Privacy

Who holds the account

The account belongs to an adult: the parent, legal guardian or other purchaser. The account email address is the login identifier and the address every message is sent to.

What we store about the adult

We store the account email address, both as you typed it and in a normalised form used for matching. When you buy, we also store the payment first name, last name, email address and phone number returned by the payment provider, together with the parental-authorisation statement you accepted, its version, the time, your IP address and your browser user agent.

Payment details themselves never reach this portal. Card data is handled entirely by the payment provider.

What we store about the learner

Only a first name and a last name. That is the name used inside the portal and printed on the certificate.

• We do not collect a child’s email address.
• We do not collect a child’s phone number.
• We do not collect a child’s date of birth.
• We do not address marketing to a child. Every message goes to the adult account contact.

Security records

Sign-in requests, administrator actions and entitlement changes are recorded in an audit log that keeps the action, the time, the IP address and the browser user agent. Secrets, tokens and one-time codes are never written to it.

Cookies

The essential session cookie is host-only, HttpOnly, restricted to this site with SameSite=Lax, and marked Secure in production.

When the feature is enabled, approved public programme pages load the dedicated Build With Gbenga Meta Pixel. It measures PageView only for a visible approved marketing page, ViewContent after a substantive visible view of a real sales page, InitiateCheckout only after the portal has durably created the order and an actual payment-provider checkout, CompleteRegistration only when verified settlement creates a genuinely new portal account, and Purchase only after independent payment verification. There is no popup, banner or checkout consent field. The device control below turns all Pixel browser events off in this browser.

Meta Pixel and Conversions API

The portal sends matching server copies of the same five intentional events through Meta’s Conversions API. Each browser/server pair has exactly the same standard event name and random event identifier so Meta can deduplicate it. Sending is asynchronous: Meta failure never delays navigation, checkout, payment settlement, account creation or access.

Server events contain the event time, approved page or checkout-return address, and the bounded purchaser or visitor browser user agent. Only purchaser events add normalised purchaser email, phone, name and the purchaser account ID after one-way SHA-256 hashing. Purchase also contains verified value and currency. The portal never sends an IP address, learner or child identity, course or offer details, order reference, payment instrument or unrelated account data.

When browser measurement is allowed, this site and the Pixel may store a first-party _fbp browser identifier for attribution. The portal stores _fbc only when a genuine fbclid arrives in the page address from a Meta ad click; it never invents an ad-click identifier. Both values are format-validated, captured only from the purchaser’s browser at the order/checkout boundary, and may accompany that purchaser’s durable server events. Opting out deletes these two identifiers and prevents their later capture; Global Privacy Control and a technically reliable Do Not Track signal also prevent capture.

Every independently verified successful payment creates one mandatory server Purchase event, even if the browser event is opted out or blocked. The device choice below, Global Privacy Control and a technically reliable Do Not Track signal stop public browser-origin measurement and every Pixel event, including browser Purchase; they do not suppress the verified server Purchase. This distinction is independent of checkout, course access and promotional messages.

How long we keep it

Access and payment records are kept as business records after an account is closed, because they establish what was bought and what was granted. If you ask us to erase personal data, we pseudonymise the account while keeping the payment history required for business and legal records.

The browser-event opt-out is stored only in this browser for one year. Meta delivery records are kept for deduplication, retry and delivery audit and are pseudonymised with the account when an erasure request applies. The outbox does not duplicate purchaser names, email addresses or phone numbers; purchaser data is read from the authoritative order only while its event is eligible to send.

Asking us about your data

Write to the address on the help page. We will confirm what we hold about your account and act on correction or erasure requests.

Meta browser-event choice on this device

OpenAI Ads measurement