Privacy notice
What the website collects—and why.
Effective 2026-07-19. This notice covers the public website, early-access list, optional AI Guide and browser storage. Invited product accounts require a separate product notice before lesson material is processed.
Who is responsible
Release gate: the full legal operator name and postal address have not been configured. Until they are published, do not treat this website as ready for paid or invited product accounts. Current privacy contact: privacy@itzako.com.
Scope of this notice
This notice applies when you browse itzako.com, save Academy progress on your device, use the optional AI Guide or join the early-access list. It does not yet govern an invited extension or dashboard account.
Early-access sign-up
When you join the list, Itzako stores your email address, selected website language, sign-up time and notice version. These data are used only to manage controlled access and relevant product updates. Joining does not create a charge or guarantee access.
AI Guide messages
When you send a message, the message, up to eight recent conversation turns, selected language and current page route are sent to OpenAI to generate a reply. The website request uses store:false. OpenAI states that API data is not used to train its models unless a customer opts in, but standard abuse-monitoring logs may contain prompts and responses for up to 30 days unless approved Zero Data Retention applies. Do not submit sensitive, confidential or unauthorised material.
Browser storage
Academy completion records, the optional Pathfinder Passport, and the SIGNAL//NOISE local high score are kept only in local storage on your device. The arcade game does not send this score to Itzako. Recent AI Guide messages are kept in session storage for the current browser session. You can remove these records by resetting the relevant feature or clearing this site’s browser data.
Technical and security data
The early-access and AI Guide endpoints temporarily use the requesting IP address for in-memory rate limiting. A rate-limit window lasts ten minutes. Hosting infrastructure may also create access and security logs as described below.
Purposes and lawful bases
Itzako processes sign-up data to respond to your request for early access and send related updates; AI Guide data to provide the answer you request; device storage to remember your chosen progress; and technical data to protect the service. The final controller must record the applicable lawful basis for each activity before release rather than treating every purpose as consent.
Hosting and service providers
Release gate: the hosting provider, processing location or security-log retention has not been fully configured. OpenAI processes AI Guide requests; early-access records use access-restricted server storage.
International transfers
Release gate: the applicable contract and international-transfer safeguard for the AI provider has not been recorded. No EU-only or single-country processing promise is made.
Retention
Early-access records are kept while the controlled programme remains active or until deletion is requested. AI Guide messages remain in browser session storage until reset, session expiry or site-data removal; Itzako does not deliberately persist them in its own application database. Rate-limit entries expire after ten minutes. Provider and hosting retention is described separately and must be verified against the deployed configuration.
Your rights and choices
Depending on applicable law, you may request access, correction, deletion, restriction, objection or portability, withdraw consent where consent is used, and complain to your local data-protection authority. Email privacy@itzako.com. Withdrawing product updates and deleting stored sign-up data are separate requests, so say which outcome you want.
Children and age
Release gate: the minimum learner age and parental-handling rule have not been configured. Until that decision is published, children should not use the AI Guide or submit an early-access email.
Learning material and learner profiles
The public website does not capture lesson content or build a learner profile. Before an invited extension or dashboard account processes selected lesson text, source URLs, prompts, answers, progress or inferred weak points, Itzako must publish the product-specific purposes, legal bases, processors, retention, export and deletion controls.
Security, changes and questions
Itzako uses restricted server-side storage for early-access records and does not place API keys in the browser. No service can promise absolute security. This notice must be updated before a new use of personal data begins. Questions and suspected privacy problems can be sent to privacy@itzako.com.