Privacy Policy

1. About this policy

This Privacy Policy explains how Coursivo Education Lab Ltd (“Coursivo”, “we”, “us”) collects, uses, shares, and protects personal data when you visit coursivo.xyz, create an account, or enrol in a programme. It applies alongside our Terms of Service, Cookie Policy, and GDPR Policy.

2. Who we are (data controller)

Coursivo Education Lab Ltd is a private limited company registered in England and Wales (Company No. 17099303), with registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. We are the data controller for personal data described in this policy.

Privacy enquiries: legal@coursivo.xyz.

3. Personal data we collect

• Account details - name, email address, password hash, and any profile information you choose to provide.
• Programme data - enrolment records, submitted artifacts, mentor notes, attendance, certificates.
• Billing data - invoice number, amount, currency, programme purchased, country of residence, and a tokenised reference from our payment processor. We do not collect or store full card numbers.
• Communications - email correspondence with support@, billing@, legal@, and contact-form submissions.
• Technical data - IP address, user agent, device and browser metadata, security identifiers used to protect the service from abuse.
• Server logs - basic access logs (request path, response code, IP address, user agent) kept for security, debugging, and abuse prevention.
• Analytics data - aggregated visit and interaction data collected through Google Analytics and Microsoft Clarity, only when you consent through the cookie banner. See our Cookie Policy for the specific cookies used.

4. How we use your personal data

• To create and manage your account and programme enrolment.
• To deliver mentoring, group sessions, and review artifacts.
• To process payments, issue invoices, and meet our tax and accounting duties.
• To communicate with you about programme logistics, changes, and support.
• To secure the service against fraud, abuse, and unauthorised access.
• To comply with legal obligations and to defend legal claims where necessary.

5. Legal bases for processing

Under Article 6 of the UK GDPR, we rely on the following lawful bases:

• Contract - to perform our agreement with you (account, programme delivery, billing).
• Legitimate interests - to operate the service securely, prevent abuse, and improve programmes. Where we rely on legitimate interests, we balance them against your rights.
• Consent - for non-essential cookies and for any optional marketing emails you opt into. You can withdraw consent at any time.
• Legal obligation - to retain billing and accounting records and to respond to lawful requests from authorities.

6. How we share your data (processors)

We use a small set of vetted processors who act on our written instructions and are bound by data-protection terms. Current processors:

• Gumroad, Inc. (United States) - payment processing, merchant of record. Gumroad collects card and billing data directly; we receive a confirmed sale record without card numbers.
• Supabase, Inc. (EU region) - authentication and database hosting for account and programme records.
• Vercel, Inc. (United States / EU edge) - application hosting and edge delivery.
• Resend, Inc. (United States) - transactional email delivery from no-reply@coursivo.xyz.
• Cloudflare, Inc. (global) - DNS, inbound email routing for support@, billing@, legal@, business@coursivo.xyz.
• Google LLC (United States) - Google Analytics 4 for aggregated web analytics, only loaded when you grant analytics consent. We enable IP anonymisation.
• Microsoft Corporation (United States) - Microsoft Clarity for aggregated user behaviour insights and session replay, only loaded when you grant analytics consent.

We do not sell personal data and we do not share it with third parties for advertising. We may disclose data where required by law, by court order, or to protect the rights and safety of Coursivo, our learners, and the public.

7. International data transfers

Some of our processors are based outside the United Kingdom. Where personal data is transferred outside the UK, we rely on UK adequacy regulations or the UK International Data Transfer Agreement / UK Addendum to the EU Standard Contractual Clauses, together with supplementary safeguards as appropriate. A current list of transfers and copies of applicable safeguards are available on request to legal@coursivo.xyz.

8. Data retention

• Account and programme data - for as long as your account is active, plus 24 months after closure.
• Billing and tax records - six (6) years from the end of the relevant accounting period, as required by HMRC.
• Email correspondence - up to 24 months from the last exchange.
• Security logs - up to 90 days, then deleted or anonymised.

We may keep data longer where the law requires it, or where we need it to defend a legal claim.

9. Your rights

Subject to UK GDPR conditions, you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have data erased where there is no compelling reason to keep it;
• restrict or object to certain processing;
• receive a portable copy of data you provided to us;
• withdraw any consent you have given us at any time.

To exercise any of these rights, write to legal@coursivo.xyz. We will respond within one calendar month and may ask for proof of identity before acting.

10. Security

We apply technical and organisational measures appropriate to the risk, including encryption in transit, access controls, hardened authentication, audit logging, and least-privilege access for staff and contractors. No system is perfectly secure, and we cannot guarantee absolute security of data transmitted online.

11. Children

Coursivo programmes are designed for adults. We do not knowingly collect personal data from anyone under sixteen (16). If you believe a child has provided personal data to us, please contact legal@coursivo.xyz and we will delete it.

12. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top of this page reflects the most recent change. Material changes will be communicated by email to active account holders at least fourteen (14) days before they take effect.

13. Contact and complaints

If you have any question or concern, write to legal@coursivo.xyz. If you are not satisfied with our response, you have the right to complain to the UK Information Commissioner’s Office at ico.org.uk or by calling 0303 123 1113.