Your learning privacy

Information and purpose

Our sign-in provider supplies an account identifier, email and optional display name. We read that identity to recognise your session. A new non-owner academy profile is saved when enrolment is completed, rather than merely when the studio is opened. Profiles record a display name, age band, role, participation status and dated notice acceptance. Learning records include practice progress, private drafts, short-lesson notes and saved position, self-recorded practice and review dates, submissions, attachments and human feedback. These support teaching, assessment and service administration. Security and role-change events help control access and investigate mistakes.

Children and guardian consent

For ages 15–17, a guardian must contact the owner before registration. The owner verifies identity and authority, explains processing and records informed consent through an agreed private process. The platform stores the learner email, a verification reference, approval dates and whether an invitation was claimed or withdrawn. It does not collect guardian identity documents. A code is bound to the agreed learner email and expires after 14 days. Adult participants confirm their own participation. A learner cannot reactivate a paused profile.

Public learning material needs no account. Sign-in providers process identity under their own policies, including if someone visits their sign-in page directly. Guardians should review provider eligibility and permissions before a child signs in.

Who may access records

Learners see their own records. Private drafts are accessible only to the account that saved them. Administrators manage access and service records; active assigned mentors may view submitted evidence and its attachments, review it and manage eligible certificates. A mentor does not receive a general learner directory or unsubmitted uploads. Reassignment removes the former mentor’s future platform access. Downloaded files cannot be recalled, so mentors must protect and remove local review copies under the handbook.

Certificates and public verification

The private certificate ledger stores the display name at issuance, curriculum scope and version, assessment references, issuer, dates and revocation history. Public verification requires an opaque code and shows award scope, date and validity, not the learner’s name or portfolio. If a visitor enters a name, the checker returns whether it matches. Share a code only when you want someone to verify the record. There is no searchable public learner list.

Coaching enquiry forms

An adult or guardian can enquire without creating a learner account. We store the submitter's name, email, optional phone number, enquiry category, goal, campaign reference, submission time and permission to reply. The owner uses these details to respond and keep private follow-up notes. Do not include a child's name, school, records or other sensitive information. An enquiry does not subscribe you to marketing.

Form records are stored in the academy database and visible only to the owner. Resend sends an owner notification containing the enquiry and a brief acknowledgement to the address provided; Zoho handles support mail and replies. Email delivery records include provider references, attempts and status. Short-lived hashed IP/email counters help prevent abuse; raw IP addresses are not stored by this form. Hosting and email providers may maintain their own security logs.

Parent learning-support enquiries

A parent or guardian may provide a grade band, curriculum, subject and learning question using their own contact details. Do not provide the child’s name, school, grades, diagnosis or private records. These details are used to check suitability and capacity, not to create a child account or subscribe anyone to marketing. Under-15s cannot enrol through this form.

Approved enquiry follow-ups

After a personal response, the owner may approve one relevant reminder while an enquiry remains active. The owner checks the mailbox and calendar first; those services do not automatically synchronise replies here. The reminder includes a stop link and does not enrol you in a campaign. The platform records approval, due time, attempts, provider reference and stop status. Pending reminders stop when the owner records a booking or advances, closes or marks the enquiry as a test. The owner can pause all reminders. Delivery already in progress cannot be recalled. This pilot ends 17 January 2027.

Coaching calendar

Choosing a time opens Google Calendar’s appointment page. Google and the coach receive the adult booker’s name, email, appointment time and preparation answers. Google sends calendar invitations, meeting links and changes under its own privacy terms. Please omit children’s details and private records. Busy event details are not published on EaseBrain. Calendar bookings do not automatically create academy accounts, record payments or update the enquiry inbox. After checking the calendar, the owner may record the appointment status, time and a short confirmation reference against your enquiry. These records support delivery and aggregate conversion reporting; private event details are not published. Contact hello@easebrain.live about changes or deletion, and use the confirmation link to cancel an appointment.

Providers and international processing

Sign-in can use Google, GitHub, an email code delivered by Resend, or the optional ChatGPT/OpenAI identity service. Google sign-in requests only basic identity (name and email), not Gmail, Calendar or Drive access. GitHub requests profile and verified primary email, with no repository access. Provider tokens are used for identity verification and are not retained by EaseBrain. Verifying your inbox can reconnect the learning record associated with that email. We retain a stable account mapping to preserve progress and certificate records. Necessary sign-in cookies are Secure, HttpOnly and SameSite=Lax: the session expires after seven days; email, Google and GitHub challenges expire after ten minutes. The database stores session/code hashes rather than the raw secrets. Expired authentication records are cleaned during sign-in requests. Signing out revokes the local session. Email and IP digests temporarily limit abuse; sign-in never subscribes you to marketing. The Sites hosting service and its Cloudflare database and file-storage infrastructure process academy data to operate the service. Support email uses Zoho, and enquiry notifications use Resend. These providers may process information outside Kenya. The operator must maintain appropriate processor arrangements and safeguards for international transfers; contact us for the applicable arrangements before a facilitated youth cohort begins. Do not treat a website feature as confirmation that all regulatory registrations or contracts are complete.

