Privacy Notice for Academies

This notice is written for the academy. It covers the personal data of the people who work for you, and — because you will be asked about it — what we do with the learner data you are responsible for. A learner wanting to know what we hold about them should read the Privacy Notice for Account Holders.

1. Who we are

Alethris is operated by iSoterik Limited (iSoterik, we, us), a company registered in Nigeria with number RC 9910229, whose registered office is at No 22 Benin Street, Malali, Kaduna. This notice is given under the Nigeria Data Protection Act 2023 (the Act).

2. Two kinds of personal data pass through your academy

Data we decide about. Every person at your academy holds an Alethris account that exists independently of you: their name and email address, their password, their sign-in sessions, their notifications, their Skills Passport, and any support case they raise with us. We decide how those work and how long we keep them, and we are the controller of that data. You do not control it and you cannot reach it — removing someone's membership does not touch their account.

Data you decide about, which we hold for you. Everything your academy asks, records and judges: application answers, including those from people who apply without an account, offers, enrolments and fees, sponsors and their contacts, lesson progress, submissions, assessments and feedback, attendance, competency evidence, credentials, risk flags, check-ins and interventions, announcements, and the questions your staff and learners ask your assistant. You decide what to collect and why, and you are the controller of that data. We process it on your instructions, as your processor, and do not use it for anything else. Clause 13 of the Terms of Service for Academies sets out what we commit to as your processor.

Keeping credentials verifiable after a learner leaves, or after your academy closes, is our own decision, and for that purpose we are responsible for the credential records.

3. What we hold about the people who work for you

For each member of your academy we hold their account identity, the roles you gave them, their membership status, the invitation that brought them in, and an audit record of the significant actions they take in your academy — who published a programme, who issued a credential, who changed a settlement account. Audit records say who did what; they do not record where the person was or what device they used.

We hold the assessment decisions your staff make under their own name, and show that name to the learner, because a credential is only worth something if the judgement behind it belongs to a person. For the same reason, the verification page of every credential that rests on an assessment shows the assessor's name, how and when they judged the work, and whether they taught the learner's cohort, and a second assessor who confirmed the evidence is named there too. Anyone holding the credential's code can read these for as long as the credential exists. The name on a credential is the learner's, as the member of your staff who issued it confirmed it against your records. The public page of each cohort names the instructors and mentors assigned to it.

Your registration, if you give it. If an owner or administrator gives us your academy's registration with the Corporate Affairs Commission, we hold its kind, number and registered name, who entered them and when, and our check of them: who on our staff checked them, when, the outcome, any note on what did not match and any accreditation they saw evidence of. A business name can be a person's own name. Once the registration is verified, the registered name, the number, when it was checked and those accreditations are shown on the verification page of every credential your academy has issued and on every page of your academy's public site, and the registered name and number on each learner's own page for those credentials; Skills Passports show only the mark. We erase it when you remove it or when your academy is erased after closing.

Our invitation, if we invited you. While Alethris admits academies by invitation, we keep the invitation that let you start yours: the address we sent it to, our note of why, who on our staff sent it, and when it was used and for which academy. Our support staff can read it, and we delete it twelve months after it is used, withdrawn or runs out.

Signatories, if you name them. We hold each signatory's name, role and any signature image you upload for your certificates, and who last changed them. They are printed on every certificate issued while they are named, and anyone holding a credential's code can download its certificate. A certificate keeps what was printed on it after you change them or your academy closes. When your academy is erased after closing, the signatories and their signature images are deleted.

For your owners and finance administrators we also hold what is needed to run your subscription and your settlement: your billing name and email address, your invoices, and your settlement account. Its full number is encrypted until Paystack has created your academy's subaccount, and after that we keep only its last four digits.

A support case your staff raise from your workspace is visible to all of your owners and administrators, to your finance administrators when it concerns billing or a learner's payment, and to our support and security staff. Its content is encrypted in our database. When a member of your staff closes their Alethris account, what they wrote in your academy's cases is cleared; our replies and your other staff's messages stay.

Each staff member's conversations with the assistant are private to them; owners and administrators cannot read a colleague's. A staff member may choose to receive a weekly summary email, which carries counts of what is waiting for them, how long the oldest item has waited and any amount owed, and nothing else.

