Privacy policy

Learn GTO is a poker teaching service at learn-gto.com, operated by Appcelerator Studio, operating from the Republic of Serbia and trading as Learn GTO. In this notice, we, us and Learn GTO mean that operator, and you means the person reading it.

For the purposes of the EU General Data Protection Regulation, the UK GDPR and the Serbian Law on Personal Data Protection, we are the controller of the personal data described here. That means we decide why it is processed and how, and we are the party you hold responsible for it.

Every privacy question, request or complaint goes to one address: team@learn-gto.com. It reaches a person, not a queue, and we would much rather answer you than have you go to a regulator — though § 20 explains how to do that too.

We have not appointed a Data Protection Officer. Our processing does not meet any of the thresholds in Article 37 GDPR that would require one: we are not a public authority, our core activity is not large-scale systematic monitoring, and we do not process special categories of data at scale.

This notice covers the Learn GTO website and everything on it: the course, the trainer, the calculators, the reference pages and the onboarding flow. It applies wherever you are reading from.

It does not cover other companies’ websites that we link to. When you follow a link away from Learn GTO you are on someone else’s site, under their notice, and we have no control over what they do — see § 18.

This clause is not a legal requirement. It is here because it explains every clause that follows, and because a privacy notice that lists protections without saying where they come from asks to be taken on trust.

Learn GTO is a static site. Every page is built into a file in advance and served from a content delivery network. There is no application server, no database, no API and no session — there is nowhere for your data to be sent, because there is nothing running that could receive it.

So the equity calculations run on your processor, the drills are graded on your device, and your progress is written to your browser’s own storage. We do not have a copy. We cannot look up your account, because there are no accounts. This is a deliberate design decision with a real cost — it is why your progress does not follow you to a second device — and the benefit it buys is that the overwhelming majority of what you do here never becomes our problem, or our liability, or anybody’s subpoena target.

Two things do leave your device, and they are set out in full in § 4 and § 6.

The table below is complete. It is generated from the same list of storage keys the application itself uses, so a key cannot be added to the product without appearing here — the code will not compile otherwise.

None of it is transmitted to us. All of it is deleted, permanently and immediately, when you clear site data for this domain in your browser settings. There is no server-side copy, so there is nothing to restore and nothing left behind.

A note on the calculator: the hands and boards you enter there are written into the page’s own address, so a link is a complete, shareable snapshot of what you were looking at. That address stays in your browser unless you share the link yourself. Our measurement deliberately records the path and never the query string, so what you typed into the calculator is not in any event record.

Stated as an undertaking, not as a description of current practice. If any of this changes, this notice changes first.

• Special categories of personal data under Article 9 GDPR: health, biometrics, genetics, race or ethnicity, religion, politics, trade union membership, sex life or sexual orientation.
• Precise geolocation. We do not request it and the site has no code that could.
• Your contacts, your calendar, your microphone, your camera or your files.
• Government identifiers, or any document proving your identity.
• Full payment card numbers, at any point, by any route.
• Data purchased from a data broker, or appended to yours from an outside source.
• Anything at all sold, rented or traded. We have never done it and this notice commits us not to.

Article 6 GDPR requires a lawful basis for each purpose, and the honest version of that table is short, because the purposes are few.

Where we rely on legitimate interests, you have an unconditional right to object, and for the measurement in particular you can exercise it without contacting us at all by turning on the browser signals described in § 6. Ask us for the balancing assessment behind any of these and we will send it to you.

Learn GTO sets no cookies. That sentence is true and, on its own, close to meaningless: the rule people call the cookie law — Article 5(3) of the ePrivacy Directive and the national laws implementing it — governs the storing of any information on your device, not the use of one particular mechanism. Local storage is squarely within it. So the disclosure that matters is the itemised table in § 5, and every entry there is classified by whether it needs your consent.

There is no consent banner on this site. That is a considered position rather than an omission:

1. Everything needed to run the course, the trainer and the calculators is strictly necessary to deliver a service you explicitly requested, and is exempt from the consent requirement.
2. Everything else on the device is there because you personally typed it in and submitted it, which is consent in the ordinary sense of the word.
3. The one measurement entry is first-party, session-scoped, carries no cross-site identifier, and is disabled entirely by a browser opt-out signal that we honour without argument.

If we ever deploy measurement that is not session-scoped and first-party, or any advertising or profiling technology whatsoever, we will ask for your consent before it runs — not after, and not by treating continued scrolling as agreement.

We do not sell your personal data. We do not share it for cross-context behavioural advertising. We have never done either, and we receive no money from anybody in exchange for data about you.

It is disclosed to these categories of recipient and no others:

• Our hosting provider, Google, through Firebase Hosting, which serves the site and keeps the request logs described in § 6.
• A measurement collector and, if configured, a tag manager, which receive the event stream described in § 6.
• An email delivery service, which receives addresses submitted through the site so that we can reply to them.
• A payment processor, once checkout opens, which will handle card details on its own systems and tell us only that a payment succeeded.
• Professional advisers — lawyers, accountants, auditors — under a duty of confidence, where they need it to advise us.
• Public authorities, where we are legally compelled. We will resist requests that are overbroad or unlawful, and will tell you about any request concerning you unless we are prohibited from doing so.
• A buyer or successor, if the service is ever sold or merged. They would take it subject to this notice, and you would be told before anything transferred.

Everyone in the first four categories acts as a processor on our written instructions under Article 28 GDPR: they may use your data to provide their service to us and for nothing else.

We are established in the Republic of Serbia, and our providers operate globally, so personal data may be processed outside the country you are reading from — including in Serbia, the European Economic Area, the United Kingdom and the United States.

