Privacy policy

Who we are

The course is operated by Irontide Academy. We are the organisation responsible for your personal data under the Singapore Personal Data Protection Act and, where they apply to you, the EU and UK data protection regulations. Our designated data protection officer can be contacted at dpo@irontide.academy.

What we store

When you create an account we store your email address and the authentication data needed to sign you in.

As you study we store your course progress: which lessons you have opened and completed, your reading position, and the time you have spent with each lesson.

When you take an assessment we store your submitted answers, your score, and the result of each attempt.

If a certificate of completion is issued, we store the name you chose to print on it, its serial number, and the date of issue.

If you purchase the course, our payment provider collects your payment and billing details directly, including the billing country used to apply the correct tax at checkout, and shares with us a customer reference and a checkout reference; we never see or store your card details.

To protect the service we also keep short-lived security records, such as rate limiting entries, which include network addresses.

For each active sign-in we keep a record of the browser and device type, the approximate city and country derived from the network address at sign-in, and when it was last used. These are shown only to you, on your account page, so you can see where your account is signed in and sign out any device; they also enforce a limit on the number of devices signed in at once. Each record is deleted when that sign-in ends.

Why we process it

We process account, progress, assessment, purchase, and certificate data because it is necessary to provide the course you purchased and to issue and verify certificates. We process security records because we have a legitimate interest in protecting the service from abuse. We do not use your data for any other purpose.

What we do not do

We do not sell or share your data for advertising. The course contains no advertising networks, no social media trackers, and no third-party analytics scripts. The only cookies we set are the session cookies required to keep you signed in, and one preference cookie (irontide-theme) that remembers your day or night theme across irontide.academy and this site.

Who processes your data

Your data is held with a managed database, authentication, and file storage provider; payments are processed by Stripe; and the application runs on a cloud hosting provider whose servers keep standard request logs. Each provider processes data only to operate the service, under a data processing agreement, and may store it outside Singapore.

Retention and deletion

Your account data is kept while your account exists. If you ask us to delete your account, your progress, assessment attempts, and certificate records are removed. Note that deleting your account also removes the record behind your certificate serial, so public verification of that certificate will stop working; keep your downloaded copy if you delete your account. Purchase records are retained as long as tax and accounting law requires.

Your rights

You can request a copy of the data we hold about you, ask us to correct it, or ask us to delete your account. Write to dpo@irontide.academy from your registered email address. If you have a concern we have not resolved, you can also raise it with the data protection authority where you live.

Effective date: 4 September 2026.