Privacy

Who holds the account

The account belongs to an adult: the parent, legal guardian or other purchaser. The account email address is the login identifier and the address every message is sent to.

What we store about the adult

We store the account email address, both as you typed it and in a normalised form used for matching. When you buy, we also store the payment first name, last name, email address and phone number returned by the payment provider, together with the parental-authorisation statement you accepted, its version, the time, your IP address and your browser user agent.

Payment details themselves never reach this portal. Card data is handled entirely by the payment provider.

What we store about the learner

Only a first name and a last name. That is the name used inside the portal and printed on the certificate.

• We do not collect a child’s email address.
• We do not collect a child’s phone number.
• We do not collect a child’s date of birth.
• We do not address marketing to a child. Every message goes to the adult account contact.

Security records

Sign-in requests, administrator actions and entitlement changes are recorded in an audit log that keeps the action, the time, the IP address and the browser user agent. Secrets, tokens and one-time codes are never written to it.

Cookies

The essential session cookie is host-only, HttpOnly, restricted to this site with SameSite=Lax, and marked Secure in production.

When the feature is enabled, approved public programme pages load the dedicated Build With Gbenga Meta Pixel. It measures PageView only for a visible approved marketing page, ViewContent after a substantive visible view of a real sales page, InitiateCheckout only after the portal has durably created the order and an actual payment-provider checkout, CompleteRegistration only when verified settlement creates a genuinely new portal account, and Purchase only after independent payment verification. This measurement is automatic: there is no popup, banner, checkout consent field or on/off control. A Meta browser-event opt-out that was saved in a browser through this site's earlier control continues to be honoured there until it expires.

Meta Pixel and Conversions API

The portal sends matching server copies of the same five intentional events through Meta’s Conversions API. Each browser/server pair has exactly the same standard event name and random event identifier so Meta can deduplicate it. Sending is asynchronous: Meta failure never delays navigation, checkout, payment settlement, account creation or access.

Server events contain the event time, approved page or checkout-return address, and the bounded purchaser or visitor browser user agent. Only purchaser events add normalised purchaser email, phone, name and the purchaser account ID after one-way SHA-256 hashing. Purchase also contains verified value and currency. The portal never sends an IP address, learner or child identity, course or offer details, order reference, payment instrument or unrelated account data.

When browser measurement is allowed, this site and the Pixel may store a first-party _fbp browser identifier for attribution. The portal stores _fbc only when a genuine fbclid arrives in the page address from a Meta ad click; it never invents an ad-click identifier. Both values are format-validated, captured only from the purchaser’s browser at the order/checkout boundary, and may accompany that purchaser’s durable server events. A previously saved browser-event opt-out, Global Privacy Control and a technically reliable Do Not Track signal each prevent their capture.

Every independently verified successful payment creates one mandatory server Purchase event, even if the browser event is opted out or blocked. A previously saved browser-event opt-out, Global Privacy Control and a technically reliable Do Not Track signal stop public browser-origin measurement and every Pixel event, including browser Purchase; they do not suppress the verified server Purchase. This distinction is independent of checkout, course access and promotional messages.

First-party site analytics

When this feature is switched on, the public marketing pages (the programme homepage, the course list, the course sales pages and the free preview lesson) measure their own use for us. Nothing is sent to an advertising or analytics company. It never runs on sign-in, checkout or enquiry forms, the privacy, help or policy pages, your dashboard, lessons or administration, and it stops if you move from a public page to one of those.

It records which of those pages were viewed, which page sections were seen, how far a page was scrolled (25, 50, 75 and 90 per cent), roughly how long a page was actively used (visible, with input in the last 30 seconds), which buttons were pressed, the kind of device (mobile, tablet or desktop), the website that linked to us (its host name only) and campaign tags in the link (utm_source, utm_medium, utm_campaign, utm_content, utm_term and utm_id). It never records what you type, other parts of the page address, an ad-click identifier's value, your IP address, your name, email or phone number.

To recognise a returning browser, the server sets one pseudonymous cookie containing a random identifier. It is host-only, HttpOnly, SameSite=Lax and Secure. It expires 90 days after it was first set and is not extended by later visits. A visit ends after 30 minutes without activity or after 24 hours. Global Privacy Control, Do Not Track and a browser-event opt-out saved through this site's earlier Meta control each stop this measurement completely: no cookie is set and nothing is stored.

When you submit checkout or a Build For Me enquiry from a browser that carries this cookie, we keep a copy of the campaign that most recently brought that browser to us within 30 days, alongside the order or enquiry, so we can see which campaigns lead to sales. That copy includes campaign labels, device type, pseudonymous browser and visit identifiers, and the times of the first acquisition, credited campaign touch, current visit and submission. Payments, access and enquiries never depend on it.

How long we keep it

Access and payment records are kept as business records after an account is closed, because they establish what was bought and what was granted. If you ask us to erase personal data, we pseudonymise the account while keeping the payment history required for business and legal records.

The planned retention period for raw site analytics is 90 days. The deletion tool is implemented, but automatic deletion has not been activated; records are not yet automatically removed at that age. The campaign copy kept with an order or enquiry is kept with that record. You can ask us to delete the analytics records for your browser: tell us the value of the cookie named __Host-gbo_sa (shown in your browser's site-data settings) and we will remove them.

A browser-event opt-out saved through this site's earlier control is stored only in that browser and expires one year after it was set. Meta delivery records are kept for deduplication, retry and delivery audit and are pseudonymised with the account when an erasure request applies. The outbox does not duplicate purchaser names, email addresses or phone numbers; purchaser data is read from the authoritative order only while its event is eligible to send.

Asking us about your data

Write to the address on the help page. We will confirm what we hold about your account and act on correction or erasure requests.

OpenAI Ads measurement