Privacy Policy

Discentik provides interactive AI-skills training. For the personal data we control, the controller is DISCENTIK LEARNING LIMITED, a company registered in Ireland with Companies Registration Office (CRO) number 827348, whose registered office is at 65 Jameson's Orchard, Seamount Road, Malahide, Co. Dublin, K36 N803, Ireland. Discentik is the product name. Contact support@discentik.com or use the Contact page. If an organisation arranges training, it may control its participation and reporting purposes and Discentik processes those records on its documented instructions and agreed processing terms. We remain responsible for purposes we determine, such as account administration, billing and platform security. Your organisation can explain its own legal basis and access policies.

Privacy requests and complaints are handled by Julio Macias Gonzalez; the incident-response contact is Julio Macias Gonzalez. Use support@discentik.com or Contact to reach them. These operational responsibilities do not imply appointment as a statutory Data Protection Officer.

• Account details — name, email, organisation, role, public-profile details, and any profile photo you upload. We keep your account date of birth, country of residence, derived age band and eligibility-review records in restricted private storage, separate from your public profile. The account date of birth is not included in AI context, analytics or invitation emails.
• Payment and instructor licence earnings details — purchase, fee, tax treatment, refund, invoice, withholding, filing, statement and payout references and amounts. Payee legal identity, establishment, tax residence and registration evidence are used for invoicing and reporting. Instructors see their own financial records without purchaser email addresses; organisation financial access belongs to the active organisation owner and authorised finance staff.
• Learning and authored content — progress, completion, certificates, saved exercise prompts, responses and documents, and content submitted to course-building or assistant features. Some of this information is necessary to deliver the course or requested AI feature even if analytics is off. Optional detailed stage metrics are collected only with analytics consent and respect your profile opt-out.
• Communications — messages you send us, such as support or contact enquiries.
• Trust and safety records — reports, appeal reasons, administrator case notes, and evidence submitted by authorised administrators.
• Technical and usage data — essential security, connection and authentication records; separately optional analytics and session replay of public pages for eligible adults when available. PostHog receives random monthly identifiers, approved event properties and recordings of public pages (form fields, typed text and the website assistant hidden) and fully masked sign-up pages, never account IDs or learner content. Our private first-party inventory can connect those identifiers to your account or browser for rights handling and deletion. Monthly identifiers do not provide cross-month user continuity. We keep minimal consent evidence without IP addresses or browser fingerprints. We do not use these tools for personalised advertising.

We obtain data from you, your browser and your use of the service. Your organisation may supply your invitation, role and training assignments. If you choose external sign-in, the identity provider supplies the account details needed to sign you in. Payment and security providers supply relevant transaction or verification results.

Account, security and payment details marked as required are needed to provide the related service; without them we may be unable to create access, complete payment or process your request. Public profile publication, analytics and session replay are optional and do not replace the separate beta-admission requirements.

Discentik no longer runs an email waitlist. The email addresses it held are deleted.

Your organisation’s authorised staff can access the training, membership and reporting information their role permits. Public profile fields, published course materials and reviews may be visible to other users or visitors when you choose to publish them. A display name may also appear with messages or reviews even when your profile is private. Authorised support and moderation staff may access information needed to handle requests or investigate reports. Review visibility settings and avoid publishing sensitive information.

• To deliver the service — performance of a contract.
• To operate and secure the platform, prevent fraud and abuse, and diagnose essential service failures — our legitimate interests, balanced against your rights. Optional analytics remains subject to consent.
• To investigate reports, prevent abuse, and preserve accountable moderation decisions — our legitimate interests and, where applicable, legal obligations.
• Optional analytics and session replay — separate consent choices that you may withdraw at any time. Necessary language preferences do not require optional consent.
• To meet legal obligations — where the law requires it.

We do not sell your personal data and we do not use it for automated decisions with legal or similarly significant effects.

