Privacy Policy

1. Who we are

Deliberate Academy is an independent online learning platform that publishes free AI courses with verifiable certificates. We are a small independent operation, not a large corporate entity. For privacy-related questions, contact us at hello@deliberateacademy.com.

2. What data we collect

Account data

When you create an account, we collect your email address and optionally your name. This data is stored in our database and is used to manage your account, track your course progress, and issue certificates.

Course progress and exam data

We record which lessons you have completed, your exam attempts, your exam answers, your scores, and whether you passed. This is required to issue certificates and to show your progress in the dashboard. For each exam attempt, we also record the IP address and user agent (browser and device information) used to submit it, for exam integrity and anti-cheating purposes. Exam records are deleted along with the rest of your account data when your account is deleted.

Certificate data

Certificates are stored in our database linked to your account. Certificate records include the course completed, the date issued, and a unique certificate ID. Certificate records are publicly verifiable via their unique URL — this is the intended behaviour and is required for the credential to be useful to employers.

The public certificate page shows your name (as stored in your account) and the course completed. If you want your certificate to remain private, do not share its URL.

Public profile

A separate, optional public profile page exists at /u/[handle]. It is off by default — it is not created or shown just because you have an account. If you choose to turn it on at /account/profile, it shows your first name and last initial, your total XP, the month and year you joined, and the list of certificates you have earned. It never shows your email address, exam scores, or full name.

You can enable or disable the public profile at any time from /account/profile. While it is off, the page is not indexed by search engines (“noindex”). The handle in the profile URL is automatically derived from your account’s first name when your account is created — if you would rather it not resemble your name, you can change it at /account/profile.

The lawful basis for showing a public profile is your consent (GDPR Article 6(1)(a)). This is separate from, and not an extension of, the certificate verification behaviour described above. You can withdraw this consent at any time by turning the public profile off again at /account/profile.

Profile photo

You can optionally set a profile photo at /account/profile — either by uploading an image, or, if you signed up with a Google account, by clicking “Use my Google profile picture” to copy your Google account photo in as your profile photo. We never do this automatically — signing up with Google does not give you a profile photo by default. Either way, our server re-encodes it into two small thumbnails (64px and 256px, WebP format) sized for the account menu and your profile settings. Any EXIF metadata embedded by your camera or phone — including GPS location data — is stripped during that re-encode and is never stored. The original file you uploaded is discarded immediately after re-encoding and is never retained.

If you use your Google profile picture, we fetch it once, at the moment you click the button, directly from Google’s servers; the downloaded image is discarded after re-encoding in the same way an uploaded file is, and we do not keep a record of where the photo came from. It will not update automatically if your Google photo changes later — you would need to repeat the action to refresh it.

A profile photo is purely cosmetic — it personalizes your account menu and does not affect your courses, exam results, or certificates in any way.

The lawful basis for storing a profile photo is your consent (GDPR Article 6(1)(a)), evidenced by the deliberate act of uploading it or of clicking “Use my Google profile picture.” You can withdraw this consent at any time by removing your photo at /account/profile, which reverts your account menu to your initials.

Your profile photo thumbnails — whether from an upload or from Google — are stored in a private storage bucket within the same infrastructure used for the rest of our database (see “Data storage and security” below) — not a separate third-party service. The bucket is not publicly accessible; only our server can read or write it.

Currently, your profile photo is visible only to you. It is not shown on your public profile page, in lesson comments, in study groups, or anywhere else — those surfaces continue to show only your initials.

Your profile photo is retained until you remove it or delete your account, including the 30-day grace period described in “Account deletion” below.

Course discussion

If you post a comment on a lesson, your first name and last initial are shown alongside your comment to anyone viewing that lesson — including visitors who do not have an account.

Study groups

Any signed-in user can create a study group (also called a cohort). Its creator chooses a name for it, may optionally link it to a course, and gets a 10-character join code to share. The join code acts as a shared secret — anyone who has it can join the group and see its members, so share it only with people you want to join.

If you join a group, its other members can see your first name and last initial, the number of certificates you have earned, and your current streak. Your profile photo is never shown here — see “Profile photo” above. If you have requested account deletion, you are hidden from other members during the 30-day grace period described in “Account deletion” below.

You can leave a group at any time from your dashboard. A group’s creator can delete the group or rotate its join code, which immediately invalidates the old one. A group’s name is free text chosen by its creator and visible to everyone in the group — please do not include anyone’s personal details in it. Group pages are not indexed by search engines, and we never send a group’s join code, ID, or member identifiers to our analytics tools.

The lawful basis for showing your name, certificate count, and streak to a group’s other members is performance of a contract (GDPR Article 6(1)(b)): joining a group is a deliberate request for that feature, and this limited information — shown only within that group — is what is necessary to provide it.

If a group’s creator leaves the group without deleting it, creator rights — deleting the group and rotating its join code — pass automatically to the group’s longest-standing remaining member. If the last remaining member leaves, the group and its data are deleted.

Content moderation

Lesson comments and study-group names are checked against formatting rules and an English-language word filter before they are stored. Typographic punctuation you type — curly quotes, long dashes, the ellipsis character, and no-break spaces — is converted to its plain ASCII equivalent as part of this check; this is disclosed where you write a comment or name a group.

