Last updated . This explains what CourseDeck does with personal information. It is written to be read, so if anything is unclear, ask: .
CourseDeck is run by (“we”). We are registered with the Information Commissioner’s Office (ICO), registration number .
There are two groups of people in this notice, and our role is different for each:
| Information | Why | Basis (UK GDPR) |
|---|---|---|
| Facilitators: email address, name, and the temporary password email we send. Your password is handled by Amazon Cognito; we never see it. | To create your account, sign you in and send account emails. | Contract (providing the service you asked for) |
| Facilitators: what you save: quizzes, questions, activities, pictures, slide decks, files, courses and session settings. | To store it for you and run it in your sessions. | Contract |
| Facilitators: the version of these terms and privacy notice you agreed to, and when. | To keep a record of your agreement. | Legitimate interests (proof of what was agreed) |
| Learners: the name or nickname they join with, their answers, scores and choices in activities, chat messages, hands-up and help requests, and the optional “about me” line in online sessions. | To run the session for the facilitator, and show results to the facilitator. | The facilitator’s: usually legitimate interests or the contract with the learner. We process on their instructions. |
| Everyone who signs up: your IP address and browser details, seen by Cloudflare’s Turnstile check to tell people from bots. We keep only one-way scrambled (hashed) versions of your IP address and email, in counters that delete themselves within three days. | To stop automated sign-ups and abuse. | Legitimate interests (keeping the service safe) |
| Facilitators who subscribe: your plan, whether you pay monthly or yearly, when it renews or ends, and your Stripe customer reference. Your card number and billing details are entered on Stripe’s own page and never reach us. | To give you the plan you pay for, end your free trial and tell you if a payment fails. | Contract |
| Facilitators: the date your free trial started. | To work out when it ends. | Contract |
| Anyone who sends a report: what you write, the address you give (optional) and the same bot check. | To look into the report and tell you what happened if you left a contact. | Legitimate interests (keeping the service safe); legal obligation where the report is about illegal content |
We do not use advertising or analytics trackers, we do not sell personal information, and we do not make decisions about people by automated means.
Learners can enter anything in an answer or chat message, so facilitators should tell them not to share sensitive personal information in a session. We do not ask for anything of that kind.
We disclose information to others only if the law requires it, or to protect people from serious harm.
| What | How long |
|---|---|
| Your account and everything you saved | Until you delete your account (Admin, “Your account”). Deleting removes it from the live service straight away and the rest within minutes. |
| What learners enter in a session | It expires by itself about 17 days after it was saved (the database can take a couple of days longer to clear it), and is removed immediately if the facilitator deletes their account. |
| Saved quiz results | 180 days, then deleted automatically. |
| Saved chat transcripts (only if the facilitator saves one) | 365 days, then deleted automatically. |
| Backups | Deleted data can remain in backups for up to 35 days, and is then gone. We do not use backups for anything except recovering from a failure. |
| Sign-up protection counters | Up to three days. |
| Reports | Just over a year, so there is a record of what was reported and what we did. |
| Your plan and subscription details | Until you delete your account. When you delete it we cancel the subscription and ask Stripe to remove the customer record; Stripe keeps payment records for as long as tax and accounting law require. |
| If your trial or subscription ends | Nothing is deleted. Your account becomes read-only: you can still sign in, look at your content, download it and delete your account, but cannot save anything new or run sessions. It stays that way until you choose a plan or delete the account. |
| Proof you agreed to the terms | Until you delete your account. |
You can ask us to: give you a copy of your information; correct it; delete it; restrict or stop using it; and move it elsewhere. You can object to our use of it where we rely on legitimate interests. Facilitators can download a copy of everything they saved, and delete their account, themselves: Admin, then “Your account”. For anything else, write to . We will reply within one month.
If you are a learner, ask your facilitator first; they decide what is kept. If you are not happy with how we handled your request, you can complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint, 0303 123 1113.
CourseDeck keeps your sign-in and a few choices (for example which session you have open) in your browser’s own storage so you stay signed in; they are removed when you sign out or close the tab. We do not set advertising or analytics cookies. The sign-in page is run by Amazon Cognito and the bot check by Cloudflare; each may set cookies it needs to work on its own pages.
Accounts are for adults who run training. Learners may include people under 18, and the facilitator is responsible for having a proper basis to use CourseDeck with them and for telling them how their information is used. We collect only a name or nickname for a learner and never ask for contact details.
Information is encrypted in transit and at rest, and stored in private AWS storage. Each account’s content is kept separate from every other account’s, and we test for that. No system is perfectly secure. If a breach puts people at risk, we will tell the people affected and the ICO as the law requires.
