This Data Collection Policy sets out, category by category, the information Academz gathers when you browse our site, run an academy, or learn on a platform we host. Where the Privacy Policy explains how we use and protect data once we hold it, this document focuses on the collection itself — what we take, the sources it comes from, the methods we use, and the lawful basis for each. Read the two together for the full picture.
At a glance
Purpose & Scope
This policy describes the personal and operational data Academz collects across its marketing site, vendor consoles, and every academy platform we host.
Academz is a multi-tenant learning management system. A single platform serves the vendor and thousands of subscribing academies, each running an isolated space for its teachers, staff, and students. Because data enters the system from many directions, we publish this dedicated collection policy so you can see precisely what is gathered at each point and why.
It applies to the data we collect as the operator of the service. It does not govern what an individual academy independently chooses to collect from its own learners, nor the third-party gateways and tools an academy connects. Where an academy decides what learner data to gather, that academy is responsible for its own collection notice.
Read alongside the Privacy Policy
This document covers what we collect and why. How that data is then used, shared, and protected is detailed in our Privacy Policy, which we reference throughout.
Categories of Data We Collect
We group the data we collect into the categories below. Not every category applies to every person — what we hold about you depends on how you use Academz and the role you hold on the platform.
| Category | Examples |
|---|---|
| Identity | Full name, preferred name, profile photo, and the role you hold on the platform. |
| Contact | Email address, phone number, and the mailing or billing address you supply. |
| Account & credentials | Username, hashed password, language and theme preferences, and multi-factor settings. |
| Academy & institutional | Academy name, branding, subdomain or custom domain, chosen plan, and configured settings. |
| Learning activity | Courses, enrollments, quiz attempts, progress, certificates, and messages you create or receive. |
| Payment & billing | Plan, subscription status, invoices, and payout details; card numbers are handled by our payment providers, not stored by us. |
| Technical & device | IP address, browser and operating system, device identifiers, timestamps, and cookie identifiers. |
Sensitive data
Please do not enter special-category data — such as health, religion, or political views — into free-text fields unless a course genuinely requires it. Academies are responsible for the lawful basis of any sensitive data they collect from their learners.
Sources of Data
We collect data from four sources. Naming them lets you trace any piece of information we hold back to where it came from.
- Directly from you
- What you type or upload — registration details, your academy configuration, course content, support messages, and payment information.
- Automatically from your use
- Data generated as you interact with the platform — pages viewed, features used, login timestamps, and the device and log data captured for security.
- From your academy
- If you are a learner or staff member, the academy that enrolled you may create or import your record, including your name, contact details, and enrollment.
- From third-party services
- When you sign in with an external provider, pay through a gateway, or connect a tool, we receive the limited data that service shares to complete your request.
We do not buy personal data from brokers or scrape it from other sites. If we ever receive data about you from a source not listed here, we will tell you at the point of collection.
How We Collect Data
Collection happens through a small, predictable set of methods, each tied to an action you or your academy takes:
- Forms and uploads — when you register, configure your academy, build a course, or submit a support ticket.
- Automatic logging — when your browser or app requests a page, we record the technical and usage data needed to serve and secure it.
- Cookies and similar technologies — to keep you signed in, remember your preferences, and understand aggregate usage, as detailed in our Cookie Policy.
- Integrations and callbacks — when a payment gateway confirms a transaction or a connected service returns the data you authorized.
- Academy imports — when an academy adds or bulk-imports learners and staff into its own isolated tenant.
No hidden collection
We do not use invisible trackers, recording of your keystrokes, or third-party advertising pixels that follow you across the web.
Lawful Basis for Collection
Where data-protection law such as the GDPR applies, we collect personal data only when at least one of the following lawful bases applies:
- Contract
- Data we must collect to deliver the service you signed up for — creating your account, running your academy, and billing your plan.
- Legitimate interests
- Data collected to keep the platform secure, prevent abuse, and improve the product, balanced against your rights and reasonable expectations.
- Consent
- Optional data tied to non-essential cookies and marketing, collected only with your consent, which you can withdraw at any time.
- Legal obligation
- Data we must collect and keep to meet tax, accounting, and other legal duties, or to respond to lawful requests.
Where we collect learner data on behalf of an academy, the academy establishes the lawful basis as the controller, and we act only on its documented instructions as the processor.
How We Use Collected Data
We use the data we collect only for the purposes it was collected for, and for no undisclosed ones:
- To provide the platform — create accounts, host academies, and deliver the features of each plan.
- To process payments — manage subscriptions, invoices, renewals, and the payouts an academy earns.