Serbia is a party to Council of Europe Convention 108 and its modernising protocol, and its data protection law is aligned with the GDPR, but it is not the subject of a European Commission adequacy decision. Transfers of personal data out of the EEA or the UK to us therefore rely on the appropriate safeguards in Article 46 GDPR — principally the European Commission’s Standard Contractual Clauses and, for the UK, the International Data Transfer Addendum — or, where a transfer is occasional and necessary to perform a contract you asked us to perform, on Article 49(1)(b).

Where our providers process data in the United States, we rely on their Standard Contractual Clauses and, where the provider is certified, on the EU-US Data Privacy Framework and its UK extension. Ask us for a copy of the safeguards relied on for any specific transfer and we will send it, redacted only where commercially necessary.

The general rule is that we keep personal data only for as long as the purpose it was collected for still exists, and then delete it. Specifically:

• Everything on your device lasts until you clear site data for this domain, which deletes it immediately and permanently. You control this entirely and do not need us.
• Email addresses are kept until you ask us to delete them, or until 24 months have passed with no contact from you, whichever comes first.
• Correspondence is kept for 24 months after the matter is closed.
• Measurement events are kept in raw form for no more than 14 months, after which they are deleted or irreversibly aggregated into figures that identify nobody.
• Hosting logs are kept under our provider’s retention schedule, which is measured in weeks, not years.
• Records of privacy requests are kept for 3 years, because we have to be able to show a regulator that we answered you.
• Accounting and tax records, once there are any, are kept for the period Serbian tax and accounting law requires, which is longer than any period above and which we cannot shorten at your request.

We take the measures Article 32 GDPR requires, judged against how little data there is to protect: the whole site is served over HTTPS; we hold no database of user content and no password to steal; access to what we do hold is limited to the people who need it; and our providers are chosen for their own security posture and bound by contract.

The strongest control here is architectural rather than procedural. Data that was never collected cannot be breached, and § 3 explains why almost none of it is.

No method of transmission or storage is perfectly secure, and anyone who tells you otherwise is selling something. If a breach occurs that is likely to result in a risk to your rights, we will notify the competent supervisory authority within 72 hours as Article 33 requires, and we will tell you directly, without undue delay, where the risk to you is high.

If you believe you have found a security problem, please report it to team@learn-gto.com. We will not pursue anyone who reports a genuine vulnerability to us in good faith and gives us a reasonable chance to fix it.

Depending on where you live, you have some or all of the following rights over your personal data. Where the GDPR or the UK GDPR applies, you have all of them.

• Access — to be told whether we hold data about you and to receive a copy of it.
• Rectification — to have inaccurate data corrected and incomplete data completed.
• Erasure — to have your data deleted where one of the grounds in Article 17 applies.
• Restriction — to have processing paused while a dispute about accuracy or legitimacy is resolved.
• Portability — to receive the data you gave us in a structured, machine-readable format, and to have it sent to another controller where technically feasible.
• Objection — to object to processing based on legitimate interests, and an absolute right to object to direct marketing at any time.
• Withdrawal of consent — at any time, without affecting the lawfulness of what was done before you withdrew it.
• Complaint — to a supervisory authority, as § 20 sets out.

To exercise any of them, email team@learn-gto.com. It is free. We answer within one month, and will tell you inside that month if a complex request needs the two-month extension Article 12(3) allows. We will only refuse a request that is manifestly unfounded or excessive, and if we do we will explain why and tell you how to challenge it.

Where we can identify you, we may ask for information confirming that the address you are writing from is the one the data belongs to. That is an anti-impersonation measure, not an obstacle, and we will not use anything you send for verification for any other purpose.

The rights in § 14 are given to everyone, wherever they live, because operating one standard is simpler and better than operating five. Some jurisdictions additionally require specific disclosures, which follow.

Learn GTO is for adults. The service is not directed to anyone under 18, we do not knowingly collect personal data from anyone under 18, and using the service requires you to confirm you are at least that age.

If you believe a child has given us personal data, write to team@learn-gto.com and we will delete it promptly. A parent or guardian can also remove everything stored on the device immediately, without contacting us, by clearing site data for this domain.

We make no decision about you by automated means that produces legal effects concerning you or similarly significantly affects you, within the meaning of Article 22 GDPR. The product does adapt to you — it picks drills from your onboarding answers and your recent accuracy — but that happens on your device, it decides only which poker hand you are shown next, and it affects nothing outside the lesson. Nobody is scored, ranked, priced or refused anything as a result.

Learn GTO links to other websites, and some of those links may earn us a commission. Following one takes you outside this notice and into the hands of a company whose practices we do not control and cannot vouch for. Read their privacy notice before you give them anything. A commercial relationship never changes the arithmetic on this site: the equity figures are computed from the cards, not from who is paying.

When this notice changes, the version number and the date at the top of the page change with it, in the same release as the change itself. The version you are reading is 2.1.

For a change that materially reduces your protections or widens what we collect, we will not rely on a quietly edited page. We will give reasonable notice before it takes effect, by email where we have your address and by a prominent notice on the site otherwise, so that you can object, withdraw consent or delete your data first.

Please start with us at team@learn-gto.com. Most complaints are a misunderstanding we can clear up in one reply, and it is much faster than a regulator.

You are not required to. You can go straight to a supervisory authority, and doing so does not affect any other remedy you have:

• Serbia — the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia, poverenik.rs.
• European Economic Area — the authority in your country of residence or work, listed by the European Data Protection Board at edpb.europa.eu.
• United Kingdom — the Information Commissioner’s Office, ico.org.uk.
• United States — your state Attorney General, and in California additionally the California Privacy Protection Agency.