4. What we do with the learner data you are responsible for

We process it to run the service you have subscribed to, and for nothing else. Concretely: to deliver your curriculum to the learners you admit, to store what they hand in, to record what your assessors decide, to record attendance, to issue and verify the credentials you award, to take payment and settle it to you, to notify people about their own learning, to answer questions through the assistants you have turned on, and to raise the risk flags your rules define.

People who apply without an account. Unless you choose otherwise in your academy's admission settings, someone may apply with only their name and an email address. To confirm the address we email it a six-digit code, which we never store; the record of the request, with the name and address, is deleted a day after the code runs out, and to stop misuse we count code requests against a hash of the address. Their application is held like any other, under the name and address they gave, and we email them about it in your name. If you accept them, we find their existing account or make one from those details, and they set it up from an email we send; an account they never set up is erased once its offer lapses. If they never take up an account, their name, email address and answers are cleared from the application twelve months after it closed. Until they hold an account, a request they make about their data comes to you, or to us to pass on to you.

When a credential you issued is looked up, we count it, and you and the learner can see how often and when last; we never record who looked. A learner may choose to show assessed work a credential was earned on to anyone who verifies it, exactly as they handed it in. That is the learner's decision about their own work, made through their own account, and they can withdraw it at any time.

We do not use it to train AI models, we do not use it for advertising, we do not sell it, we do not enrich it from outside sources, and we do not use one academy's data to serve another. Your records are kept apart from every other academy's by the database itself, not only by our code.

Risk rules run from the start. Every academy has a set of rules that flag learners who may need attention — for example, seven days without counted activity, two absences in the last three sessions, or a required assignment still missing two days after it was due. You can adjust or switch off each rule for the academy. A flag never changes a learner's enrolment, assessment, access, payment, completion or credential. When a learner's case reaches high priority — from a high-severity flag, or a lesser one left open for a week or with a follow-up overdue — the instructors and mentors of their cohort are alerted once in Alethris, or your owners and administrators where the cohort has none, and whoever is assigned a check-in is told.

Some of what you record is kept from learners on purpose: risk flags and their evidence, check-ins and intervention notes, private assessment notes and the notes against each rubric criterion, the reasons for overriding a rubric's result or replacing a decision, the note a second assessor keeps when confirming the evidence behind a credential, attendance notes and the reasons for correcting a mark, admission decision notes, and the reasons a credential was revoked or replaced. The Privacy Notice for Account Holders says so openly, so that a learner is not misled about what exists — but the notes themselves stay yours.

Who at your academy sees what follows the roles you assign and where you seat your staff. Application answers are visible to owners and administrators. Submissions, assessments and attendance are visible to owners and administrators, and to the instructors, mentors and assessors seated on the learner's cohort; self-paced work is visible to the staff seated on its programme or, while nobody is seated there, to all of your teaching staff. Owners, administrators and finance administrators can see the academy's whole list of learners, with their names, email addresses and learner numbers; instructors, mentors and assessors see only the learners of the cohorts and self-paced programmes they are seated on. Payments are visible to owners, administrators and finance administrators.

5. Who at iSoterik can reach any of it

Our staff work through named roles — support, security, finance, trust and safety, content, AI, analytics and access administration. None of them is a general administrator, and a role grants only its own permissions.

• Support and security operators can look up a person's account — name, email address, status and the academies they belong to — after stating a reason and re-entering their password. Looking at a summary of a record at your academy, such as the state of an enrolment or a certificate, also needs an open support case. Both are written to registers that cannot be edited or deleted, and a lookup that cannot be recorded returns nothing. These operators also read support cases.
• Finance operators see your billing details, your settlement account's bank, account name and last four digits, and the refunds, disputes and invoices on your academy.
• Trust and safety operators can view any Skills Passport in order to moderate it.
• Operators who can read the academy register — support, security, finance and analytics — see your billing name and email address, the registration you give us and the outcome of our check, without a support case. Only support and security operators record that check, with a re-entered password.

Outside those boundaries — except in a support session your academy allows, described below — are your learners' submissions, assessment feedback, private notes and notification content. Always outside them are AI conversations and outputs, full bank account numbers, payment and video provider payloads, and where files are stored.