If the filter flags a comment or group name, it is held from other people until a person reviews it — the filter never rejects your text outright. Anyone signed in can also report a comment; a person reviews every report, and the comment stays visible while a report is open unless we remove it.

When a comment or group name is held, reported, or removed, we keep a moderation record of that episode: the original text, why it was flagged (a category such as “profanity,” never the specific matched word), any report against it (the reporting account, category, and explanation given), any statement you submit to contest a decision, and the notice we send about the outcome. We separately record which account submitted the group’s name when the group was created — this can differ from the group’s current creator, because creator rights pass to the longest-standing remaining member if the original creator leaves, while the record of who wrote the name does not transfer.

The lawful basis for this processing is our legitimate interest (GDPR Article 6(1)(f)) in keeping comments and study groups safe and enforcing our content rules, and, where it applies, our legal obligation (GDPR Article 6(1)(c)) to operate a notice mechanism and provide a statement of reasons under the EU Digital Services Act. This is not based on your consent, and nothing in the comment or study-group tools asks for consent to moderation.

A comment or group name we remove, and any connected report explanation or contest statement, is removed from our live systems within 6 months of the decision (or, if you contest it, within 6 months of the contest being decided, up to a further 30 days if a contest is still open when that period ends). Copies may persist for a limited additional period in backup copies of our database, under our hosting provider’s standard backup rotation.

After the text itself is removed, we keep a text-free record of the episode — that a hold or report occurred, its category, its outcome, and the relevant dates — for 730 days, on the same legitimate-interest basis (GDPR Article 6(1)(f)): so we can show, if a decision is later disputed, that a statement of reasons was issued, and so we can recognize repeated bad-faith reports or repeated rule violations. This record never contains the removed text or the matched word.

We never disclose who reported a comment to the comment’s author.

Analytics data

We may use analytics tools to understand aggregate site usage — pages visited, device types, and traffic sources. This data uses IP anonymization and is not linked to your account or email address.

Advertising data

Display advertisements may appear on most pages of the site, including both public pages and authenticated pages such as your dashboard, lesson pages, exam preparation and result pages, and certificate pages. Ads never appear on the active timed exam itself, or on signup, login, password-reset pages. Ad networks may use cookies to serve relevant ads. We do not control those cookies.

Payment data (premium subscribers only)

If you subscribe to remove ads, your email address and billing information are processed by Paddle, our merchant of record. We store your subscription status and Paddle identifiers, but we never see or store your card details — Paddle handles those directly.

Contact form

If you use the contact form, the name, email, and message you submit are used only to respond to your enquiry. They are not added to a marketing list or retained beyond what is necessary to handle your message.

Newsletter signups

If you submit your email address to join our newsletter, we store it to send you future updates. We do not currently send a newsletter — no automated or scheduled emails go to this list. If you want your email address removed from this list at any time, whether or not you have an account, email hello@deliberateacademy.com and we will remove or provide it to you within 30 days.

3. How we use this data

• Accounts: to authenticate you and give you access to your dashboard and certificates
• Progress and exams: to track completion and determine certificate eligibility
• Certificates: to issue, store, and publicly verify your credentials
• Study groups: to show your name, certificate count, and streak to other members of any group you join
• Analytics: to improve the site and content
• Advertising: to fund the free courses and platform
• Contact messages: to respond to your specific enquiry
• Content moderation: to check comments and study-group names against our content rules, review reports and contests, and send a statement of reasons if we hold, remove, or reset something you wrote — legitimate interest (Article 6(1)(f)), and legal obligation (Article 6(1)(c)) where EU Digital Services Act notice and statement-of-reasons requirements apply

We do not sell your data. We do not use your data for automated decision-making that affects you legally.

4. Data storage and security

Account, progress, exam, and certificate data is stored in a managed database with encryption at rest and in transit. Authentication is handled securely — passwords are never stored in plain text.

If you set a profile photo — whether by uploading an image or by adopting your Google profile picture — the resulting thumbnails are stored separately in a private object storage bucket within the same infrastructure — not a public bucket, and not a separate third-party service — with read and write access restricted to our own server.

The platform is hosted on a managed cloud infrastructure provider. Standard server access logs (IP address, request URL, timestamp) may be collected for infrastructure and security purposes.

4a. International data transfers

Some of our infrastructure and third-party service providers process data outside the European Economic Area (EEA) and the UK. Where this occurs, we rely on the European Commission’s Standard Contractual Clauses (SCCs) or the UK International Data Transfer Agreement (IDTA) to ensure your data receives an equivalent level of protection.

Our primary database and authentication infrastructure is operated by providers that have executed SCCs with us. If you are a business customer or employer using our verification services and require a Data Processing Agreement (DPA), please contact us at hello@deliberateacademy.com.

5. Cookies

We set an authentication session cookie when you are logged in. This is strictly necessary for the platform to work. We do not set advertising or tracking cookies ourselves. Third-party ad networks on public pages may set their own cookies.

You can block cookies in your browser settings. Blocking the session cookie will prevent you from accessing your dashboard, completing courses, or viewing your certificates while logged in.

