Draft template. Replace the bracketed items and have it reviewed (Swiss FADP and EU GDPR).
[Legal name], [address]. Contact: [e-mail].
From your Google sign-in: name, e-mail address and an account identifier. From your use of the course: purchases and access periods, lesson progress, the lessons opened with time, device identifier, browser type and IP address. Payments are handled by Stripe; we do not receive your card details.
To provide the course and your access period (contract), to issue invoices (legal obligation), and to prevent account sharing and misuse (legitimate interest). We do not sell your data. [If you send marketing e-mails, state the basis and how to opt out.]
Google Firebase (sign-in), Cloudflare (hosting and database), Stripe (payments). Some may process data outside Switzerland and the EU under standard contractual clauses.
Account and progress: while your account exists. Lesson access logs: [12] months. Invoices: as required by law (10 years in Switzerland).
You can ask for access, correction, deletion or a copy of your data, and object to processing, by writing to [e-mail]. You may also complain to the data protection authority.