Last updated: 21 June 2026

Kiteline Academy — Privacy Policy

This policy explains how Kiteline Academy (“we”, “us”) collects and uses personal data when you register, learn, or pay for courses at Kiteline Academy.

1. Data controller

Kiteline Academy is the data controller. Contact: contact@kiteline.uk

2. Data we collect

• Account data — name, email, phone (optional), password (hashed), country, language preference, and optional profile fields you choose to add.
• Learning data — course enrolments, progress, certificates, and support messages.
• Payment data — processed by Stripe; we store payment status and course access, not full card numbers.
• Security data — IP address, login attempts, session cookies (HttpOnly), optional authenticator-app 2FA secrets (encrypted at rest when Postgres is enabled).
• CAPTCHA — bot-check tokens from Cloudflare Turnstile or Google reCAPTCHA when enabled.

3. How we use data

• Provide courses, enrolment, certificates, and student support.
• Secure accounts (password hashing, rate limits, 2FA, email verification).
• Process payments and prevent fraud.
• Comply with law and respond to lawful requests.

4. Legal bases (UK GDPR / EU GDPR)

We rely on contract (delivering courses you purchase), legitimate interests (security and fraud prevention), consent (where required, e.g. marketing), and legal obligation where applicable.

5. Sharing data

We do not sell personal data. We may share data with:

• Hosting — Render (application hosting).
• Database — Neon Postgres (encrypted cloud database when configured).
• Payments — Stripe for checkout.
• Email — SMTP provider for verification and password reset.
• CAPTCHA — Cloudflare or Google for bot protection.

6. International transfers

Some providers may process data outside the UK/EEA. We use appropriate safeguards (standard contractual clauses or equivalent) where required.

7. Retention

We keep student records while your account is active and for a reasonable period afterwards for backups, tax, and legal compliance. You may request deletion subject to legal requirements.

8. Security

Passwords are hashed with scrypt. Sessions use HttpOnly, Secure cookies in production. HTTPS is required on kiteline.uk. Enable two-factor authentication in your student dashboard for extra protection.

9. Your rights

You may have rights to access, rectify, erase, restrict, object, and data portability. To exercise these rights email contact@kiteline.uk. You may complain to the ICO (ico.org.uk).

10. Children

Students must be at least 13 years old. Users under 18 should register with a parent or guardian’s permission where required by local law.

11. Changes

We may update this policy. The “Last updated” date will change when we do.

Return to Kiteline Academy