Privacy Policy

CourseXpress is a trading name of Koar Group Limited, a company registered in Scotland (SC848652), registered office 5 South Charlotte Street, Edinburgh, EH2 4AN, United Kingdom ("we", "us"). This policy explains what personal data we handle when you use CourseXpress, why, and the choices you have. Contact us about anything here at support@coursexpress.io or by post at our registered office. We haven't appointed a data protection officer.

Creators (people who build courses) have an account with us; for their account, billing and the content they upload, we are the data controller.

Learners take courses that creators publish. For a learner's enrolment, progress, quiz answers and certificates in a creator's course, that creator decides how the data is used and is its controller; we process it on their behalf to run the course. For a learner's own CourseXpress account (sign-in, settings), we are the controller.

• Account details: your email address, name and display name, and sign-in records (handled by our authentication provider, which also holds any password).
• Course content: files you upload or choose to import (Excel, Word, PowerPoint, PDF, Google Docs, Slides and Sheets), the pictures and any personal data in them, your logo, and the courses, lessons and quizzes made from them.
• Learning activity: course enrolments, lesson progress, quiz answers and scores, and certificates, which show your name.
• Invitations and plan limits: the email address a creator enters to invite a learner, and a record when a learner can't join because a creator's plan is full.
• Billing: subscription status and history. Stripe collects and holds card details, billing address and any tax ID; we never see full card numbers.
• Messages: what you send us when you contact support.
• Technical data: IP address, browser and device details, pages requested, times and error reports, used for security, rate limiting and troubleshooting.

We get this data from you, from the creator who invites you, and from services you connect: Google if you sign in with it or import from Drive, and Stripe when you pay. You need to provide an email address to have an account, and payment details to buy a paid plan.

We don't ask for special category data, such as health information or religious beliefs, or use precise location. Please don't include this kind of data in course files unless you have a lawful basis to.

• To provide the service you signed up for: your account, building and hosting courses, tracking progress, issuing certificates (performance of a contract).
• To take payment and keep accounting records (contract; legal obligation).
• To keep the service secure and working: preventing abuse, limiting request rates, diagnosing errors (legitimate interests).
• To send essential service messages, such as about your account or billing (contract).
• To answer questions and complaints (contract; legitimate interests).
• To comply with the law and to establish or defend legal claims (legal obligation; legitimate interests).

Our legitimate interests are running a secure, reliable service and protecting our business, and you can object to this use (see section 11). If we ever need your consent for something, we'll ask first. We don't send marketing emails or make decisions with legal or similarly significant effects by automated means alone.

When you import a document, its text and pictures are sent to an AI model to draft the course: lesson text, quizzes and picture descriptions. Requests go through Vercel's AI Gateway to the model provider (currently Anthropic). The content is used only to produce your draft; we do not use it to train AI models, and we choose providers whose terms do not allow them to train on it.

We record how much AI processing each workspace uses (counts and sizes, not content) to apply plan allowances.

If you import from Google Drive, you choose each file in Google's own file picker, and we can access only the files you pick (the drive.file permission). We read a file only to import it into your course, store the access token encrypted, and never sell Google data or use it for advertising. As section 5 explains, the content of a file you import is sent to our AI providers to draft your course. If you sign in with Google, we receive your name and email address.

CourseXpress's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We use these service providers (processors) to run CourseXpress:

• Vercel: hosting, file storage for course pictures, and the AI Gateway
• Neon: database
• Clerk: sign-in, account security and sign-in emails (Clerk uses Cloudflare to protect sign-in)
• Stripe: payments
• Anthropic: AI drafting of imported content
• Google: file picker and Drive access you grant
• Upstash: rate limiting (IP addresses and account identifiers)
• Sentry: error monitoring (technical details of errors; we configure it not to collect IP addresses, cookies or what you type)

A creator can see the learners in their courses and their progress, scores and certificates. We don't sell personal data. We disclose data if the law requires it, to our professional advisers where needed, and to a buyer or successor if our business is sold or reorganised, who must protect it as this policy says.

Our main hosting and database are in London. Some providers process data outside the UK and EEA, mainly in the United States. Where they do, transfers are covered by the UK International Data Transfer Addendum or the EU Standard Contractual Clauses, or an adequacy decision such as the UK-US data bridge. Email us for more about these safeguards.

• Account data and content: until you delete your account (Settings, Delete account), which removes it straight away, along with your courses and their pictures. Copies in database backups are removed when those backups expire.
• Records we must keep, such as invoices and purchase records, are kept for as long as the law requires (generally six years in the UK), held by us or by Stripe.
• Security and error logs: up to 90 days.
• Records of learners who couldn't join because a plan was full: up to 90 days.
• Support messages: as long as needed to deal with them and any follow-up.

Data is encrypted in transit, and Google access tokens are encrypted at rest. Access is limited to what each part of the service needs. No system is perfectly secure; if a breach affects your data, we'll tell you and the regulator as the law requires.

You can ask to access, correct, delete or export your personal data, object to or restrict how we use it, and withdraw consent where we rely on it. These rights aren't absolute in every case, and we'll explain if one doesn't apply. You can delete your account yourself at any time in Settings. For anything else, email support@coursexpress.io. We normally reply within one month and don't charge. We may need to confirm who you are. If you're a learner and your request concerns a creator's course, we'll pass it to the creator or help them respond.

If you live elsewhere, such as the US, Canada, Australia or South Africa, local law may give you similar or additional rights. Contact us in the same way, and we'll respond as that law requires.

If you're unhappy with how we've handled your data, please tell us first at support@coursexpress.io. We'll acknowledge your complaint within 30 days, look into it without undue delay, keep you updated and tell you the outcome.

You can also complain at any time to the UK Information Commissioner's Office (ico.org.uk/make-a-complaint, 0303 123 1113, or Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF) or your local data protection authority.

We use only cookies needed to run the service: keeping you signed in, security, and remembering settings such as dark mode. We don't use advertising or tracking cookies. Our Cookie Policy lists them.

CourseXpress accounts are for people aged 16 and over. Creators who publish courses for younger learners are responsible for having the consent the law requires. If you think a child under 16 has an account, tell us at support@coursexpress.io and we'll deal with it.

We'll post changes here and update the date above. If a change materially affects how we use your data, we'll tell you by email or in the app first.