Privacy and data retention

Updated September 2026 · Plain English, no legal padding

This course is free, carries no advertising, and has no commercial interest in your data. We collect the minimum needed to save your progress and to issue a certificate that other people can verify. This page explains exactly what that means.

The short version. We store your name, email, a hashed password, which criteria you have ticked, and — only if you leave it switched on — the text you write into exercises. You can download everything or delete it all at any time. Nothing is shared with anyone. Issued certificates outlive deleted accounts so they remain checkable.

Who is responsible

This course is operated by VenzAura LLC under the name JKLM Adult AI Curriculum. For any question about your data, contact ayaz@venzaura.com. We aim to respond within five working days.

What we collect and why

Data	Why we need it	Optional?
Your name	Appears on your certificate and in verification results	Required
Email address	Identifies your account so you can sign back in	Required
Password	Hashed with scrypt and a unique salt. We never hold it in readable form and cannot recover it for you	Required
Recovery code	Also hashed. The only way back in if you forget your password, since we send no email	Required
Completion criteria	Records your progress and is part of what a certificate is issued against	Required
Project submissions	When you submit each of the five projects we record the date, the length of your write-up and a one-way fingerprint of it. This is the evidence behind your certificate	Required to earn a certificate
Quiz scores	Shown back to you; not used for anything else	Required
Exercise and project writing	Lets your written work follow you between devices	Optional — can be switched off
Account created and last used dates	Drives the retention schedule below	Required

Worth reading before you start. Every project in this course asks you to use your own real work rather than invented examples — that is what makes the course useful. If your work is commercially sensitive or covered by a confidentiality agreement, switch off “save my exercise and project writing” at signup or later in your account. Your progress and certificate work exactly the same; only the written text stops being stored on our servers. Project submission still works, because the fingerprint we keep is a one-way hash — it records that a write-up of a given length existed at a given moment without us holding the words.

What we never collect

Payment details of any kind. The course is free and there is no payment system to collect them with.
Analytics, tracking pixels, advertising identifiers or third-party scripts.
A history of your IP addresses or device fingerprints.
Nothing is ever sold, rented, or shared for marketing. We do use a small number of service providers to run the course — they are named in full below and act only on our instructions.

Service providers who process data for us

We are a small operation and do not run our own servers. A handful of providers process data on our behalf, under contract, solely to deliver the course. None of them may use your data for their own purposes.

Provider	What they handle	Where and why
Netlify Active now	Hosting and the database holding your account, progress and written work	United States. This is where the course runs and where your data is stored at rest.
Resend Active now	Delivering email: confirmation, password resets, your certificate, dormancy warnings	United States. Receives your email address and name in order to send the message. Does not receive your progress or written work.
Google Only if you use Google sign-in	Confirming you control a Google account	Only involved if you choose that sign-in method. See below.
LinkedIn Only if you use LinkedIn sign-in	Confirming you control a LinkedIn account	Only involved if you choose that sign-in method. See below.

If we add or change a provider, this table is updated and the date at the top of the page changes.

Signing in with Google or LinkedIn

You may create your account with an email and password, or by using an existing Google or LinkedIn account. Both routes give you the same course; the choice is entirely yours and neither is required.

What we receive if you use it

Your name as it appears on that account
Your email address
Whether the provider has confirmed that email address
A provider account identifier, so we can recognise you when you return

That is the whole list. We request the minimum scope available — sign-in and basic profile only.

What we never receive

Your password for that account. It is never shown to us and we could not see it if we tried.
Your contacts, connections, files, calendar, messages or posts.
Permission to act on that account. We cannot post, send, or change anything on your behalf.

What the provider learns about you

Google or LinkedIn will know that you signed in to JKLM Adult AI Curriculum, and when. They do not receive your progress, your quiz results, your written work, or whether you completed the course. If you would rather they knew nothing at all, use email and password instead.

Why we offer it. A name taken from a signed-in Google or LinkedIn profile carries a little more weight than a name typed into a box, so certificates issued that way note the sign-in method used. It also confirms your email automatically, which means we can reach you about your certificate without a separate confirmation step.

Disconnecting

You can revoke our access at any time from your Google or LinkedIn account settings — neither of us needs the other's permission. Doing so does not delete your JKLM account or your progress; it means you sign in with a password instead. If you have never set one, use the recovery code you were given at signup, or ask for a reset link.

How long we keep it

What	Kept for	What happens then
Your account and progress	While in active use	Retained as long as you sign in at least once every 24 months, so you can take breaks freely
Sign-in sessions	90 days	Expired sessions are deleted automatically each day. You sign in again; your progress is untouched
Dormant accounts	24 months idle	Flagged at 23 months, then deleted automatically. Any certificate already issued survives
Issued certificates	Indefinitely	Reference, name and issue date only. A certificate nobody can check is worthless, so these are kept
Security log	400 days	Records account creation, sign-ins and deletions for security. Pruned automatically

This is enforced, not just promised. A scheduled job runs every day and actually carries out the deletions described above. It is not a policy that depends on somebody remembering to act on it.

Your controls

Take your data with you

From your account page, Download all my data returns a complete JSON file containing everything held about you. Password and recovery hashes are excluded, since exporting them would create a risk rather than serve you.

Delete your account

From the same page, deletion is immediate and permanent. Your name, email, progress and written work are removed from our servers straight away. You will be asked one question: whether to keep any certificate you have earned verifiable.

Keep it verifiable (recommended) — only the reference number, the name on the certificate and the issue date are retained, so employers can still check it. Everything else goes.
Remove it entirely — the certificate is destroyed and will fail verification permanently. This cannot be reversed.

Stop storing your writing

Switching off exercise storage erases the text already held on our servers immediately and stops any further text being sent. Your writing stays in the browser you typed it in.

Security

Passwords are hashed with scrypt using a unique per-user salt, and compared in constant time.
Recovery codes are hashed the same way and shown once at signup, never again.
Sign-in and recovery attempts are rate limited — six failures locks that account for fifteen minutes.
All traffic is served over HTTPS.
Certificates are issued only after the server independently confirms all twenty-five criteria in its own record. A modified browser cannot obtain one.

An honest limitation. This course sends no email. That means we cannot verify that an email address genuinely belongs to you, and we cannot contact you if something goes wrong. It also means your recovery code is the sole route back into your account — lose it and your progress cannot be recovered by us or by anyone.

If you are in the UK or EU

Our lawful basis for holding your account data is performance of a contract — you asked us to run a course for you and save your progress. Storing your written work is separate and rests on consent, which is why it is a switch you control and can withdraw at any time without losing anything else. Using Google or LinkedIn to sign in also rests on consent, given at the moment you choose that option rather than entering a password.

Our providers in the table above are processors acting under contract. Netlify and Resend are based in the United States; transfers rely on their standard contractual clauses. We hold no special category data — no health information, no biometrics, no identity documents — and we have no plans to collect any.

You have the right to access, correct, export, restrict or erase your data. Access, export and erasure are available immediately from your account page without needing to ask. For correction or any other request, email ayaz@venzaura.com.

Changes to this policy

If we change what we collect or how long we keep it, this page is updated and the date at the top changes. We will not begin collecting anything new without saying so here first.

JKLM Adult AI Curriculum · operated by VenzAura LLC
Questions about your data: ayaz@venzaura.com

Return to the course · Verify a certificate