Last updated: 30 April 2026
Privacy Policy
VisionForge Academy is the controller of the data we hold about you. This page explains what we hold, why, who helps us process it, how long we keep it, and the rights you have under the UK GDPR and EU GDPR. If you want a copy in any other format, write to hello@visionforge.academy.
1. Who is the data controller?
VisionForge Academy. Registered office in Constantia, Cape Town. Our Data Protection Officer can be reached at hello@visionforge.academy. We respond within 30 days.
2. What data we hold
| Category | What it is | Why we hold it |
|---|---|---|
| Account email | The address you sign up with | Sign-in, password reset, account notices |
| Lesson interactions | Your replies in Sensei sessions, belt progression, honour points | Delivering the course, grading, progress tracking |
| Billing history | Stripe customer id, last four digits of card, invoice records | Processing payments, tax reporting, refunds |
| Error reports | Stack traces, browser, page URL, anonymised user id | Diagnosing crashes and improving reliability |
| Cookie preferences | Your choices on the consent banner | Honouring consent across visits |
3. Lawful basis (GDPR Article 6)
| Purpose | Lawful basis |
|---|---|
| Delivering belt courses you have paid for | Contract |
| Analytics cookies | Consent |
| Marketing cookies | Consent |
| Fraud and abuse detection | Legitimate interest |
| Tax records for billing | Legal obligation |
You can withdraw consent for analytics or marketing at any time. The cookie banner remembers your choice for 12 months and then asks again, so you stay in control.
4. Who processes your data
We use the following processors. EU resident data stays within the European Union (Frankfurt, eu-central-1) wherever we control the storage location.
| Processor | What they handle | Region |
|---|---|---|
| Amazon Web Services (Cognito) | Account credentials, sign-in tokens | eu-central-1 |
| Amazon Web Services (DynamoDB) | Lesson progress, purchases, cost ledger | eu-central-1 |
| Amazon Web Services (Bedrock) | Live AI responses for Sensei sessions | eu-central-1 |
| Amazon Web Services (SES) | Transactional email | eu-central-1 |
| Cartesia (via API) | Text-to-speech for Sensei voice | API call only, no persistent storage |
| Stripe | Card payments, invoices, refunds | UK / EU |
| Sentry | Error report aggregation | EU region |
We do not sell your personal data. We do not share it for advertising purposes outside what you explicitly consent to.
5. How long we keep it
| Data | Retention | Reason |
|---|---|---|
| Account email and credentials | Active life of account, plus 90 days | Account recovery window |
| Lesson interactions and progress | 24 months from last activity | Course continuity, learner support |
| Billing history | 7 years | Legal requirement (tax records) |
| Error reports | 30 days | Diagnostic relevance only |
| Cookie consent record | 12 months | Annual re-prompt for fresh consent |
6. Your rights
- Access: receive a copy of your personal data.
- Rectify: correct anything we hold that is wrong.
- Erase: ask us to delete your account and personal data.
- Port: receive your data in a machine-readable format.
- Object: ask us to stop processing on legitimate-interest grounds.
- Restrict: ask us to pause processing while a query is investigated.
To exercise any of these, raise a request via our endpoint:
POST /api/gdpr/dsar
Content-Type: application/json
{ "type": "access", "email": "you@example.com" }Or simply email hello@visionforge.academy with the type of request and the address on the account. We respond within 30 days, in line with GDPR Article 12.
7. International transfers
Your data is stored in the European Union. Where a processor operates outside the EU, we rely on Standard Contractual Clauses approved by the European Commission to ensure equivalent protection.
8. Children
VisionForge is not directed at children under 16. If you become aware that a child has provided personal data, write to hello@visionforge.academy and we will erase the account.
9. Changes to this policy
If we materially change how we use your data, we will email registered users and post a notice on the site. The "Last updated" line at the top shows the current version.
10. Cookies
See the dedicated cookie policy for the categories of cookie we set, what each one does, and how long it lasts.