If we change this notice in a way that matters, we will update the date above and ask facilitators to agree again. Earlier versions are available on request.
, . Email . To report content or behaviour on CourseDeck, use the report form. See also the terms of use.
Last updated . This explains what CourseDeck does with personal information when an organisation uses it for training. It is written to be read, so if anything is unclear, ask: .
CourseDeck is run by (“we”). We are registered with the Information Commissioner’s Office (ICO), registration number .
When an organisation uses CourseDeck, there are two roles:
We are a controller only for a small amount of information we need for ourselves: the contact details of the organisation’s administrators (to run the arrangement, send notices and deal with billing) and operating and security records needed to keep the service safe.
| Information | Why | Whose decision / basis (UK GDPR) |
|---|---|---|
| Facilitators and administrators: name, email address, role. Passwords are handled by Amazon Cognito; we never see them. | To create accounts, sign people in and send account emails. | The organisation’s (usually legitimate interests or the employment or training relationship). We process on its instructions. |
| Facilitators: what they save: quizzes, questions, activities, pictures, slide decks, files, courses and session settings. | To store it and run it in sessions. | The organisation’s. We process on its instructions. |
| Learners: the name or nickname they join with, answers, scores and choices in activities, chat messages, hands-up and help requests, and the optional “about me” line in online sessions. | To run the session and show results to the facilitator. | The organisation’s. We process on its instructions. |
| Administrators: contact and billing details if the organisation pays after the evaluation period. | To run the arrangement, invoice and send notices. | Ours: contract and legitimate interests. |
| Everyone: the technical records that web services necessarily produce (for example the address a request came from and error records), and alarms about errors. | To run and secure the service. | Ours: legitimate interests (keeping the service safe). |
We do not use advertising or analytics trackers, we do not sell personal information, and we do not make decisions about people by automated means.
Learners can enter anything in an answer or chat message, so facilitators should tell them not to share sensitive personal information in a session. We do not ask for anything of that kind.
We disclose information to others only if the organisation tells us to, the law requires it, or it is needed to protect people from serious harm.
The organisation controls how long its content is kept. These are the standard settings; they can be changed for a deployment, and we will tell the organisation what applies to it.
| What | How long |
|---|---|
| The organisation’s content (quizzes, activities, files, courses) and its users’ accounts | Until the organisation removes them, or the arrangement ends and the deployment is deleted. |
| What learners enter in a session | It expires by itself about 17 days after it was saved (the database can take a couple of days longer to clear it). |
| Saved quiz results (only if the facilitator chooses to keep them) | [180] days by default, then deleted automatically. |
| Saved chat transcripts (only if the facilitator saves one) | [365] days by default, then deleted automatically. |
| Pictures and clips made by AI-based activities, and saved screenshots | A few days (about 7 and 14 by default), then deleted automatically. |
| Backups | Deleted data can remain in backups for up to 35 days, and is then gone. Backups are used only to recover from a failure. |
| Email sent to us (support and questions) | The copy held on our systems is deleted after 30 days. The messages in our own mailbox are kept only as long as needed to deal with the matter. |
You can ask for a copy of your information, to correct it, to delete it, to restrict or stop its use, and to move it elsewhere, and you can object where the use relies on legitimate interests. If you are a facilitator or a learner, ask your organisation first: it decides what is kept, and we will help it respond. If you write to us, we will pass your request to the organisation and tell you we have done so. For the information we hold as controller (section 1), write to ; we reply within one month.
If you are not happy with how your information has been handled, you can complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint, 0303 123 1113.
CourseDeck keeps your sign-in and a few choices (for example which session you have open) in your browser’s own storage so you stay signed in; they are removed when you sign out or close the tab. We do not set advertising or analytics cookies. The sign-in page is run by Amazon Cognito, which may set cookies it needs to work on its own pages.
Facilitator and administrator accounts are for adults. Learners may include people under 18; the organisation is responsible for having a proper basis to use CourseDeck with them and for telling them how their information is used. We collect only a name or nickname for a learner and never ask for contact details.
Information is encrypted in transit and at rest, and stored in private AWS storage. Each organisation’s deployment is separate from every other organisation’s. Access to production systems is limited to the people who need it, and the service raises alarms on errors and failed backups. No system is perfectly secure. If a breach puts people at risk, we will tell the organisation without undue delay so it can meet its own duties to the ICO and to the people affected.
If we change this notice in a way that matters, we will update the date above and tell the organisation’s administrators. Earlier versions are available on request.
, . Email . See also the service terms and the data processing summary.