Our staff cannot sign in as one of your members or learn their password, and they cannot change an admission, enrolment, assessment, completion or credential decision. To sort out a problem, a support operator may ask to see your academy as one of your members sees it, in a support session. That needs an open support case, the member's permission and your academy's: an Owner switching on "Let Support look without asking", which covers only cases your academy or its members raise, or an Owner allowing the request, which needs their password. We treat an Owner's permission as your instruction to process your learners' data in this way. A session can only view, unless changes were allowed: when the fix is in your academy's setup — its settings, courses, cohorts or templates — the operator may ask to make that change as the member, for at most 24 hours, and both the member and an Owner must allow it each time, with their passwords; the switch never covers it. Whatever was allowed, a session cannot send, pay, publish, decide or accept anything in your academy's name, cannot change a price or a refund policy, cannot change who belongs to it, and never shows AI conversations or outputs. It lasts at most an hour. Your Owners are told when we ask and when a session enters the academy, and can end it, or withdraw the academy's permission, at any time; switching the setting off ends every session it allowed at once. Each session that entered the academy is listed in your settings — when, how long, as whom, what it opened and how many changes it made — each change is in your audit log as made by Alethris Support as that member, and the operator is not named, as with replies to a case. What they can do to your academy — retrying failed work, governance, finance actions and the rest — is listed in clause 14 of the Terms of Service for Academies. The governance powers are the widest: a security operator may suspend a person's account or end their sessions, and may make your academy read-only or suspend it, and a trust and safety operator may suspend a Skills Passport's public page and links. Each is done with a recorded reason and a re-entered password, and none deletes anything.

A small number of engineers who run the platform have technical access to its systems, and use it only to operate, repair and secure the service.

6. Providers who process this data for us

Paystack receives each paying learner's email address and the payment's details, your billing email address when you pay for your plan, and, when your settlement account is set up, your bank details. Mux receives the video file and nothing that identifies your academy or your learners in it. Learners' browsers fetch video directly from Mux and YouTube, so those providers see a learner's connection address and your academy's web address.

The AI providers receive what each task needs to answer: the question; passages of your material — published or, for a drafting task, the draft being worked on; the text of any document a member of your staff gives a task to draft from, up to ten documents and 250,000 characters of each; and records the person asking may read — which, for staff, can include learners' names, progress, attendance, fees and risk flags. We send no account identifiers, and we instruct OpenAI not to store what we send. Under both providers' terms for this kind of use, they do not train their models on it, although they may keep it for a limited period to detect misuse. The model that makes your material searchable runs on our own servers, not at a third party.

We will tell you at least thirty days before adding or replacing a provider that processes personal data for your academy, so that you can object; clause 13 of the Terms of Service for Academies applies.

7. Where it is held, and transfers out of Nigeria

Alethris runs in the European Union: its servers and databases are in the Netherlands, and its files, email and backups are in Ireland. Some providers in clause 6 are in the United States. Personal data about your staff and your learners is therefore transferred out of Nigeria as a matter of course.

We make these transfers under written terms with each provider that require it to protect the data to the standard the Act sets and, where those terms are not enough on their own, because the transfer is necessary to provide the service your learners and staff use.

8. How long we keep things

Most of your academy's records are kept for as long as your academy is open. The periods below are the ones the platform applies to particular records, including what happens to them after it closes.

Credentials are held indefinitely, and outlive both your academy and a learner's membership of it, so that an employer can still verify one years later.

9. Security

Passwords are stored as scrypt hashes with a unique salt and a secret of ours, never in a form that can be turned back into the password. One-time links — for verification, invitations, password resets and share links — are stored only as hashes.

Settlement and bank-transfer account numbers, support case content, AI conversations, drafts and instructions, the email addresses we deliver to, payment and video providers' notifications, and audit details are encrypted in the database, each bound to its field and, where it has one, its academy, so that a value copied into another field or academy fails to decrypt rather than opening.

Files are uploaded straight from the browser to private storage through a signed form that lasts five minutes, and checked for what they actually are. In production, files are scanned for malware before they can be used, and lesson resources, assignment files and documents for the assistants are held back if they cannot be scanned. Nothing in storage is public. An image your academy's pages or certificates show — a logo, a photograph, a programme cover or a signature — is served through a signed link that stays the same for a day and lasts twenty-five hours, and visitors' browsers may keep a copy of it. Once an image is deleted, its address stops serving it.

Requests to your academy are checked against your academy's current state, not against a cached decision, and the database itself keeps each academy's records apart.

