Privacy policy

What we collect

• Account: email, name, and (optionally) a company name and billing address for receipts. Purchases also record the country the payment came from and the campaign link, if any, that brought you.
• Learning: lesson progress, quiz and exam attempts, and the answers you give in “apply to your org” steps. These exist to build your plan and issue your certificate, and are visible only to you (and to us for support). If your seat was bought by a team, the buyer sees your name, email, and completion percentage on their team page.
• Purchases: what you bought and when. Card details never touch our servers. Payment is processed by Stripe.
• Certificates: holder name, credential ID, and issue date, shown on the public verification page for any credential you earn.
• Security log: when a request is refused (a sign-in link that has expired, a rate limit, an admin page you are not allowed to open), we record what happened, when, and the IP address it came from. This is how we notice an attack on your account, and we keep it on the legitimate-interest basis rather than consent.

Email

We send essential account email (sign-in links, receipts, certificates, refund confirmations) and, as an existing customer, occasional email about our own AI leadership programs, the soft opt-in basis. Every marketing email has one-click unsubscribe, honoured instantly across all our systems including our newsletter list. Unsubscribing never affects essential account email.

Who processes data for us

• Stripe: payments.
• Resend: transactional email delivery.
• Sendy on Amazon SES: our marketing list and broadcasts.
• Railway: application hosting and database.
• Google Analytics: which pages are visited and roughly where from, so we know what to improve. It sets cookies in your browser and Google processes the data on our behalf.
• Anthropic: the AI mentor inside lessons, where it is switched on. It receives the question you type and the text of the lesson you are reading, and nothing else: not your name, not your email, not your progress or results.

The AI mentor

If you ask the in-lesson mentor a question, we store the question so we can see where our material is unclear and fix it. We store your question, not the answer. Treat it like any message you would send us: ask about the lesson, not about anything personal or confidential. Deleting your account deletes your questions along with the rest of your learning data.

Retention & deletion

Your data stays while your account exists. You can request deletion at any time ([email protected]): account and learning data are erased; purchase records are retained in anonymised form (no name, no readable email) because accounting law requires a financial ledger. Security log entries are kept with your email and account reference removed, so the record of an attack survives without naming you. Issued certificates are deleted and their credential IDs permanently retired as part of deletion, so they no longer verify.

Your rights

UK GDPR applies: access, correction, deletion, portability, and objection. Email [email protected] and we'll act on it. If we ever fall short, you can complain to the ICO (ico.org.uk).