Privacy Policy

1. Data Controller and Data Processor Roles

When an organization uses Personal Academy, the customer organization acts as the Data Fiduciary (Data Controller) regarding all employee, learner, and training content data. Personal Academy operates as a Data Processor handling such information strictly on behalf of the customer pursuant to our Data Processing Addendum (DPA).

2. Categories of Information Collected

• Account Identification: Full name, corporate email address, organizational role, and encrypted authentication tokens.
• Learning Analytics: Course enrolments, lesson progress, quiz attempts, time spent, completion timestamps, and issued certificates.
• Technical Metadata: Access timestamps, IP addresses for security allow-listing, browser user-agent, and audit logs.
• AI Inputs & Outputs: Prompt requests submitted by course authors and generated syllabus materials. We never use customer prompts or training data to train public foundation models.

3. Purpose and Lawful Basis for Processing

We process personal data solely to provide, secure, and deliver the LMS service (performance of contract, GDPR Art. 6(1)(b)), satisfy compliance auditing requirements (legal obligation, Art. 6(1)(c)), and prevent unauthorized system intrusion (legitimate interest, Art. 6(1)(f)).

4. European GDPR Rights

EU and UK residents possess statutory rights under GDPR Articles 15–22, including the right of access, rectification, erasure (the "Right to be Forgotten"), restriction of processing, and data portability. Such requests can be initiated directly by tenant administrators or by contacting our Data Protection Officer.

5. India DPDP Act 2023 Compliance & Grievance Redressal

Under the Digital Personal Data Protection Act 2023, data principals have the right to access, correct, and withdraw consent for personal data. In accordance with Section 10 of the DPDP Act, the statutory Grievance Officer is designated generically as:

6. Data Retention and Erasure

Customer organizational data is retained for the active duration of the subscription. Upon subscription termination, customer administrators have 30 days to export all records. After that, customer data is deleted within 30 days; backups expire on our database provider’s schedule.

7. Children's Data

Accounts are for people aged 18 and older. A person under 18 may use the service only (a) when enrolled by an organisation that has obtained verifiable consent from the parent or legal guardian and warrants this to us, or (b) through self-registration where a parent or legal guardian gives consent at sign-up and is the paying party. We do not knowingly collect personal data from a minor outside these paths, and organisations must not enrol minors without that consent.

8. Analytics and Marketing Cookies

Our public website (not the signed-in application) may run Google Analytics and Google Tag Manager, Vercel Web Analytics, and the Meta Pixel — but only after you consent, and only on marketing and trust pages. With your marketing consent it may also load the Google Ads conversion tag and the LinkedIn Insight Tag, which record whether a sign-up or demo request followed one of our advertisements on those networks; their cookies and retention periods are listed in the Cookie & Tracking Policy. These never run inside the signed-in product, on /admin, /home, /courses, /super-admin or /learn. See our Cookie & Tracking Policy for the full list of cookies, providers and how to change your choice.