Data Policy

Last updated: May 2026

1. What data we collect

We collect account data (name, email, hashed password), learning data (progress, submissions, grades), payment records (via Stripe — we do not store card numbers), usage data (pages visited, IP address, browser), and support communications.

2. Legal basis

We process data based on contractual necessity, legitimate interest, consent, and legal obligation.

3. Data retention

• Account data: while account is active, plus 30 days after deletion
• Learning data: retained indefinitely for certificate verification
• Payment data: 7 years for financial compliance
• Usage data: anonymised after 12 months

4. Who we share with

Only Stripe (payments), Google/Microsoft/Apple (OAuth if chosen), and our hosting provider. We do not sell data to third parties.

5. Your rights

You may request access, correction, deletion, portability, or restriction of your data. Contact privacy@yourdomain.com and we will respond within 30 days.

6. Security

We use HTTPS, bcrypt password hashing, CSRF tokens, prepared SQL statements, role-based access, and regular security reviews.

7. Contact

Data Protection: privacy@yourdomain.com