Privacy Statement

• Account data: your email address and display name, provided by your chosen sign-in provider (Microsoft Entra External ID or Google). We never receive or store your password - authentication happens entirely with your identity provider.
• Learning data: which lessons you’ve completed, your quiz and assessment scores and attempt history, and any certificates issued to you.
• Billing data: your subscription plan and status. Full payment card details are collected and processed entirely by Stripe and never reach our servers.
• Odyssey program applications: the name, email, and motivation statement you submit if you apply, kept only for reviewing applications.
• Usage and cookie data: an essential session cookie that keeps you signed in, plus standard technical logs (IP address, browser type, pages visited). We don’t currently run an analytics or email/notification tool; if we add one, we’ll name it here and note the date, before it goes live.

• To provide the Service - creating your account, tracking your progress, issuing certificates, and billing your subscription (contractual necessity).
• To keep the Service secure and working - technical logs, abuse prevention (legitimate interest).
• To meet legal obligations - such as retaining billing records for tax purposes.
• With your consent - for anything not covered above, such as optional analytics, if and when we introduce it.

We share data only with the processors that help us run the Service:

• Microsoft (Entra External ID sign-in, and Azure hosting/database),
• Google (sign-in),
• Stripe (payment processing).

We don’t sell your personal data, and we don’t share it with anyone else for their own marketing purposes.

Our hosting and database are in the EU (Azure West Europe), so most of your data stays in the EEA. Microsoft, Google, and Stripe are global companies that may process data outside the EEA as part of running their services; where they do, they rely on their own Standard Contractual Clauses or equivalent safeguards.

We keep your account and learning data for as long as your account is active. If you delete your account, we delete or anonymize your personal data within a reasonable period, except where we’re required to retain billing records for tax or legal purposes.

Under the GDPR, you can ask us to access, correct, delete, or export your personal data, restrict or object to certain processing, and withdraw consent at any time. To exercise any of these, email privacy@oncloudlearning.com. You can also lodge a complaint with Portugal’s supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), or your own local data protection authority.

The Service isn’t directed at children under 16, and we don’t knowingly collect personal data from them.

We use reasonable technical and organizational measures to protect your data, including encrypted transport and least-privilege access to production systems. No online service can be perfectly secure, but we work to keep what we hold to the minimum needed to run the Service - for example, by never handling your password or full card number at all.

We may update this Privacy Statement from time to time; we’ll update the “Last updated” date above when we do, and name any new processor (like an email or analytics tool) before it starts handling your data.

Questions about this Privacy Statement or your data? Reach us at privacy@oncloudlearning.com.