years, or where the law requires otherwise. VERIFY_NO_TRAINING Processing takes place in the United States (see section 7).

Our copy: we keep the conversation, and the admin team reads it to understand what confuses students and improve the lessons. See section 8 for how long.

Limits: the assistant's answers are AI-generated and may be wrong, so check them against the lesson. There is a daily question limit. You can report any answer that is offensive or wrong from within the conversation.

AI-generated content: we also use Claude to write drafts of lesson summaries and short quizzes from the lesson transcripts. No student data is sent for this. Our team reviews and edits every draft before publishing it.

6. Who we share data with

We do not sell your data or share it for advertising. We use service providers who process data on our behalf and only on our instructions:

Other users: other students in the community see only your display name, messages and comments, not your email or phone. The admin team: the academy's administrator and moderators see only the data they need for their role. Authorities: we may disclose data where the law requires it, to protect our rights in a leak case, or to prevent serious harm. Transfer of the service: if the academy is transferred to another entity, the data moves with it and stays protected by this policy; we will tell you.

7. International transfers

Your data may be processed outside the UK:

• The EU (e.g. Slovenia): the UK recognises it as providing adequate protection (adequacy regulations).
• The United States: we rely on the provider's participation in the UK Extension to the EU-US Data Privacy Framework ("UK-US data bridge") where it is certified, otherwise on approved contractual clauses (the IDTA or the UK Addendum to the EU SCCs).
  • This applies to Google, Cloudflare and Anthropic. VERIFY_ANTHROPIC_DPF
• The admin team's country: the team that administers the service on the operator's behalf works from ADMIN_TEAM_COUNTRY and may access data from there. That country has no UK adequacy regulations, so we rely on SAFEGUARDS_TO_CONFIRM, after checking that protection of your data will not be materially lower.
• Server location: SERVER_LOCATION (chosen when the Hostinger VPS is created: France, Germany, Lithuania or the UK, all adequate).

You can ask for a copy of the safeguards we use via privacy@moneyluster.com.

8. How long we keep data

Note: if you delete your account, we may keep your watermark code with minimal data for EVIDENCE_RETENTION, because a leaked copy from an earlier period may surface later. We use it for nothing else. REVIEW_WITH_LAWYER

9. Your rights

Under the UK GDPR you have the right to:

• access your data and get a copy;
• rectify inaccurate data;
• erasure ("right to be forgotten");
• restrict processing in some cases;
• data portability in a machine-readable format;
• object to processing based on legitimate interests;
• withdraw consent at any time (e.g. turn off notifications in your device settings);
• not be subject to a solely automated decision with significant effects, and to ask for human intervention.

How to use your rights: email privacy@moneyluster.com from your registered address. We may need to verify your identity. We reply within one month, extendable by two further months for complex requests, in which case we'll tell you why. It is normally free.

Complaints: if you have a complaint about your data, please contact us first so we can try to resolve it; we will acknowledge it within 30 days and handle it without undue delay. You also have the right to complain to the UK Information Commissioner's Office (ICO): https://ico.org.uk/make-a-complaint/ — or to the data protection authority in your country.

10. Age

• The app is for people aged 16 and over. We ask for your age at sign-up and refuse anyone younger.
• If we learn that an account holder is under 16, we delete the account and its data.
• For users aged 16–17 we apply high-privacy defaults: no location, no ads, no tracking, no public profile beyond the display name, and no private messages from strangers IF_DMS_EXIST.
• Reminders and streaks are there to help you finish your courses, not to keep you in the app: you can turn off each reminder under "My Account", we send no reminders between 10 pm and 9 am in your time zone, and there is no public comparison or ranking between students.

11. Security

• All connections are encrypted (HTTPS/TLS).
• Passwords are stored as one-way hashes.
• Video links are signed, short-lived and tied to your account.
• The admin panel has two layers: Cloudflare Access and a sign-in with two-factor authentication.
• Strict database permissions: no student can see another student's data.
• Encrypted daily backups.

No system is 100% secure. If a breach is likely to put you at high risk, we will tell you and the relevant authorities as the law requires.

12. Cookies

The app itself uses no cookies and no advertising or tracking tools. The website moneyluster.com also uses no cookies, no analytics, tracking or advertising tools, and loads no fonts or files from third parties, so it shows no cookie banner.

13. Changes to this policy

We may update this policy. We'll change the "Last updated" date and tell you in the app or by email about any material change before it takes effect.

14. Contact

privacy@moneyluster.com — POSTAL_ADDRESS