- To secure the service — detect fraud, prevent abuse, enforce isolation between tenants, and investigate incidents.
- To support you — answer questions, resolve tickets, and send essential service notices.
- To improve the product — understand which features help, using aggregated and de-identified data wherever possible.
- To comply with the law — meet tax and accounting duties and respond to lawful requests.
Full detail in the Privacy Policy
How each purpose maps to a lawful basis, and the safeguards around every use, is set out in full in our Privacy Policy.
Automated Processing & AI
Some Academz features use automated processing and artificial intelligence — for example, generating quiz questions, drafting content, or summarizing material. This section explains what that means for the data involved.
- AI features process the content you submit to them — a prompt, a document, or a lesson — only to produce the output you asked for.
- Each AI action consumes metered ai_credits from your plan, so processing happens only when you deliberately trigger it.
- We do not sell your content, and we do not use it to build advertising profiles or to train models for unrelated purposes.
- Automated output is a starting point, not a final decision — a person reviews and edits it before it affects any learner.
Human oversight
No AI feature makes a decision with a legal or similarly significant effect on a person without human review. You stay responsible for the content you publish from AI output.
Data Minimization & Accuracy
We design collection around two principles: take the least data a feature needs, and keep what we take accurate.
- Minimization — forms request only the fields a feature genuinely needs; optional fields are clearly marked, and we avoid collecting data "just in case."
- Purpose limitation — data collected for one purpose is not quietly repurposed for an unrelated one.
- Accuracy — you and your academy can update most data directly, and we act on correction requests promptly.
- De-identification — where we analyze usage to improve the product, we use aggregated or de-identified data wherever it will do the job.
If a field becomes unnecessary, we stop collecting it. Keeping the dataset lean is part of how we keep it secure.
Sharing & Sub-processors
We share the data we collect only in the limited circumstances below, and only to the extent necessary:
- Sub-processors — vetted vendors that host our infrastructure, send email, process payments, and provide analytics, each bound by a data-processing agreement.
- Your academy — if you are a learner, the academy that enrolled you sees the records it needs to run your enrollment.
- Legal and safety — where required by law, or to protect the rights, safety, or property of users and the public.
- Business transfers — if Academz is involved in a merger or acquisition, data may transfer as part of that transaction, subject to our policies.
We do not share the data we collect with data brokers or advertisers. A current list of sub-processors is available on request.
Retention Schedule
We keep the data we collect only for as long as the purpose requires, then delete or anonymize it. Retention depends on the type of data:
| Data | Kept for |
|---|---|
| Active account & academy data | For as long as the account is active. |
| Data after cancellation | A short grace window for export, then deletion. |
| Invoices & tax records | As long as the law requires, often several years. |
| Security & audit logs | A limited period, then purged on a rolling basis. |
| Support tickets | A limited period after the ticket is resolved. |
When an academy closes, we provide a window to export data before it is permanently removed from active systems, subject to any records we must keep by law. Backups cycle and expire on their own schedule.
Security Controls
The data we collect is protected by layered technical and organizational controls, applied from the moment it enters the platform:
- Encryption in transit — every connection is protected with modern TLS.
- Tenant isolation — the data layer enforces the boundary between academies on every read and write, so one academy can never reach another's collected data.
- Access control — role-based permissions, least-privilege staff access, and audited administrative actions.
- Payment safety — card data is handled by PCI-compliant providers; we never store full card numbers.
- Monitoring — continuous logging, error reporting, and rate limiting on sensitive endpoints such as login and payment.
Your part matters
Use a strong, unique password, enable any available extra verification, and grant staff only the access they need.
Your Controls & Rights
You keep meaningful control over the data we collect about you. Subject to the law that applies to you, you can:
- Access — ask for a copy of the personal data we have collected about you.
- Correct — update information that is inaccurate or incomplete, directly or by request.
- Export — receive your data in a structured, machine-readable format.
- Delete — ask us to erase data where there is no overriding reason to keep it.
- Object — object to collection based on our legitimate interests, and opt out of marketing at any time.
To exercise a control, contact us using the details below. We will verify your identity and respond within the timeframe the law requires. If you are a learner on an academy platform, we may direct your request to that academy as the controller of your data.
Contact Us
If you have any question about what we collect, or you want to exercise a control over your data, reach our team using any of the channels below. We aim to respond promptly.
- Privacy & data protection [email protected]
- Legal team [email protected]
- Operated by Academz — Cairo · Riyadh · Dubai
This summary is for convenience only — the full clauses below are what apply.
Back to top