Privacy Policy

1. Who we are The platform is operated by ⟦not yet provided⟧ (company number ⟦not yet provided⟧, registered in ⟦not yet provided⟧), whose registered office is at ⟦not yet provided⟧ ("learn.co.uk", "we", "us" or "our"). For privacy questions, contact ⟦not yet provided⟧.

2. Controller and processor roles We act in two different roles: - **As controller** for our own purposes: running Creator accounts, billing for packages, security, support, our own marketing, and improving the Platform. - **As processor** on behalf of Creators: when a Creator uses the Platform to enrol, teach, assess and certify their Students, the Creator decides why and how Student data is used and is the controller. We process that data on their instructions under our Data Processing Agreement.

If you are a Student, the academy you joined is usually your first point of contact for privacy requests about your course.

3. Personal information we collect - **Account details:** name, email address, password (stored in hashed form), phone number if given, role. - **Creator and academy details:** academy name, web address, logo, branding, team members, package and subscription status. - **Student information:** enrolments, lesson progress, time spent on lessons and exams, exam answers, uploaded evidence, marks, feedback, certificates. - **Payment and billing information:** package, invoices, payment status and references. Card details are collected and held by Stripe; we do not see or store full card numbers. - **AI prompts and uploaded content:** text extracted from PDFs, audio extracted from videos, and transcripts sent to AI Tools to draft questions or narration. - **Communications:** messages sent through contact forms and to our support addresses. - **Technical data:** IP address, browser type, device and log information needed to secure and run the Platform.

4. Lawful bases - **Contract:** to provide accounts, subscriptions and the services you request. - **Legitimate interests:** to secure the Platform, prevent fraud, provide support and improve our services, balanced against your rights. - **Legal obligation:** to keep financial records and respond to lawful requests. - **Consent:** for optional marketing emails and any non-essential cookies. You may withdraw consent at any time.

5. How we use information To create and manage accounts; provide course building, delivery and assessment; process payments; issue and verify certificates; give support; send service messages; keep the Platform secure; meet legal obligations; and, with consent, send marketing.

6. Third-party subprocessors We use these providers to run the Platform: - **Lovable Cloud** — application hosting, database, authentication and file storage. - **Cloudflare** — website delivery and server functions. - **Stripe** — payment processing for packages. - **AI model providers accessed through the Lovable AI gateway (including OpenAI and Google)** — generating questions, transcribing video audio and narrating lessons. - **Email delivery through Lovable** — account and password emails.

The exact data locations and transfer arrangements of each provider must be confirmed before this policy is approved.

7. International data transfers Some providers may process data outside the UK. Where they do, we rely on UK adequacy regulations or appropriate safeguards such as the UK International Data Transfer Addendum or Agreement.

8. Data security We use access controls, row-level database permissions, encrypted connections, private file storage with time-limited links, and role-based staff access. No system is perfectly secure, but we work to protect your information.

9. Data retention We keep account data while your account is active. Financial records are kept for six years for tax purposes. Issued certificates may be kept so that they can still be verified. Other data is deleted or anonymised within a reasonable period after an account closes, unless a Creator instructs otherwise or the law requires longer retention.

10. Your rights You have the right to be informed, to access your data, to rectification, to erasure, to restrict processing, to data portability, to object, and rights relating to automated decision-making. Marking is done by people; AI Tools only suggest content and do not make decisions with legal or similarly significant effects.

11. Subject access requests Email ⟦not yet provided⟧. We will respond within one month, which may be extended where the law allows. We may ask you to confirm your identity.

12. Children Creator accounts are for adults. Creators who teach under-18s are responsible for having an appropriate lawful basis and safeguarding measures, and for any parental consent required.

13. Marketing communications We only send marketing emails if you opt in. Every marketing email includes a way to unsubscribe. Service emails about your account are not marketing.

14. Cookies See our Cookie Policy. We currently use only storage that is strictly necessary for the Platform to work.

15. Complaints Please contact us first. You also have the right to complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).

16. Changes We will post updates here and tell you about significant changes.