Privacy Policy

What we collect, why we collect it, who else sees it, and what you can ask us to do about it. This is the policy for Ekati's own services, on the website and in the mobile app alike. A school running its own site through Ekati publishes its own policy for its own site.

1. In short

We collect what the platform needs to work: who you are, what you enrol in, what you have done, and enough about how you use it to keep it running and to improve it.

Your account is one account. Using the app instead of the website does not give you a separate identity and a separate copy of your data — it is the same data, reached a different way.

We do not sell your personal data, and we do not share it for anyone else's advertising. Where a school runs a course, the school is the one deciding what it collects about its own learners — and that is explained in the school's own policy.

2. What we collect

Only what serves a purpose described in this policy.

Account details you give us: name, email address, phone number, and a profile photo if you choose to add one.
Institution details you or your school give us, such as the school a learner belongs to and their class or group.
Learning activity: which courses you are enrolled in, the lessons you open, your exercises and assessments, and the results behind any certificate.
Orders and payments: which course you bought, from whom, at what price, and the status of the payment. Card details go to our payment providers, not to us.
Technical data: your IP address, the browser or app version you used, the device you used it on, pages you visited and the approximate time.
Analytics: aggregate page views and the actions you take on a page or in the app — searching, adding to a basket, completing a form — so we can see which parts of Ekati are used and which are broken.
Communications: messages you send us, and support conversations about your account or your order.

3. The mobile app

The app is a client of the same platform. It collects what the features you use need, and nothing else.

When you allow notifications, your device gives us a push token — an identifier for that device, not for you. It is what lets a message reach your phone. Removing the app or revoking notifications stops us using it.

The app stores your session on your device so you stay signed in, and it may cache course material so you can open it without a connection. That local copy stays on your device until you clear it or delete the app.

Push token: kept so we can deliver notifications to that device. It is not linked to any other device and we do not use it for advertising.
App version and device model: kept so we can tell which versions crash, and so we can tell you when the one you are using is no longer supported.
Permissions you decline: we are not told about them. A declined camera permission simply means the scanning feature is unavailable.
Crash reports: kept only for as long as it takes to identify and fix the fault.

4. Why we are allowed to use it

Under data protection law we need a lawful reason for every use. We rely on three: performing the contract you are party to, our legitimate interest in running and improving a service people depend on, and your consent where we ask for it.

To run your account, deliver your courses and take your payment — performing our contract with you.
To keep the platform secure, fix faults and understand which features are used — our legitimate interest, balanced against your privacy.
To send marketing about courses you may want — your consent, which you can withdraw at any time.
To send you notifications about your own classes and results — the contract we have with you to run the course.
To meet a legal obligation, such as tax or accounting records, and to defend legal claims.

5. Who else sees your data

Your school, if you are one of its learners: your enrolment, activity and results. A school sees its own learners, and no other school's.
Your parent or guardian, if you are a minor account: your activity and progress.
The seller of a course you buy, for the seller named on that course, so it can deliver what it sold you.
Our processors, who host the platform, send email, deliver push notifications and take payments. They act on our instructions and may not use your data for their own purposes.
The app stores, Google Play and the Apple App Store see the transactions and the device involved in installing the app, under their own policies. They are not given anything about your courses.
Nobody else. We do not sell your data and we do not build advertising audiences for third parties.

6. Analytics and cookies

We use Google Analytics 4 and the Meta (Facebook) pixel to understand which pages and actions people use. These record things like the page you looked at, what you clicked and what you searched for — not your name, your email address or what you wrote.

Analytics on our public marketing site and on the login pages can be used before you sign in. Analytics inside the portal and the back office are only loaded once you are signed in, so we are not profiling anonymous visitors inside a logged-in area.

Where analytics identifies you, we send Meta a hashed identifier rather than your email address, so a Meta administrator reading our events cannot recover your email from them.

7. How long we keep it

For as long as your account is open, and afterwards only as long as we have a reason to keep it.

Account and learning data: for the life of the account, so your progress and certificates remain available.
Order and payment records: for as long as tax and accounting law requires us to keep them.
Support correspondence: for a few years after the conversation, so we can answer a question about an old order.
Security logs: a short, defined period, unless they are needed for an investigation.
Crash reports and app versions: a few releases, until the fault they describe is fixed.
Push tokens: until you remove the app, revoke notifications, or close your account.
Analytics: kept in identifiable form only as long as needed; aggregated reports keep no individual.

8. Children's data

Ekati is used by schools, so we do process data about children — and we treat that as the most sensitive data we hold.

A learner below the age at which they can legally consent is normally added by a parent, a guardian or their school, and we collect only what that learner needs to follow their course. We do not run behavioural advertising against children, we do not profile them, and we do not knowingly collect data from a child who has not been added by an adult.

If you believe a child has given us data without a valid basis, contact us and we will delete it.

9. Your rights

You can ask us about the data we hold on you, and ask us to change or delete it. Most of this you can do yourself, and where you cannot, write to us and we will do it.

Deleting your data has its own page and its own process, because it is the right most people care about most: see the data deletion policy. It works the same whether you learned on the website, in the app, or both.

Access — a copy of the data we hold about you.
Correction — fix anything wrong or incomplete.
Deletion — remove your account and its personal data, where we are not required to keep it.
Portability — receive your learning history in a machine-readable file.
Objection or restriction — tell us to stop a particular use, and we will consider it.
Withdraw consent — at any time, by unsubscribing, turning off notifications or writing to us. This does not affect anything we did before you withdrew it.
Complain — to your data protection authority. We would rather you told us first, but you are not required to.

10. Security

We encrypt data in transit, protect the database and administration areas with access controls, and keep audit logs of who did what. No system is perfect, and no provider will claim otherwise; what we commit to is that a breach affecting your data will be investigated promptly and told to you and to the regulator as the law requires.

11. International transfers

Ekati is operated from outside every country where it is used, and some of our processors are too. Where your data leaves your country, we use recognised safeguards such as standard contractual clauses, and we keep the transfer limited to what the service needs.

12. Changes to this policy

We will update this policy when what we do changes. When a change materially affects your rights we will tell you before it takes effect, and the revision date at the top of this page always reflects the current version.