Privacy Policy

Data controller

Create-AI Ltd, England and Wales. For all data protection enquiries: info@courseagent.ai

1. Data we collect

1.1 Account information

When you create a CourseAgent account, we collect:

• Name (first and last)
• Email address
• Organisation or company name (if provided)
• Job title (if provided)
• Password (stored as a cryptographic hash - we never store passwords in plain text)
• Billing information (processed by Stripe - see section 5)

1.2 Content you create

We store the content you create and upload using the Platform, including:

• Course titles, descriptions, section content and learning objectives
• Quiz questions, answers and assessment configurations
• Images, documents, PDFs and other media you upload
• AI prompts and instructions you submit
• Course review comments and feedback

1.3 Learner data (Academy users)

If you use the Academy LMS feature, we also process personal data about your learners on your behalf. In this context, you are the data controller for your learners' data and we act as a data processor. This includes:

• Learner name and email address
• Course enrolment and completion records
• Assessment scores and attempt history
• CPD and learning record entries
• Any custom profile fields you configure

1.4 Usage and technical data

We automatically collect technical data about how you use the Platform:

• Log data: IP address, browser type, device type, operating system
• Usage patterns: features accessed, pages viewed, time spent on the Platform
• Performance data: errors encountered, page load times, feature interactions
• Analytics data: aggregated and anonymised usage statistics via our analytics provider

2. How we use your data

2.1 Providing and improving the Platform

• Creating and managing your account
• Processing your subscription and payments
• Delivering the AI course generation, Academy LMS and other Platform features
• Identifying and fixing bugs and performance issues
• Developing and improving Platform features

2.2 Communications

• Sending transactional emails (account confirmations, password resets, billing notifications)
• Sending service announcements and security notices
• With your consent: sending product updates, newsletters and marketing communications

2.3 Analytics and research

We analyse anonymised and aggregated usage data to understand how the Platform is used, identify popular features, measure performance and make product development decisions. We use privacy-focused analytics that do not track individual users across sites.

2.4 Legal compliance and security

• Detecting and preventing fraud, abuse and security threats
• Complying with legal obligations
• Enforcing our Terms of Service
• Maintaining financial records as required by UK law

3. AI training and content processing

3.1 How AI features process your content

When you use AI-powered features on the Platform, your prompts and uploaded content are sent to our AI infrastructure for processing. This includes:

• Course generation from briefs, documents or URLs
• AI Compare & Update processing
• Course quality audit analysis
• Translation and adaptation requests
• Audio narration generation

AI processing is performed by Google Cloud Vertex AI (using Gemini models) and, for audio narration, by ElevenLabs. Both providers process your content to generate the requested output and return it to the Platform.

3.2 AI training - our position

Create-AI Ltd does not use your course content or personal data to train its own AI models without your explicit consent.

Our AI providers (Google Cloud Vertex AI and ElevenLabs) have their own data processing terms. Under our agreements with these providers, customer data submitted via API is not used to train their foundation models by default.

3.3 Opting out of AI features

If you do not wish your content to be processed by third-party AI providers, you should not use AI-powered features on the Platform. Non-AI features (editing, publishing, Academy management) are not affected.

4. Legal basis for processing (UK GDPR)

5. Data sharing and third-party processors

We share your data with the following third-party service providers, each of whom acts as a data processor under our instructions and has agreed to appropriate data protection terms:

We do not sell your personal data to third parties. We do not share your data with third parties for their own marketing purposes.

5.1 Legal disclosures

We may disclose your data if required to do so by law, court order or to protect the rights, property or safety of Create-AI Ltd, our users or the public.

5.2 Business transfers

If Create-AI Ltd is subject to a merger, acquisition or sale of assets, your personal data may be transferred to the acquiring entity. We will provide notice before your data is transferred and becomes subject to a different privacy policy.

6. Data retention and deletion

6.1 Active accounts

We retain your personal data for as long as your account is active and for a reasonable period thereafter to allow for account reinstatement or to comply with legal obligations.

6.2 Account inactivity

To comply with the UK GDPR storage limitation principle, we implement the following account lifecycle policy:

• 12 months inactivity: A dormancy warning is sent to the registered account email address
• 23 months inactivity: A final deletion warning is sent with 30 days to respond
• 24 months inactivity: The account and all associated data are permanently deleted

You can prevent deletion at any time by logging into your account. Contact info@courseagent.ai if you need to arrange extended retention.

6.3 Specific retention periods

6.4 Deletion requests

You may request deletion of your account and personal data by emailing info@courseagent.ai. We will action deletion requests within 30 days. Some data may be retained beyond this period where required by law (for example, financial records).

7. Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encrypted connections (HTTPS/TLS) for all data in transit
• Encryption of data at rest
• Password hashing using industry-standard algorithms
• Access controls and role-based permissions
• Multi-factor authentication options for account holders
• Regular security updates and vulnerability monitoring

No method of transmission or storage is 100% secure. While we take security seriously and work continuously to protect your data, we cannot guarantee absolute security.

7.1 Security incidents

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware, as required by UK GDPR. Where the breach is likely to result in a high risk to you personally, we will also notify you directly without undue delay.

8. International data transfers

Create-AI Ltd is based in the United Kingdom. Some of our third-party service providers are based in or operate from the United States. Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the UK ICO
• Adequacy decisions where applicable
• Provider-specific data processing agreements

9. Cookies and tracking

We use the following types of cookies and similar technologies:

• Essential cookies: Required for Platform authentication and security. These cannot be disabled.
• Analytics: We use Plausible or Fathom Analytics, which are privacy-focused tools that do not use cookies and do not track users across sites. No personal data is collected for analytics purposes.

Because we use cookieless analytics, we do not display a cookie consent banner for analytics purposes. You can manage cookie preferences through your browser settings. Disabling essential cookies will prevent the Platform from functioning correctly.

See our Cookie Policy for full details.

10. Your rights under UK GDPR

If you are based in the UK or European Economic Area, you have the following rights regarding your personal data:

• Right of access: Request a copy of the personal data we hold about you
• Right to rectification: Request correction of inaccurate or incomplete data
• Right to erasure: Request deletion of your personal data, subject to legal retention requirements
• Right to restrict processing: Request that we limit how we use your data in certain circumstances
• Right to data portability: Receive your data in a structured, machine-readable format
• Right to object: Object to processing based on legitimate interests
• Right to withdraw consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at info@courseagent.ai. We will respond within one calendar month. There is no charge for exercising your rights unless requests are manifestly unfounded or excessive.

11. Children's privacy

The CourseAgent Platform is intended for use by individuals aged 18 and over. We do not knowingly collect personal data from children under 18. If you believe a child has provided personal data to us, please contact info@courseagent.ai and we will take steps to delete it promptly.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email and by posting a notice on the Platform at least 14 days before the changes take effect. The updated policy will show the new effective date at the top of this page. Continued use of the Platform after changes take effect constitutes acceptance of the updated policy.

13. Contact and complaints

For any questions about this Privacy Policy or how we handle your personal data:

Right to complain

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):

We would appreciate the opportunity to address your concerns before you contact the ICO - please contact us first at info@courseagent.ai.