Privacy Notice
Effective date: October 18, 2026
This notice explains how Iroko Skills Academy processes information when you use its learning, portfolio, scholarship, organization, opportunity, AI, and payment services.
Who this notice covers
This notice applies to learners, instructors, reviewers, organization representatives, scholarship applicants, opportunity participants, and visitors who use Iroko Skills Academy. When an organization sponsors access, it may separately control information it collects directly; its own notice should explain that processing.
Information we collect
We process account and authentication details; learning profile and accessibility preferences you choose to provide; enrollments, progress, assessments, projects, credentials, scholarship applications, and support requests; payment and entitlement records without storing full card numbers; and security, audit, device, usage, and service-performance data. Sensitive demographic information is not required for free learning.
Why we use it
We use information to authenticate users, deliver and personalize learning, maintain progress and assessment history, provide support, administer scholarships and sponsored cohorts, issue and verify credentials, process purchases and refunds, prevent abuse, secure the service, meet legal obligations, and measure product performance. We do not present registration or completion counts as proof of employment impact.
AI features
The learning companion sends the current question and authorized course context to the configured AI provider. Course text and uploads are treated as untrusted content. We record limited usage metadata such as model, tokens, latency, cost, and outcome; full tutoring transcripts are not retained indefinitely by default. AI may assist learning and formative feedback, but consequential grading, credential, scholarship, financial, role, and publication decisions require deterministic controls or authorized human review.
Service providers and disclosures
We use contracted providers for hosting, PostgreSQL storage, private file storage, email delivery, rate limiting, observability, AI inference, and payment processing. They receive only information needed to perform their service under applicable safeguards. Authorized organization managers receive permitted cohort information and aggregate outcomes, not private tutoring conversations or unrelated learner records. We may disclose information when legally required or necessary to protect users and the service.
Sharing you control
Portfolios are private by default. If you create a public share link, only the selected portfolio fields are disclosed, and you can revoke the link. Employer visibility is opt-in. Public credential verification shows limited authenticity and status information, not contact details, private learning history, or internal assessment discussions. External opportunity applications take you to the third party's site and are governed by that party's privacy practices.
Retention
We retain active account and learning records while the account is active; AI usage metadata for about 13 months; private assignment files while the submission is active plus 12 months; closed support requests for 24 months; financial records for seven years or the applicable statutory period; and security/audit records for 24 months before restricted archival. Credential authenticity and revocation records may be retained as long-term verification records. Legal holds and local law can extend these periods.
Your choices and rights
Account Settings lets you update profile and accessibility details, change employer visibility, download an allowlisted copy of your data, and request access, correction, export, or deletion. We verify requests and may retain restricted records where law, fraud prevention, financial reporting, credential integrity, or legal claims require it. You may also withdraw optional consent without losing designated free learning access.
Security, transfers, and children
We use server-side authorization, optional authenticator MFA, encryption in transit, private signed file access, rate limits, audit trails, and tested recovery controls. No internet service is risk-free. Providers may process data in countries different from yours, subject to applicable transfer safeguards. The service is not intended for children below the minimum digital-consent age in their location unless an approved guardian or institutional arrangement and required protections are in place.
Cookies and similar technologies
We use essential cookies and local storage for authentication, security, preferences, and service operation. Optional analytics or marketing technologies, if introduced, will be described and presented with any consent controls required by applicable law.
Changes to this notice
We may update this notice when the service, providers, or legal requirements change. We will post the revised effective date and provide additional notice when a change materially affects how we use information or when law requires it.
Contact and complaints
Use the support form for privacy questions or complaints. Authenticated users should use Account Settings for formal privacy requests. You may also complain to the data-protection authority available in your location.