When you request AI features, relevant messages, exercise prompts, documents, course material and conversation context are sent to approved AI providers for chat, feedback, evaluation, help, research or adult authoring assistance. Younger-user operations use their approved protected route and fail safely when that route is unavailable; they never fall back to adult credentials. Display names, public-profile text and course reviews may be sent for text-safety screening. Profile photos and course cover images are sent for automated content-safety screening before use. New profile photos use private storage with short-lived access links governed by current sharing; course covers use public storage. Authorised administrator evidence images are also screened before private storage. Screening can reject a submission; you can contact support to challenge a result, and human administrators remain responsible for moderation investigations and enforcement. Do not submit confidential or personal data you are not authorised to share, including pupil data. AI output may be inaccurate. Provider processing and applicable retention are distinct from the information saved in your Discentik account.

We use the following services for the purposes described below. Their role depends on the service: some process data on our instructions, while payment, identity or security providers may also process information for their own legal, security or account-management purposes under their notices.

• Cloudflare — website and network hosting, delivery, security and Turnstile form-protection checks, which involve technical connection and challenge information.
• Supabase — database, authentication and file storage. Hosted regions and any transfer arrangements depend on the deployed service; contact us for details about the environment processing your data.
• OpenAI — requested exercise, help and authoring assistance, plus safety screening of shared text, profile photos, course covers and administrator evidence images.
• PostHog — EU-hosted product analytics and filtered error diagnostics after analytics consent, and recordings of public pages only after separate replay consent and adult eligibility. Signed-out recordings show page text and images; form fields, typed text and the website assistant stay hidden, signed-in recordings stay masked, and sign-up and sign-in pages are recorded with all text and fields hidden. Each capability remains off where its release safeguards are not verified. The capture boundary excludes chat, documents, answers, account identifiers and raw error messages. Recordings have a 30-day maximum; optional events have a 12-month maximum, enforced through verified deletion of monthly identifiers where native deletion is insufficient.
• Google Analytics 4 — traffic measurement after analytics consent. Our tag disables advertising signals, advertising storage and ad personalisation. Our explicit pageview events filter URLs and titles and do not intentionally include account identifiers or authored content. Google receives browser and connection information through its tag.
• Resend — transactional emails, including contact messages sent to our support inbox, invitations and assignment reminders. Contact messages include your name, reply email, message and any team details you choose to provide.
• Payment providers — Stripe processes course payments, calculates transaction tax where Discentik is registered to collect it, and handles connected-account identity verification and bank-account management. For Stripe payouts, you supply bank details directly to Stripe; Discentik keeps account, tax-calculation and payment references and readiness information. For approved manual bank payouts, authorised finance staff arrange secure beneficiary verification and payment through Revolut Business. Beneficiary and bank details are handled outside the Discentik platform for this purpose. The platform records the recipient label, last four account digits, private verification evidence references, review status, and payment and reconciliation details. Contact support to arrange secure verification; do not enter full bank details in platform fields or ordinary support messages.
• Have I Been Pwned (Pwned Passwords) — password safety checks send only the first five characters of a cryptographic password hash to compare against known breaches. The password and complete hash are not sent; the provider receives the network request.
• Google or Microsoft — if you choose their sign-in options, they process authentication under their own privacy notices and provide the account details needed for sign-in.

Some providers may process data outside the European Economic Area, even where a primary database is hosted in Europe. GDPR requires an applicable transfer mechanism, such as an adequacy decision or Standard Contractual Clauses with any necessary additional safeguards. Contact us for the countries, recipients and safeguards relevant to your data and to request a copy of applicable safeguards.

We keep account details, including the privately stored account date of birth and residence, profile information, learning progress, exercise prompts, AI responses, and certificates while your account remains open. If your account is closed or deleted, we delete or irreversibly anonymise this information from our active systems within 30 days, except where retention is required for the purposes described below.

Payment, invoice, refund, and essential contractual records are retained for six years to meet tax, accounting, and legal obligations. Support correspondence is normally retained for 24 months after the enquiry is resolved, or for up to six years where it relates to a transaction, dispute, or legal claim. Security and authentication logs are retained for up to 12 months. Consent-based product-analytics events are retained for up to 12 months; individual providers may use shorter periods. Anonymous aggregated statistics may be retained indefinitely.

