Privacy Notice

1. Scope and responsible party

This notice explains how Frontier Learn handles personal information through frontierlearn.ai, the inquiry form and schedule.frontierlearn.ai. Frontier Learn is a professional brand operated by Néstor Reverón from Costa Rica.

2. Website inquiries

The inquiry form may collect your name, business email, company, country, area of interest, estimated participants, preferred language and format, time zone, target timing, free-text requirements, consent choice, locale and anti-abuse verification data. Do not submit confidential, sensitive, regulated or unnecessary personal information in free-text fields.

3. Scheduling and partner access

The scheduling platform may collect your name, email, optional company, selected service, duration, dates, start times, time zone, notes, consent timestamp, policy version, workflow status and related timestamps. If a request is approved, the application stores the Microsoft and Google event identifiers needed to operate the booking. The contracted-partner portal also stores the identity provider, stable provider subject, current name and email, Microsoft tenant ID when supplied, declared organization, professional role, access purpose, access decision, assigned organization and a digest of the application session token.

4. Calendar, identity and OAuth processing

The Frontier Learn operator connects the owner’s Microsoft 365 and Google calendars. To calculate availability, the server requests busy intervals and does not return private calendar titles, attendees or descriptions. An approved partner sees details only for engagements explicitly assigned to that partner organization; all other commitments are shown only as rounded and merged Busy time. Partner visitors may authenticate through Microsoft 365 using identity-only scopes (openid profile email), or register and sign in by verifying a personal or work email address with a one-use link. Email verification establishes mailbox control, not employment or a contractual relationship. Microsoft and email identities are not automatically merged. This does not grant access to their mailbox, calendar, files or directory and does not prove a contractual relationship; Frontier Learn approves that access manually. Provider ID, access and refresh tokens used during partner sign-in are not retained after validation. Approval of a booking can create calendar events containing the requester’s identity, organization, booking details and notes. Owner-calendar refresh tokens and provider configuration may be stored encrypted.

5. AI assistant

If you use the assistant, your message, selected language, portal context, browser-reported time zone and limited recent conversation are sent through the scheduling service and Cloudflare to OpenAI to generate a reply. The application may then perform a separate read-only live availability check, but OpenAI does not receive calendar busy intervals or event details. The assistant does not submit or approve bookings. Do not enter confidential, sensitive, regulated or unnecessary personal information.

6. Purposes and legal grounds

We use information to respond to requests, prevent abuse, calculate availability, review and administer bookings, create approved calendar events, communicate about services, prepare proposals and contracts, secure and operate the services, maintain recovery copies, and comply with legal obligations. Depending on the circumstances, processing is based on your request or consent, performance of a contract, legitimate operational interests, or applicable legal duties.

7. Providers and international processing

Relevant providers include Cloudflare for DNS, hosting, security, Turnstile and D1 database services; Formspree for inquiry delivery; Microsoft for Clarity analytics, Microsoft 365, Outlook Calendar and email; Google for Google Calendar and OAuth; OpenAI for assistant response generation; and GitHub for private source control and encrypted operational backups. These providers may process information in countries other than yours under their terms and applicable safeguards.

8. Analytics, local storage and security technologies

Microsoft Clarity is used to understand site interaction through analytics, heatmaps and session interaction data. Advertising storage is disabled. The website stores your analytics choice in your browser and lets you accept, reject or reopen that choice. When analytics is rejected, the site sends a denied consent state and does not authorize persistent analytics storage. Cloudflare Turnstile and other Cloudflare security controls may use essential browser or network signals to detect abuse and protect the forms and services.

The classroom timer saves its settings, course title, participant message and countdown state in session storage in the current browser tab. This supports reloads and language changes; closing the tab normally clears that session, although browser session-restoration features may retain it. Timer values are not sent to a Frontier Learn timer service. Editable fields and their presentation text are marked for analytics masking. The existing site analytics choice still applies.

9. Retention

General inquiry information is kept only as long as reasonably necessary to respond, manage a potential or active engagement, maintain required business records and resolve disputes. Pending booking requests are marked expired after 48 hours. Booking records and their occurrences are scheduled for deletion after 730 days; cleanup runs opportunistically in limited batches. Partner OIDC transactions expire after ten minutes and application sessions after 12 hours. Email-verification challenges and their essential browser-binding cookie expire after 15 minutes. The database stores the recipient address, self-declared name and token/binding digests; challenges are deleted on successful use or sending failure, or through bounded expiry cleanup. We send the link through the connected Microsoft account without requesting a Sent Items copy. Recipient email providers may retain delivered messages under their own controls. Active approved access is retained. Rejected access requests become eligible for deletion 365 days after the decision; suspended access records become eligible 730 days after suspension. A partner identity becomes eligible for deletion after 365 days of inactivity only when it has no access requests, booking references or active sessions. Partner cleanup runs in batches of up to 100 records when a partner begins sign-in or an administrator views access requests; these are eligibility periods, not guaranteed deletion deadlines. Calendar connections and OAuth configuration remain until replaced, disconnected or no longer required. Assistant conversations are not written to the Frontier Learn application database or browser local storage; OpenAI, hosting and security logs may follow separate controls. Provider calendars, email, security logs, analytics and encrypted backups follow their separate controls.

10. Security and backups

We use access controls, encrypted transport and encryption for stored OAuth secrets and refresh tokens. Encrypted D1 recovery copies may be stored in a private GitHub repository, while the archive recovery key is kept separately. No internet service can be guaranteed completely secure; report a suspected privacy or security issue to the contact below.

11. Your choices and requests

Subject to applicable law, you may request access, correction, deletion, restriction or portability, object to certain processing, or withdraw consent for future processing. You may ask Frontier Learn to suspend or remove partner-portal access and may revoke the partner application grant from your Microsoft account. A booking-data request may require separate action in D1, Microsoft Calendar, Google Calendar, email and recovery copies. You may also ask the operator to disconnect calendar integrations; provider access can additionally be revoked from the applicable Google or Microsoft account. We may need to verify your identity before completing a request.

12. Children

These business services are not directed to children. Do not submit a child’s personal information through the inquiry or scheduling forms.

13. Changes

We may update this notice when services, providers or legal requirements change. The effective date above identifies the current published version.

14. Contact

For privacy requests or questions, email nestor@frontierlearn.ai. Please do not include unnecessary sensitive information in your initial message.