Privacy Policy · Coursentials

1. Who this policy covers

Coursentials (“we”, “us”) provides Coursentials. The data we handle falls into two groups, and our role is different for each:

Customer and account data. Information about the people who sign up, author, review and administer courses. For this data we are the controller.
Learner data. Information about people who take a course that one of our customers publishes — through a share link, an embed, or their organisation’s learning management system (LMS). For this data the customer that published the course is the controller and we act as its processor, under our Data Processing Addendum. If you are a learner, the organisation that gave you the course is the best first contact for questions about your data.

2. What we collect

When you create and use an account

Your name, email address, password (stored only as a one-way hash) and, if you use single sign-on, the identity details your provider shares with us.
Your workspace (organisation) name, members, roles and plan.
Preferences you set, such as editor colours, language and email preferences.
Billing details: plan, invoices and payment status. Card and bank details are entered with and held by our payment processor; we do not store full card numbers.

The content you create or upload

Source material you provide: documents, pasted text, outlines, images, audio and video files.
Courses and everything in them: scripts, narration, scenes, lessons, questions, rubrics, personas and settings.
Content we generate for you with AI, such as drafts, images, narration audio and transcripts.
Version history of your content, so you can restore earlier versions.

Your content may itself contain personal data (for example, a recording of your voice, or a case study naming real people). Please only upload personal data you are entitled to use.

When a learner takes a course

Identifiers passed to us by the customer’s LMS or launch link — for example a learner ID, name and email sent over LTI, SCORM, xAPI or cmi5 — or, for anonymous share links, a random identifier stored in the learner’s browser.
Progress, completion, scores, answers, written responses and time spent.
For spoken answers in labs and practice conversations: the voice recording, its transcript, and measurements derived from it (such as speaking pace, pauses and filler words) used to give feedback on delivery.
Conversation transcripts with AI-played characters, and any feedback or reviewer notes on an attempt.
Some reading-course features (such as highlights, notes and resume position) are kept only in the learner’s own browser storage and are not sent to us.

When you use the service

Technical data: IP address, browser and device type, pages and features used, and timestamps.
Error reports that help us find and fix problems.
Records of AI requests made on your behalf (what was sent and returned), used to troubleshoot and improve quality, and usage records used to meter AI credits and minutes.

When you contact us

Messages you send to support, feedback and bug reports, beta-programme check-ins and survey answers.

3. How we use it

To provide the service: run your account, generate and store your content, publish and deliver courses, and record learner results.
To send results back to your LMS or other systems you connect.
To bill you, apply plan limits and track AI credit and minute usage.
To keep the service secure, prevent abuse and fraud, and enforce our Terms.
To troubleshoot, measure quality and improve the product.
To send service emails (such as sign-in, publishing and billing messages) and, where you have agreed or where the law allows, product updates. You can opt out of non-essential email at any time.
To comply with legal obligations.

We do not sell personal data, and we do not use it for third-party advertising.

4. AI processing

Many features — course generation, narration, image creation, transcription, practice conversations and automated feedback — work by sending the relevant content to AI model providers that process it on our behalf and return a result. We send only what a feature needs. We use providers whose terms do not permit them to use this content to train their models, and we do not use your content or your learners’ data to train AI models of our own.

AI output can be inaccurate. Automated scores and feedback on labs and practice conversations are produced to support learning. Course owners can require a human reviewer to check results before they are released, and learners who disagree with a result should contact the organisation that provided the course.

Text that people type into prompts is treated as content, never as instructions to change how the system behaves, and is screened for misuse.

5. Legal bases (EEA and UK)

Where data-protection law requires a legal basis, we rely on:

Contract — to provide the service you signed up for.
Legitimate interests — to secure, support and improve the service, and to communicate with customers about it, balanced against your rights.
Consent — where we ask for it, for example optional marketing email. You can withdraw consent at any time.
Legal obligation — for tax, accounting and lawful requests.

For learner data, the customer that published the course determines the legal basis.

6. Who we share it with

We share personal data only as needed to run the service, with:

Sub-processors that provide parts of our infrastructure, in these categories: cloud hosting and databases; file storage and content delivery; AI model providers (text, image, speech synthesis, speech recognition and video); email delivery; payment processors; and error monitoring. Some features also send search terms (not personal data) to stock-media libraries.
Systems you connect, such as your LMS, learning record store or single sign-on provider, when you or your organisation set up the connection.
Your organisation — workspace administrators can see the content and activity in their workspace.
Professional advisers, authorities and successors — where required by law, to protect rights and safety, or as part of a merger or acquisition, subject to equivalent protection.

Each sub-processor is bound by a written agreement that limits its use of the data. A current list of sub-processors is available on request from hello@coursentials.com.

7. International transfers

Our providers may process data in countries other than yours. Where data leaves the EEA, UK or another region with transfer rules, we rely on recognised safeguards such as the European Commission’s Standard Contractual Clauses and the UK addendum.

8. How long we keep it

Account and content data: for as long as your account is active. You can delete individual courses at any time.
After an account is closed, we delete its content within 30 days, and it ages out of backups within a further 35 days.
Learner results: for as long as the customer keeps the course and account, or until the customer asks us to delete them.
Records of AI requests: typically 30 days. Earlier versions of content: a limited number of recent versions per course or scene.
Billing and transaction records: as long as tax and accounting law requires.

9. Security

We encrypt data in transit, store passwords as one-way hashes, encrypt stored credentials and keys, separate each customer’s data by workspace, and limit staff access to what is needed. No system is perfectly secure; if a breach affects your personal data we will tell you as the law requires.

10. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to the processing of your personal data, to receive a copy of it, and to withdraw consent. To make a request, email hello@coursentials.com. We may need to verify your identity. If you are a learner, we will pass your request to the organisation that provided the course and help it respond. You can also complain to your local data-protection authority.

If you are a California resident, you have similar rights to know, delete and correct, and we do not sell or share personal information for cross-context behavioural advertising.

11. Cookies and browser storage

We use cookies and browser storage that are needed to sign you in, keep your session secure, remember your preferences, and let learners resume where they left off. We do not use advertising cookies.

12. Children

Accounts are for adults acting for themselves or an organisation. Customers who deliver courses to children are responsible for obtaining any consent the law requires.

13. Changes to this policy

We will post any update here with a new effective date. For material changes we will tell account owners by email at least 30 days before they take effect.

14. Contact

Coursentials, Registered address: TO BE CONFIRMED. Email hello@coursentials.com.