Legal
Privacy Policy
Last updated October 13, 2026
Demo deployment: this is template text written for the product. Have it reviewed for your company and jurisdiction before launch.
This policy explains what personal data Groundwork processes, why, and the choices you have. We collect as little as we need to run the service.
1. What we collect
Account data: your name, email address and a one-way hash of your password (never the password itself).
Learning data: the courses you are enrolled in, lessons completed and where you stopped in a video, so we can sync your progress across devices.
Purchase data: orders, amounts, and the identifiers our payment provider gives us. Card details are handled entirely by the payment provider.
Technical data: the browser and IP address associated with a signed-in session, kept to protect your account.
2. Why we use it
To provide the service you signed up for (contract), to keep accounts secure (legitimate interest), to meet tax and accounting obligations (legal obligation), and to send account emails such as receipts and password resets.
We do not sell personal data, and we do not use it for advertising profiles.
3. Cookies
We use one essential cookie to keep you signed in. It is strictly necessary for the service, so no consent banner is required for it. We do not set advertising or cross-site tracking cookies.
4. Who we share it with
Processors that help us run the service — hosting, email delivery, video hosting and payment processing — under contracts that restrict their use of your data.
Authorities, where the law requires it.
5. International transfers
Where processors are outside your country, we rely on adequacy decisions or standard contractual clauses to protect transfers.
6. How long we keep it
Account and learning data: for as long as your account exists. Purchase records: as long as tax law requires (often 6–10 years). Session records: until they expire, at most 30 days.
7. Your rights
Depending on where you live (for example under the GDPR or UK GDPR), you can ask to access, correct, export or delete your data, object to processing, or complain to your data protection authority.
Send requests through the Contact page; we answer within 30 days.