Privacy Policy

This policy explains how Upkora Academy handles personal information when you visit upkoraacademy.com, apply to a programme, pay tuition, or take part in a cohort as a learner, mentor or instructor.

It does not cover third-party sites we link to, or an employer’s own handling of your information after you consent to an introduction.

Application details

Your name, email address, phone number, country of residence, the programme and cohort you selected, your chosen payment plan, and your answers to background and goal questions.

Account information

Your email address, a hashed password, email verification status, role, and account activity such as sign-in times.

Payment information

Payment card details are entered directly with Stripe and never reach our servers. We store the payment status, amount, currency, plan type, instalment schedule, invoice identifiers and Stripe reference identifiers associated with your enrolment.

Learning activity

Course and lesson progress, completion status, submitted work, assessment results, attendance in live sessions and mentorship notes.

Communications

Emails and messages you send us, support requests, and records of admissions or conduct conversations.

Technical information

IP address, browser and device type, operating system, referring page, pages viewed and timestamps, collected through server logs and our content delivery network.

We do not ask for government identification numbers, financial account numbers, biometric data, precise geolocation, or information about your health, race, religion, sexual orientation or political views. Please do not send them to us.

• Directly from you, when you fill in a form, create an account, submit work or contact us.
• Automatically from your device, through server logs, cookies and similar technologies.
• From our payment processor, which confirms payment outcomes and subscription status back to us.
• From an instructor or mentor, in the form of feedback and progress notes about your work.

• Review your application and make an admission decision.
• Take payment, run instalment schedules, issue receipts and process refunds.
• Give you access to lessons, track your progress and provide feedback and certificates.
• Run live sessions, mentorship and career support.
• Send transactional email such as verification, password reset, payment confirmations, schedule changes and cohort announcements.
• Send marketing email about programmes and events, where you have opted in.
• Keep the service secure, detect fraud and abuse, and debug problems.
• Measure aggregate usage so we can improve the curriculum and the site.
• Meet our legal, tax, accounting and regulatory obligations, and enforce our terms.

We do not use your personal information to train machine learning models, and we do not make automated decisions that produce legal or similarly significant effects about you. Admission decisions are made by people.

• Performance of a contract, for enrolment, teaching, payment and support.
• Legitimate interests, for security, fraud prevention, service improvement and defending legal claims.
• Consent, for marketing email and for any optional analytics cookies, which you can withdraw at any time.
• Legal obligation, for tax, accounting and regulatory record keeping.

Payment processing

Stripe processes payments, stores card details and manages instalment schedules. Stripe acts as an independent controller for fraud prevention purposes.

Cloud infrastructure

Amazon Web Services hosts our application, database and media, in United States regions. Data is encrypted in transit and at rest.

Email delivery

A transactional email provider sends verification, password reset, payment and cohort emails on our behalf.

Instructors and mentors

Your name, progress and submitted work are visible to the instructors and mentors assigned to your cohort, so they can teach and give feedback.

Employers and partners

We share your profile or work with a potential employer only when you ask us to or give explicit consent for that introduction.

Legal and safety

We disclose information when required by valid legal process, or where necessary to investigate a conduct or security incident, protect someone’s safety, or establish or defend legal claims.

Business transfer

If we are involved in a merger, acquisition or sale of assets, your information may transfer as part of that transaction. We would tell you before it becomes subject to a materially different policy.

We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined by the California Consumer Privacy Act and comparable state laws. We have not done so in the preceding 12 months, including for anyone under 16.

We do not run advertising pixels, retargeting tags or data broker integrations on our site.

We use a small set of cookies and browser storage to keep you signed in, to remember your progress through the application form, and to measure aggregate site usage. Our Cookie Policy lists each category and explains how to control them.

We honour the Global Privacy Control signal. If your browser sends it, we treat it as a valid opt-out of any sale or sharing of personal information for that browser.

Unsuccessful applications

Deleted 24 months after the admission decision, unless you reapply.

Enrolment and learning records

Kept for seven years after your programme ends, so we can verify completion and issue replacement certificates.

Payment and tax records

Kept for seven years, as required by tax and accounting rules. This period cannot be shortened by a deletion request.

Server and security logs

Kept for 90 days, then deleted or aggregated.

Marketing preferences

Your unsubscribe record is kept indefinitely so that we do not email you again by mistake.

We encrypt data in transit and at rest, hash passwords, run our database in a private network with no public access, restrict staff access on a least-privilege basis and require multi-factor authentication for administrative accounts. Our Security page describes these controls in more detail.

No system is perfectly secure. If a breach affects your personal information, we will notify you and the relevant regulators within the timeframes required by applicable state and international breach notification laws.

Depending on where you live, you may have some or all of the following rights. We honour these requests for every learner, regardless of state, wherever it is practical to do so.

• Know what personal information we hold about you, where it came from, why we process it and who we disclose it to.
• Access a portable copy of the personal information you provided to us.
• Correct information that is inaccurate.
• Delete personal information, subject to records we must keep for tax, legal or academic verification reasons.
• Opt out of any sale or sharing of personal information, and of targeted advertising. We do none of these, so there is nothing to opt out of.
• Limit the use of sensitive personal information. We do not collect sensitive personal information.
• Be free from discrimination or a worse price for exercising a privacy right.
• Appeal a decision we make about your request.

To make a request, email us from the address on your account. We will confirm receipt within 10 business days and respond within 45 days, extending once by up to a further 45 days where the request is complex. We will tell you if we need an extension.

We verify requests by matching them against the account email and, for deletion requests, by confirming through a signed-in session. An authorised agent may act for you with written permission that we can verify. If we decline a request, we explain why, and you may appeal to the same address within 45 days. If your appeal is denied you may contact your state attorney general.

We operate from the United States and our infrastructure is hosted in United States regions. If you are outside the United States, enrolling means your information is transferred to and processed in the United States, where privacy laws differ from those where you live.

For transfers of personal data from the EEA, the UK or Switzerland we rely on the European Commission’s Standard Contractual Clauses and the UK Addendum, together with technical measures including encryption in transit and at rest. You may lodge a complaint with your local supervisory authority.

Our service is not directed to children. We do not knowingly collect personal information from anyone under 16. Learners aged 16 or 17 may enrol only with a parent or legal guardian, who must provide consent and accept financial responsibility.

If you believe a child under 16 has given us personal information, email us and we will delete it promptly.

Transactional email about your account, payments and cohort is part of the service and cannot be switched off while you are enrolled. Marketing and newsletter email is opt-in, and every message includes a one-click unsubscribe link that we honour within 10 business days.

We update this policy when our practices change. The date at the top of the page always reflects the current version. If a change materially affects how we use information you already gave us, we will email you before it takes effect.