Privacy notice.

Plain English. What data is collected, why, who gets to see it, and how to make us stop. If anything here is unclear, email garde@ai-bear.io and we'll explain.

Last updated 2026-05-16 · Version 2605

Who we are

"AI Bear" is the trading name of Evgenii Garde, a sole operator based in the United Kingdom. Evgenii is the data controller for all personal data described in this notice.

The brand spans the AI Bear newsletter (on Substack), the LinkedIn profile, the AI Bear Academy (academy.ai-bear.io), and any future ai-bear.io site.

Contact: garde@ai-bear.io
Postal address available on request.

What we collect, and why

If you sign up to AI Bear Academy

Data	Why we need it	Lawful basis
Name	Address you in lessons and communications	Legitimate interest
Email	Account login, course updates, password reset	Legitimate interest
Password (hashed, never plain)	Account security	Legitimate interest
Course progress (which lessons you completed, when)	Show you where you are, certify completion	Legitimate interest
IP address + session cookie	Security, fraud prevention, session management	Legitimate interest
Consent timestamp	Prove you agreed to this notice at signup	Legal obligation

Founding cohorts are free at point of signup, so the data processing is on a legitimate interest basis: we need the data to run the service you asked for, and you can ask us to stop and delete at any time. If and when paid courses launch, the basis for transaction-related data shifts to contract performance under UK GDPR Article 6(1)(b).

If you subscribe to the AI Bear newsletter

Data	Why we need it	Lawful basis
Email	Send you the newsletter	Consent
Name (if you give it)	Personalise the greeting	Consent
Open and click data	Improve the newsletter	Legitimate interest

The newsletter is hosted on Substack, which has its own privacy policy at substack.com/privacy. They act as a data processor for us and a data controller for some platform functions.

If you email us, message on LinkedIn, or otherwise initiate contact

We retain what you sent so we can reply and refer back to the conversation. We may also add a brief note to our internal people register (name, role, where we met, context of the conversation, last interaction date) so we can remember who you are next time. Lawful basis: legitimate interest. We don't add you to any product or paid offering without you asking.

If we research you for outreach

If we contact you to pitch a podcast, conference, collaboration, or piece of work, we may have looked at publicly available information about you (LinkedIn, your published writing, your company's site). The lawful basis is legitimate interest: a narrowly targeted, one-off, business-context outreach that a reasonable person in your role would expect to receive. We do not buy, scrape in bulk, or maintain a marketing database. If you tell us to stop, we stop.

Who we share your data with

We use third-party tools to run AI Bear. Each one acts as a data processor under their own terms and ours.

Processor	What they do	Where data sits
Substack	Hosts and sends the newsletter	USA
DigitalOcean	Hosts the LMS and supporting services	UK (London region)
Bluehost	DNS for ai-bear.io	USA
Anthropic (Claude) / OpenAI	AI assistance for content drafting and operations	USA
Google Workspace	Email (garde@ai-bear.io), Drive, Calendar	USA / EU (mixed)
Stripe (when payment goes live)	Payment processing	USA / EU

We never sell your data. We don't share it with advertisers. We don't use it to train AI models, and we use paid tiers of AI tools with model-training opted out.

International transfers

Some processors (Substack, Anthropic, OpenAI, Bluehost, Stripe in part) operate from the United States. We rely on their published Standard Contractual Clauses or equivalent UK transfer mechanisms. If you would like a copy of the relevant safeguards, email us.

How long we keep your data

LMS account: while your account is active, plus 12 months after you ask us to close it (so we can respond to a return request, prove course completion if you need a reference, and meet HMRC bookkeeping rules if you paid).
Newsletter subscription: until you unsubscribe. We delete inactive subscribers (no opens for 12 months) annually.
Email and message threads: up to 3 years after our last interaction. Older threads get pruned.
Outreach research notes: deleted once the outreach is closed (response received, declined, or no reply after 60 days).
Server logs and security data: 30 days.
Payment records (when applicable): 6 years, per HMRC requirements.

Your rights

Under UK GDPR you can:

Access the personal data we hold about you. Email us and we'll send a copy within 30 days.
Correct anything inaccurate.
Delete your data ("right to be forgotten"), subject to legal retention rules (e.g. payment records).
Port your data in a machine-readable format.
Restrict or object to certain uses (especially the legitimate-interest ones).
Withdraw consent at any time, where consent is the lawful basis (e.g. newsletter).
Not be subject to automated decision-making. We don't do any.

To exercise any of these, email garde@ai-bear.io. We aim to respond within 7 days and resolve within 30. There's no charge.

If we don't resolve a concern to your satisfaction, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or 0303 123 1113.

Cookies

The AI Bear Academy LMS uses one cookie: aba_session, an HTTP-only, secure cookie that keeps you logged in. It expires after 30 days or when you log out. No tracking cookies, no ad cookies, no analytics cookies on the LMS.

The newsletter (on Substack) uses Substack's cookies, governed by their own policy.

Children

AI Bear Academy is for adults. We do not knowingly collect data from anyone under 18. If you believe we have, email us and we'll delete it.

AI use, plain English

AI Bear uses AI tools (currently Claude, possibly others) to draft content, run operations, and assist with research and analysis. We use paid tiers with model-training opted out, which means:

Your data does not become training data for future AI models.
Inputs may still be retained by the AI provider for up to 30 days for safety review, then deleted.
We do not paste customer or subscriber names into AI tools unless strictly necessary for a one-off, purpose-specific task.
We do not make automated decisions about you. Anything that affects you (e.g. course access, support reply) is reviewed by a human.

If you'd prefer your data not be processed by AI tools at all, email us and we'll handle your interactions manually. There's no penalty for asking.

Changes to this notice

When this notice changes materially we'll update the version number and "last updated" date at the top, and (for LMS users and newsletter subscribers) notify you by email at the next sensible touchpoint. Minor wording fixes are made without notification.

Contact

Anything about your data: garde@ai-bear.io.
Postal address available on request.