Privacy Policy

Education Labs AI (“Education Labs AI”, “we”, “us”) operates the Education Labs AI platform from the State of Florida, United States. This policy explains what personal data we collect about you, why we collect it, who we share it with, how long we keep it, and the rights you can exercise over it.

For the purposes of the EU General Data Protection Regulation (“GDPR”) and the UK GDPR, Education Labs AI is the controller of the personal data described in this policy. For the purposes of US state privacy laws, we are the business that determines the purposes and means of processing.

This policy applies to the Education Labs AI website and services. It does not apply to third-party websites or services we link to, which have their own privacy policies.

Contact us about anything in this policy at support@educationlabsai.com. To help us route your message, use the subject line “PRIVACY REQUEST”.

Data you give us.

• Account data — your name, email address and a securely hashed password. We never store your password in readable form. If you sign in with a third-party provider, we receive your name, email address and provider account identifier, but never your password with that provider.
• Profile data — anything you choose to add, such as a display name, biography, avatar, and for instructors a headline, subjects taught and payout email address.
• Purchase data — the courses and sessions you buy, order and payment status, amounts, currency and the transaction reference from our payment provider. We do not receive or store your full card number, expiry date, security code or bank credentials.
• Learning data — enrolments, lessons started and completed, progress percentages, quiz attempts and the answers you selected, scores, and certificates issued.
• Content you post — course reviews and ratings, questions, and messages you send to instructors or support.
• Booking data — tutoring sessions you book, the tutor, the scheduled time, and the associated video meeting details.
• Communications — the content of emails and support requests, and your newsletter subscription status.

Data we collect automatically.

• Technical and log data — IP address, browser and device type, operating system, referring page, pages viewed, and the date and time of requests. This is generated by our servers and infrastructure providers in the ordinary course of delivering and securing the service.
• Session data — an authentication cookie that keeps you signed in, and security signals used to detect automated abuse. See our Cookie Policy.
• Video playback data — our video provider records playback events such as views and buffering in order to stream content and report aggregate performance.

Sensitive data. We do not ask for, and you should not send us, special category or sensitive personal data — such as health, biometric, genetic, racial or ethnic origin, religious beliefs, sexual orientation, trade union membership, or government identifiers — unless we specifically request it to provide an accessibility adjustment you have asked for, in which case we process it with your explicit consent and delete it when it is no longer needed.

Where the GDPR or UK GDPR applies, we must have a legal basis for each use of your personal data. The table below sets out what we do and why.

Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights and freedoms, and you may object at any time — see Section 12.

Quizzes on Education Labs AI are graded automatically by comparing the options you select against the answer key set by the instructor. Course progress percentages and eligibility for a certificate of completion are likewise calculated automatically from the lessons you have completed.

These processes are simple, rule-based calculations. They do not profile you, and they produce no legal or similarly significant effect within the meaning of Article 22 of the GDPR — a quiz score on this platform is not a formal qualification and does not determine any entitlement. If you believe a score or a progress calculation is wrong, contact support@educationlabsai.com and a person will review it.

The following are also visible to other people:

• Course reviews and ratings, shown publicly with your display name.
• Instructor profiles — for approved instructors, the name, headline, biography, subjects and course list are public.
• Your first name or display name is visible to a tutor when you book a session with them, and to instructors of courses you enrol in.

If you would prefer a less identifying display name, you can change it in your account settings; this updates how you appear going forward, including on certificates issued afterwards.

We do not sell your personal data. We share it only as described here:

• Service providers (processors) who process data on our instructions and under contract, listed below.
• Instructors and tutors — limited data needed to teach you, such as your display name, enrolment and, for a booked session, the scheduled time. Instructors are contractually required to use it only to deliver teaching and support.
• Professional advisers — lawyers, accountants and auditors, under a duty of confidence.
• Authorities — where we are required by law, court order or a valid legal request, or to establish or defend legal claims. We assess each request and disclose only what is necessary.
• Safeguarding disclosures — where we reasonably believe a child is at risk of harm, we may disclose relevant information to a parent, guardian or an appropriate authority.
• A successor — if we are involved in a merger, acquisition, financing or sale of assets, data may transfer to the counterparty, who will remain bound by this policy or give notice of any change.

Our service providers

We do not sell your personal data, and we do not share it for cross-context behavioural advertising or targeted advertising, as those terms are defined under the California Consumer Privacy Act as amended by the CPRA, the Florida Digital Bill of Rights and comparable US state laws. We have not done so in the preceding twelve months, including for personal data of consumers we know to be under 16. We do not use your personal data to train artificial intelligence models, and we do not permit our service providers to do so.

We use only strictly necessary cookies and local storage — to keep you signed in, to protect forms against cross-site request forgery and automated abuse, and to remember interface preferences. We do not use advertising or third-party analytics cookies. Full details, including names and durations, are in our Cookie Policy.

We keep personal data only as long as necessary for the purposes it was collected for, and to meet our legal, accounting and reporting obligations.