Required agreement acceptances, tax-profile evidence, invoices, earnings, refunds, withholding, filing and payout history can be retained for the applicable statutory period with stable payee references separate from profile details. Removing profile details does not erase outstanding financial obligations. The payment-record retention rules and applicable legal holds continue to apply.

Private moderation evidence is scheduled for deletion 90 days after upload. It remains protected for longer while an investigation, appeal, enforcement, or legal hold is active and is deleted after that need ends. Moderation case and audit records are normally retained for 24 months after closure, but may be retained for up to six years where necessary for an account suspension, appeal, dispute, or legal claim.

We may retain relevant information for longer while a legal hold, investigation, appeal, or proceeding remains active. Deleted information may remain temporarily in encrypted backups until those backups expire and will not be used for any other purpose. You can request deletion at any time.

Under the GDPR you have the right to:

• access a copy of your data;
• rectify inaccurate data;
• erase your data (“right to be forgotten”);
• restrict or object to certain processing;
• data portability;
• withdraw consent at any time, without affecting prior processing.

Use Account privacy to submit and follow privacy requests, including access, export, correction, erasure, restriction and objection. You can also contact support@discentik.com without beta admission or an account. We verify requests proportionately; OAuth users do not have to create a password. Exports may require review and redaction. External cleanup still pending is shown as processing, not a promise that all data has been deleted. Contact support if shared ownership requires a handover.

We respond without undue delay, normally within one month. Where the GDPR permits an extension for a complex or numerous request, we will explain it within that first month. We may need proportionate information to verify your identity. Rights apply subject to their legal conditions; we will explain any lawful restriction or refusal. Withdrawing consent does not affect processing that was lawful before withdrawal.

You can raise a privacy complaint through Contact or our support email. We acknowledge complaints within 30 days and investigate and keep you informed without undue delay. This is separate from the deadlines for exercising your data rights.

UK users may also complain to the Information Commissioner’s Office (ICO).

You may complain to the Irish Data Protection Commission or your local EEA supervisory authority.

We use access controls and row-level security so users and organisations can see only data they are authorised to access, and we limit access to what is needed to run the service.

Discentik supports eligible people aged 16 and over in approved countries. We derive age bands from the date of birth supplied for eligibility checks. The account date of birth and residence are stored privately; identity documents are not routinely requested in the declaration form, and a declaration is not verified age. Users aged 16–17 may use approved learning features. Purchases, when available, require an active purpose-specific guardian authorisation. They cannot author, publish or sell courses, receive payouts, or hold finance or organisation-administrator roles. Optional analytics and session replay remain disabled for under-18s and while adult eligibility is unresolved. Guardian status does not grant access to private learning conversations or documents. School/pupil-data processing is not part of this release. You can submit a date-of-birth or residence correction through the eligibility form or contact support. A correction that would relax protections requires review before it takes effect. A pending review does not grant new permissions; declarations requiring stronger protections can restrict access immediately. Admission restrictions do not erase saved work or remove privacy rights.

If you are under 18, optional tracking is off. Do not put private information about yourself or another person into practice prompts or documents unless your school has explained why it is needed. AI can make mistakes: ask a teacher or contact support if a result seems wrong or unsafe. Asking for help or refusing optional tracking does not remove your privacy rights. Child-capable AI remains unavailable until its dedicated privacy and safety checks are approved; your saved work is not deleted because AI is unavailable.

For school-directed learning, the school determines the authorised teaching purposes and Discentik processes learning records on its documented instructions. Our own account, security and legal duties remain separate. Before school access is activated, the school and Discentik must agree staff access, pupil notices, safeguarding contacts and rights assistance. Staff access must be limited to assigned learners and necessary work or results, not blanket access to private AI conversations. Ask your school what its staff can see. A parent or representative does not automatically receive unrestricted access; authority and the learner’s rights must be considered.

We may update this policy; we will post changes here and notify you where required. Questions about this policy or your data can be sent through the Contact page or to support@discentik.com.

The company is the controller for the purposes described in this notice. This notice does not itself authorise a transfer of historical records, new uses of personal data or new marketing. Any change of controller for existing records requires the applicable legal basis, safeguards and notices. Existing rights requests and obligations continue to be handled through the contact details above.