RAP DojoLumivara

Privacy Policy

Last updated: 9 June 2026

RAP Dojo is an independent educational app — available as a website and as an Android app (a wrapper around the same website) — operated by Lumivara, an independent developer based in Ontario, Canada. This policy applies to both, and explains what personal data we process when you use RAP Dojo, why, who helps us do it, how long we keep it, and the rights you have over it. For data protection purposes, Lumivara is the data controller for RAP Dojo.

1. What we collect

  • Account data. If you create an account, we store your email address. If you sign in with Google, we receive basic Google profile information (your name, email, and profile picture) — we request only the minimal email-and-basic-profile scopes. If you sign in with an email one-time code (OTP), we process your email to send and verify that code.
  • Learning progress.Your learning state — lesson progress, streaks, goals, display preferences, and the practice you do — lives only in your browser's localStorage on the device you use. We do not currently copy it to our servers, so it does not automatically follow you to another device or survive clearing your browser data; signing in is for access and billing, not progress sync.
  • Self-explanation text (optional).Some exercises invite you to write a short summary in your own words (“explain it back”). When an AI grader is configured for the deployment, that text is sent once to the grader to score it. When no AI grader is configured, the text is graded locally by a deterministic heuristic and never leaves your browser. Please do not include customer names, system IDs, or ticket numbers in what you write.
  • Payment metadata. If you buy a subscription, the payment is processed by Stripe. We never see or store your full card number — Stripe Checkout handles card data directly. We retain only payment metadata (e.g. a Stripe customer/subscription identifier, plan, status, billing country, and the amount and date of a charge) needed to give you access and keep records.
  • Minimal technical data. Our host keeps short-lived operational logs (such as IP address and request metadata) for security and to run the service. We keep analytics minimal and do not build advertising profiles.

2. Why we process it, and our legal bases

For users in the EU/EEA and UK, we rely on the following legal bases under the GDPR (Article 6):

  • Performance of a contract — to create and run your account, deliver the course, save your progress, and process the subscription you purchased.
  • Legitimate interests — to keep the service secure, prevent fraud and abuse, and understand aggregate, non-identifying usage so we can improve RAP Dojo. We balance these against your rights and keep the data minimal.
  • Consent — for any optional marketing email and for sending your self-explanation text to the AI grader (which you trigger by choosing to submit it). You can withdraw consent at any time.
  • Legal obligation — to keep records (for example, tax and accounting records for payments).

3. Third-party processors and sub-processors

We use a small set of reputable service providers to run RAP Dojo. They process data on our behalf under their own terms and data processing agreements:

  • Google— “Sign in with Google” authentication (basic profile + email).
  • Stripe — payment processing and subscription billing (card data is handled entirely by Stripe).
  • Resend — delivery of sign-in one-time-code and transactional emails.
  • Neon — managed PostgreSQL database hosting for account and entitlement data.
  • Vercel — application hosting, edge delivery, and the AI Gateway used to reach the optional AI grader.
  • AI grader — when configured, the model accessed via the Vercel AI Gateway (e.g. Google Gemini) grades your optional self-explanation text. The text is sent for grading and is not used by us to build a profile of you.

4. International transfers

Lumivara is based in Canada and our providers operate infrastructure in various countries, including the United States and the EU. Where personal data is transferred outside your region, we rely on the safeguards our providers offer (such as Standard Contractual Clauses and equivalent transfer mechanisms) to protect it.

5. Cookies and local storage

RAP Dojo uses your browser's localStorageto keep your learning progress and preferences on your device, and uses strictly necessary cookies to keep you signed in and to operate the service securely. We do not use advertising or cross-site tracking cookies. You can clear this data at any time using your browser's “clear site data” controls.

6. How long we keep it

  • Account data — for as long as your account is active; deleted (or anonymised) within a reasonable period after you delete your account, subject to records we must keep by law.
  • Learning progress in localStorage — stays on your device until you clear it.
  • Self-explanation text — sent to the AI grader for a one-off scoring call; we do not retain it on our servers as a permanent record.
  • Payment records — retained as required for tax and accounting purposes.
  • Operational logs — short-lived, kept only as long as needed for security and operations.

7. Your rights (EU/EEA, UK and similar)

If you are in the EU/EEA, the UK, or a region with comparable laws, you have the right to:

  • Access the personal data we hold about you;
  • Rectification — correct inaccurate or incomplete data;
  • Erasure— ask us to delete your data (“right to be forgotten”). You can delete your account and the personal data tied to it yourself at any time from Account → Delete account in the app, or email us and we will do it for you.
  • Portability — receive your data in a portable format;
  • Objection and restriction — object to, or restrict, certain processing (including processing based on legitimate interests), and withdraw consent at any time.

To exercise any of these rights, contact us at the address in the Contact section below. You also have the right to lodge a complaint with your local data protection authority.

8. Children

RAP Dojo is a professional upskilling tool intended for adults and is not directed to children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us data, contact us and we will delete it.

9. Security

We use industry-standard measures to protect your data, including encrypted connections (HTTPS), reputable managed providers, scoped access, and keeping card data out of our systems entirely via Stripe. No method of transmission or storage is perfectly secure, but we work to protect your information and to address issues promptly.

10. Contact

For any privacy question or to exercise your rights, contact Lumivara at privacy@lumivara.tech. We aim to respond within a reasonable time and in line with applicable law.

11. Changes to this policy

We may update this policy as the service evolves or the law changes. We will update the “Last updated” date above and, for material changes, take reasonable steps to notify you.

SAP, ABAP, ABAP Cloud, S/4HANA, Clean Core, Joule, RAP, Fiori, SAP BTP, C_ABAPD and other SAP product/service names are trademarks or registered trademarks of SAP SE (or an SAP affiliate) in Germany and other countries. RAP Dojo is an independent educational product and is not affiliated with, sponsored by, authorized by, or endorsed by SAP SE.

Terms of Service →