What we collect, and why.

What we collect

Grouped by the thing you did, because we keep them separate on purpose and one does not feed another.

• If you join the founding list: your email address, the page you joined from, and the date you consented.
• If you take a course and claim a certificate: the name you want printed on the certificate, your email address, your score and the fact that you passed. The email identifies the certificate if it ever needs reissuing. It does not join you to any mailing list unless you tick the optional box on that form.
• If you buy a course: your email address, what you bought, and the reference of the payment. Payment is handled by Stripe. Card numbers never reach this site and we never hold them.
• If you start a purchase and do not finish: the email address you gave before going to payment, what you were buying, and when you started. Only if you left the box asking us not to remind you unticked; tick it and we keep nothing. We use it to send you one reminder, once, and for nothing else.
• If you sit an exam: the paper you were served, the answers you gave and the result. Papers you start and do not submit are deleted automatically.
• If you submit the capstone: the files you upload, the notes you write with them, and the marks and written feedback of the marker (and of the moderator, if your work is second-marked). Those files are your own work and may describe your employer, so we treat them as the most sensitive thing here.
• If you write to us: your message and our reply, in our mailbox.

If you join the list or buy from a campaign link: we store the campaign labels carried in that link (the utm_ values you can see in the address bar), so we know which work brings people here. When you join the list we also note the site you arrived from, as a domain only, never the full page address. When you buy, the labels travel with your checkout to Stripe and are kept with your purchase record. We read them at the moment you sign up or start a purchase and store nothing at all on your device, which is why there is no cookie banner on this site and why our campaign figures undercount rather than follow you around.

Why (lawful basis)

Consent for marketing email. You are only on the founding list if you asked to be, either through a signup form or by ticking the optional box when claiming a certificate. Every email carries a one-click unsubscribe, and unsubscribing is permanent: we keep a record that you left precisely so that you are not added again by a later import.

Contract for everything else you asked us to do. Issuing a certificate you earned, keeping it verifiable on the public register, marking your capstone, and giving you access to a course you paid for.

Legal obligation for the records of a sale that company and tax law require us to keep.

Legitimate interests for the one reminder after a purchase you started and did not finish: you gave us your address in the course of buying, and most people who stop at payment were stopped by something we can help with. You can refuse it with one tick before you go to payment. It is the only one we send, it is not a mailing list and does not put you on one, and replying "delete" removes your address at once.

We do not use course, exam or purchase records to market to you. The single reminder above is the one exception, and it is about a purchase you had not completed.

How long we keep it

These are the periods the system actually enforces, not intentions. Where nothing expires, this page says so.

Who processes it

Three companies and, for capstone assessment only, one independent person. No others. We do not sell your data, we do not share it for anyone else's marketing, and there is no advertising network, data broker or enrichment service anywhere in this.

• Cloudflare hosts this site and stores the records described above.
• Stripe processes payments. They take the card details directly; we receive the fact of a completed payment and a reference.
• Resend sends and delivers our email.

All three are headquartered in the United States, and your data may be processed outside the United Kingdom. Each processes it only on our instructions, under its own data processing terms.

One person, for capstone assessment only. Capstone appeals are second-marked and decided by an independent external moderator rather than by the original marker, and the moderator may also second-mark failed or sampled submissions. For that case only, the moderator receives your submission, your AI-assistance declaration, the marks and feedback, any appeal you made, and your name, so that they can step aside if they know you. Not your email address, and nothing about your purchases, your exams or the founding list. Before any work is sent, the moderator signs an agreement requiring them to act only on our instructions, keep it confidential, never put it into an AI tool or any other outside service, and delete their copies within 30 days of deciding. We keep the record of the decision. If the moderator is based outside the United Kingdom, the safeguards UK law requires for that transfer are in place before anything is sent.

There is no analytics vendor. No Google Analytics, no PostHog, no product analytics of any kind. The only traffic figures we see are the aggregate request counts Cloudflare produces from serving the pages, which happen in Cloudflare's network rather than in your browser: there is no analytics script on this site and nothing is written to your device.

We do not track opens or clicks in our email. Our mail provider can report those and we deliberately do not record them. We store only whether a message was sent, delivered, delayed, bounced or reported as spam, because that is what tells us a certificate failed to arrive. Whether you opened it is not our business.

What is public

One thing: the certificate register. Anyone holding a certificate ID can check the credential, level, learning hours, issue date and current status at our verification page. The register cannot be searched by name or by email address, so nobody can look up who holds our certificates, and a holder's email address is never returned by it. Nothing else you give us is published anywhere.

Cookies and your device

This site sets no cookies, which is why you have never seen a banner asking about them. If you buy a course, your browser stores your access key locally so that you do not have to type it on every page. That stays on your device, is readable only by this site, and clearing your browser data removes it. Your key is also in the email we sent you, and your certificates are listed on the learn page whenever you enter it.

Who is responsible

The data controller is London School of AI Governance Ltd, registered in England and Wales, company number 17373376, at 167-169 Great Portland Street, 5th Floor, London W1W 5PF. We are registered with the UK Information Commissioner's Office under the data protection fee regime, registration reference ZC211405. Data protection enquiries: [email protected].

Your rights

Under UK GDPR you may ask us for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict or object to what we do with it, ask for it in a portable form, and withdraw consent to marketing at any time. Write to [email protected] and we respond within one month.

One limit, stated rather than buried: if you ask us to delete a certificate record, the certificate stops verifying. That is what deleting it means. We will do it if you ask, and we will tell you first.

You may also complain to the UK Information Commissioner's Office at ico.org.uk.

Changes to this policy

The date at the top is the date this text last changed. If we ever add a processor, start collecting something new, or change a retention period, this page changes first and the date moves with it.