We apply technical and organisational measures appropriate to the risk, including:

• encryption of traffic in transit using HTTPS, with HTTP Strict Transport Security enforced;
• passwords stored only as salted bcrypt hashes, never in readable form;
• a Content Security Policy, clickjacking protection and other security headers;
• server-side sanitisation of user-submitted content to prevent script injection;
• rate limiting and bot protection on authentication and other sensitive endpoints;
• role-based access control, so staff and instructors see only what their role requires;
• no storage of card or bank details on our systems — payment data stays with our payment provider.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours where required, and will notify you without undue delay where the law requires it.

We are based in the United States, and our service providers may process data in the United States and other countries. If you are in the UK, the European Economic Area or Switzerland, your personal data will be transferred outside your country to a jurisdiction that may not provide the same level of protection.

Where we make such a transfer, we rely on an appropriate safeguard under Chapter V of the GDPR — normally the European Commission’s Standard Contractual Clauses, together with the UK International Data Transfer Addendum issued by the Information Commissioner’s Office for UK transfers, and we carry out a transfer risk assessment and apply supplementary measures where needed. You can request a copy of the relevant safeguards by emailing support@educationlabsai.com.

If the GDPR or UK GDPR applies to you, you have the right to:

• Access — obtain confirmation of whether we process your data and a copy of it.
• Rectification — have inaccurate data corrected and incomplete data completed.
• Erasure — ask us to delete your data where one of the grounds in Article 17 applies.
• Restriction — ask us to limit processing in defined circumstances.
• Portability — receive data you gave us in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible.
• Object — object to processing based on legitimate interests, and object at any time and absolutely to processing for direct marketing.
• Withdraw consent — where we rely on consent, withdraw it at any time, without affecting the lawfulness of processing before withdrawal.
• Not be subject to automated decisions producing legal or similarly significant effects — see Section 4.

To exercise a right, email support@educationlabsai.com. We respond within one month, extendable by two further months for complex requests, and we will tell you if we need the extension. We do not charge a fee unless a request is manifestly unfounded or excessive.

You can also complain to your data protection authority. In the UK that is the Information Commissioner’s Office (ico.org.uk); in the EEA it is the supervisory authority of your country of residence, place of work or the place of the alleged infringement. We would appreciate the chance to address your concern first.

Florida — Florida Digital Bill of Rights

If you are a Florida resident and the Florida Digital Bill of Rights applies, you have the right to confirm whether we process your personal data and to access it, to correct inaccuracies, to delete it, to obtain a portable copy, and to opt out of targeted advertising, the sale of personal data, and profiling with legal or similarly significant effects. As stated in Section 7, we do not sell personal data, engage in targeted advertising, or carry out such profiling.

California — CCPA as amended by the CPRA

If you are a California resident you have the right to know the categories and specific pieces of personal information we have collected, the sources, the business purposes and the categories of third parties involved; to delete personal information; to correct inaccurate personal information; to opt out of sale or sharing (we do neither); to limit the use of sensitive personal information (we do not collect it for the purposes that trigger this right); and not to be discriminated against for exercising any of these rights. We do not offer financial incentives for personal information.

The categories of personal information we have collected in the last twelve months are: identifiers (name, email, IP address, account identifiers); commercial information (purchases); internet or network activity (usage and log data); and inferences limited to course progress. We disclose these categories to the service providers listed in Section 6 for the business purposes in Section 3.

Other US states

Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana and other states with comprehensive privacy laws have comparable rights of access, correction, deletion, portability and opt-out, and in several states a right to appeal a refused request. If we decline your request, we will tell you why and how to appeal; if an appeal is denied you may contact your state Attorney General.

How to exercise these rights

Email support@educationlabsai.com with the subject line “PRIVACY REQUEST”. We will verify your identity by matching your request against the email address on your account, and may ask for additional information for sensitive requests. We respond within 45 days, extendable once where reasonably necessary. An authorised agent may submit a request on your behalf with written proof of authorisation, and we may still ask you to verify your identity directly.

The Services are not directed to children under 13 and we do not knowingly collect their personal data. Learners aged 13 to 17 may use the Services only with the consent of a parent or guardian, who may access, correct or delete their child’s data and withdraw consent at any time. Our full approach, including safeguarding during tutoring sessions, is set out in the Children’s Privacy & Safeguarding Policy. If you believe a child under 13 has given us personal data, contact support@educationlabsai.com and we will delete it promptly.

We send the newsletter only to people who have asked for it. Every marketing email includes a one-click unsubscribe link, and you can also email support@educationlabsai.com to opt out. Unsubscribing stops marketing email but not service messages such as receipts, booking confirmations, security alerts and policy updates, which are necessary to provide the Services.

There is no common industry standard for responding to browser “Do Not Track” signals, so we do not respond to them. Because we do not sell or share personal data for advertising, there is nothing for a Global Privacy Control signal to opt you out of; we honour it as a valid opt-out request where a state law requires it.

We may update this policy as the Services change or the law develops. The “Last updated” date at the top of this page shows the current version. If a change materially affects how we use your personal data, we will give notice — by email to the address on your account or by a prominent notice on the Services — before it takes effect, and where required we will ask for your consent.

For any privacy question or to exercise a right, email support@educationlabsai.com with the subject line “PRIVACY REQUEST”. We have not appointed a Data Protection Officer, as we are not required to; privacy enquiries are handled directly by Education Labs AI.