Optional AI

Free prompt and evaluation activities do not need a paid model. The optional tutor sends a user-supplied API key and question through the academy to OpenAI only after billing consent. The academy does not store the key, question or answer; a daily request count limits use. Response storage is disabled in the request, but the provider’s processing policies still apply. The key owner pays the provider. Never include private learner records. AI does not award mastery or certificates.

Retention and your rights

Except for the limited weekly-email and learning-activity retention described below, records currently remain in the hosted service until the operator removes them. Before a youth cohort begins, the operator must adopt and communicate a documented retention schedule covering inactive accounts, attachments, consent evidence, audit records and certificate verification. A certificate may require a smaller verification record after learning evidence is removed; any continued retention must have a stated purpose and lawful basis.

You or an authorised guardian can request access, correction, a copy, withdrawal, restriction or deletion at hello@easebrain.live. Identify the account and request without sending a password or identity document in an initial message. We may need proportionate verification before changing or releasing records. The owner should explain the result and any lawful retention that prevents complete deletion. Learners can export submitted work and print a progress report from the studio. Withdrawal pauses further participation; it does not by itself erase existing records.

Additional boundaries

The platform has no advertising analytics, facial recognition, personality profiling, public leaderboard or automatic portfolio publication. Promotional use of a learner’s face, name or work needs separate permission. Use fictional or appropriately licensed public project data. Leave out health records, passwords, private messages and photographs of other people without appropriate permission.

Questions or complaints

Contact the operator using the details above. You can also raise a data-protection concern with Kenya’s Office of the Data Protection Commissioner. For urgent safeguarding or safety concerns use an appropriate local emergency or protection service; the academy is not an emergency response service.

Coaching measurement and follow-up

We keep the coaching route and campaign labels submitted with an enquiry, follow-up dates, private notes, client stage and amounts the owner records as received. These support service delivery and show which campaigns bring relevant enquiries. They are accessible only to the authorised owner; a recorded payment does not automatically create a learner account or grant access.

Coaching pages count page loads, form starts and outbound booking clicks. The business readiness explorer counts visible views, lens selections and completed readiness checks without storing the selected lens, answers or business notes. The free project planner counts views, plans prepared and lesson-button clicks, without collecting selected goals, time budgets or text. Events are stored in daily totals by a bounded source, creative and route label. These totals do not contain names, emails, raw IP addresses or persistent visitor identifiers. We do not add analytics cookies, browser-storage identifiers or advertising pixels. Short-lived daily IP digests are used to limit abuse; aggregate counters are retained for up to 90 days and cleaned when activity is recorded. The client respects Do Not Track and Global Privacy Control where available. Counts can include repeat visits and are not a record of unique people.

Transactional emails contain our branding and a plain-text alternative. A coaching enquiry is not marketing-list consent. Mailbox replies are handled through Zoho and do not automatically update the platform follow-up record. Hosting and email providers process technical delivery and security data under their own terms.

Optional weekly learning emails

Adults can separately request our free weekly learning series. We store the email address, chosen learning context, dated consent notice and confirmation, subscription state and delivery references. Confirm your request through your inbox. An enquiry, booking or learning account does not enrol you. Resend sends the emails; Zoho receives replies. The pilot offers up to 13 exercises and ends 17 January 2027. Each email has an unsubscribe link; stopping emails does not affect learning access. We do not use email-open pixels or personalised click tracking in these messages.

Unconfirmed requests expire after 48 hours and are removed by the daily delivery job. Minimal subscription and unsubscribe records are retained during the pilot to honour choices and investigate delivery problems; request deletion at hello@easebrain.live. The owner will review removal within 30 days of the pilot ending. Short-lived hashed address and IP counters limit abuse; the form does not store raw IP addresses.

Public learning challenges

The playground and challenge controls count anonymous visits, twist choices and successful public-link copies using the existing limited aggregate event system. We do not send your prediction, lesson notes, progress or recipient details. A copied link is not evidence that it was shared or opened. Do Not Track and Global Privacy Control are respected. Public links contain only a learning-page address and general referral tags.

Continued-learning measurement

When you save a changed application note of at least 20 characters or complete/review a short practice, we record the account identifier, lesson, calendar day and practice/completion type. These service records help the owner understand whether learners return and improve teaching. They contain no copy of your note, device fingerprint or browsing history and are not matched to newsletter subscribers. The owner sees aggregate return rates and an owner-only learner journey showing registration, practice dates, completed lesson counts, submitted project counts and signed-in support-request counts. Private lesson notes are not shown. Mentors cannot access this dashboard. Anonymous visits, newsletter addresses and public enquiry addresses are not joined to these learner identities. Daily cleanup removes events older than 365 days. Public lesson reading is not attributed to an individual. The measurement starts with this release; we do not reconstruct earlier visits.