6. Third-party services

• Database and authentication — our core data store, accessed only by this application’s backend
• Cloud hosting — manages server infrastructure, may retain standard access logs
• Analytics (where enabled) — aggregate usage data with IP anonymization to improve the product; not linked to your account
• Display advertising networks — ads may appear on most pages of the site, including public pages and authenticated pages such as your dashboard, lesson pages, exam preparation and result pages, and certificate pages; ads never appear on the active timed exam, or on signup, login, and password-reset pages. Each network operates under its own privacy policy
• Payment processing (Paddle) — processes your email address and billing information if you subscribe to remove ads; we never see or store your card details
• Error monitoring — used to detect and diagnose bugs and outages; captures technical details like stack traces and request URLs, not your personal profile data
• Transactional and account email (Resend) — sends account, progress, and moderation-related emails on our behalf (for example, that a comment or group name of yours was held, removed, or reset, or the outcome of a report you filed); processes your email address and the content of the email
• Spam and bot protection (Cloudflare Turnstile) — used on the contact form, sign-up, and sign-in; processes your IP address to verify you are not a bot

7. Your rights

GDPR (EEA and UK)

• The right to access data we hold about you
• The right to request deletion of your account and associated data
• The right to correct inaccurate data
• The right to object to processing based on legitimate interests
• Your account data export (from account settings) includes any study groups you have joined or created, and when you joined them
• Your account data export also includes content-moderation records about you — comments or study-group names you submitted that were held or removed, reports you filed and their outcome, any contest you submitted, and the notices we sent you. It never includes the identity of anyone who reported your content, or any other user’s account details.

These rights apply whether or not you have an account with us — for example, if you only submitted your email to our newsletter signup form.

CCPA (California residents)

• The right to know what personal data is collected about you
• The right to opt out of the sale of personal data (we do not sell data)

To exercise any right, email hello@deliberateacademy.com. We will respond within 30 days.

8. Account deletion

You can request deletion of your account at any time, either from your account settings or by emailing us. When you request deletion, your account enters a 30-day grace period. You can cancel the request at any point during those 30 days simply by logging back in, which fully reactivates your account.

If the 30-day window passes without cancellation, we permanently delete your personal account data — your login credentials, email address, profile details, any profile photo (whether uploaded or adopted from Google), course enrollments, lesson progress, and exam attempt records (including exam answers and scores). This data cannot be recovered once deleted.

Deleting your account is treated the same as leaving every study group you belong to. In a group you did not create, only your membership is removed; the group continues to exist for its other members. In a group you created, creator rights — deleting the group and rotating its join code — pass automatically to the group’s longest-standing remaining member, preferring a member who is not themselves pending deletion, unless every remaining member is, exactly as they would if you left the group while keeping your account active. If you were the group’s only remaining member, the group and its data are deleted. If you had already left a group you created before requesting deletion, that group already has no recorded creator, and deleting your account does not change that.

For as long as a group continues to exist, deleting your account does not change or remove its name — the exception is the case above, where you were the group’s only remaining member and the group itself, including its name, is deleted. If our record of which account submitted the group’s name when the group was created points to your account, that record is cleared when your account is deleted — separately from creator rights, which pass to another member as described above.

Deleting your account also affects any open content-moderation record connected to you. A pending or reported comment you wrote is deleted with your account, and any open review of it is closed. If a comment or study group name of yours is still withheld or was removed for breaking our content rules, we keep that decision record for the period described above under “Content moderation” — on our legitimate-interest basis (GDPR Article 6(1)(f)) — but it is no longer linked to your account. If you filed a report or contest against someone else’s content, it is still reviewed but no longer linked to your account, and we cannot send you its outcome once your account is deleted.

Certificate records are treated differently. Certificates you have earned remain permanently accessible via their public verification URL even after your account is deleted. This is intentional: certificates are designed to function as durable, employer- and client-facing credentials, and their usefulness depends on staying verifiable indefinitely, not just while you hold an active account. After deletion, a certificate’s public page continues to show the recipient’s name, the course completed, the certificate title, and the issue date exactly as before — it is simply no longer linked to any login account.

The legal basis for this limited retention is our legitimate interest (GDPR Article 6(1)(f)) in preserving the integrity and verifiability of credentials we have issued. This is a narrow, specific exception that applies only to the certificate record itself — it is not a blanket refusal to delete your data, and it does not affect deletion of any other account or personal data described above.

If you have a specific reason for wanting a certificate removed as well — for example, a request under GDPR Article 17 grounds not covered by the legitimate-interest exception above — contact us at hello@deliberateacademy.com and we will review it on a case-by-case basis. Certificate removal is not automatic, but it is not impossible.

9. Children

Deliberate Academy is intended for working professionals and adults. We do not knowingly collect data from children under 13. If you believe a child has created an account, contact us and we will delete it promptly.

10. Changes to this policy

If we make material changes, we will update the "Last updated" date at the top of this page. Continued use of the platform after a change constitutes acceptance of the updated policy.

11. Contact

For any privacy-related questions, contact us at hello@deliberateacademy.com.