Every production database is backed up nightly and encrypted before it leaves our servers, into a storage account kept separate from the service.

10. What we expect of you

You decide what to ask your learners and why, so the lawful basis for collecting it is yours to establish. Tell your learners what you collect and why; this notice covers what we do, not what you do.

Ask only for what you need. Your application forms can ask any question, including dates; do not ask for more than your admissions actually use. Attendance notes can hold sensitive reasons, such as health; record only what is necessary.

Give people only the roles they need, and withdraw a membership promptly when someone should no longer have access. We cannot judge who at your academy should see a learner's record; your role assignments are the answer to that question. Tell your instructors and mentors that the public page of each cohort they are assigned to names them.

Do not put passwords, answer keys, private rubrics or confidential governance material into the instructions you give the assistants. Those instructions shape behaviour; they are not a security boundary and they are not secret.

Name a signatory only with their agreement, and upload only a signature they have given you for the purpose.

The risk rules evaluate your learners automatically. The basis for that, and what you tell your learners about it, are yours to establish.

Do not put personal data on your public homepage without permission. The team, testimonial, logo and outcome sections carry claims you confirm when you publish, and permission from anyone named or pictured is yours to obtain — including where our assistant drafted the text. Taking a photograph off your homepage does not delete it. If someone asks you to remove one, publish your homepage without it, then delete it from your image library: a photograph only earlier published versions used can be deleted, and restoring such a version leaves its place empty. Photographs and programme covers stay in your library until you delete them.

11. Requests from your learners

A learner may ask us for a copy of their data, or to correct or erase it. Where the request concerns data you are responsible for, we pass it to you and act on your instruction rather than deciding on your behalf. Where it concerns their account, their Passport or a case they raised with us, we handle it ourselves and do not need to tell you.

A support case a learner raises with us is not visible to you — not to the owner, not to an administrator, not to finance. If it cannot be resolved without involving you, we ask the learner first.

A learner can take a copy of their own data without asking either of us, from their account. It holds what Alethris holds about them as a person and as your learner: their account, their memberships, what they applied for and the places they took up, the lessons they opened, their attendance, what they handed in and the assessments of it, what they paid, and what they asked an assistant. It holds nothing about your academy's own position — not your fees, not your share of a payment, not the notes your staff wrote about them, not anything we keep from them on purpose. Your owners and administrators are told each time one of your members takes a copy, and are not shown it.

A learner can close their account. Thirty days later their account's name and email are replaced with a marker that identifies nobody, and their membership of your academy ends, with any place not yet finished and any application still waiting. Your records about them stay — their applications and places, their work and the decisions on it, their completions, competency evidence and risk records — but take on the marker in place of their name and email. Only the credentials you issued keep the name they were issued with.

You can close the academy yourself, from its Profile settings, once any paid subscription that would renew, or whose last renewal failed, is set to end, any Enterprise agreement has reached the date it is paid through, and no cohort is still teaching; closing sets a free trial to end. It becomes read-only at once, every member is told, and it can be kept for thirty days; after that its material, branding, public presence and the risk records its staff kept about learners are removed. What the credentials it issued are built on stays, because a credential that cannot be traced is worth nothing. Clause 16 of the Terms of Service for Academies sets this out in full.

There is no academy-wide export yet. Until there is, an owner can ask us in writing for the academy's learner, enrolment, assessment, attendance and payment records, as clause 16 of the Terms of Service for Academies describes.

12. If something goes wrong

If a breach of security affects your academy's personal data, we will tell your owners without undue delay, and within forty-eight hours of becoming aware of it: what happened, which data and people it concerns as far as we know, what we are doing about it and what you may need to do. We will help you meet your own obligations, including notifying the Nigeria Data Protection Commission within seventy-two hours where the Act requires, and telling the people affected.

Where a breach affects data we are responsible for — people's accounts — we notify the Commission and the people affected ourselves.

13. Changes to this notice

We will publish any change here with a new version number and the date it takes effect. Where a change materially affects how we process data you are responsible for, we will tell you at least thirty days before it takes effect.

14. Contact

iSoterik Limited, No 22 Benin Street, Malali, Kaduna.

• Privacy: privacy@alethris.com
• Security: security@alethris.com
• Supervisory authority: the Nigeria Data Protection Commission, ndpc.gov.ng