Privacy Policy | 9k.school

Who controls your data

9K LABS LTD operates 9k School, a 9k Labs product, and is the controller responsible for the personal data described in this policy.

The company is registered in England and Wales under company number 16423917. Its registered office is 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ. You can contact us using the email address at the bottom of this page.

When you join the waitlist

We store your email address, the language you were reading the site in, and the time you signed up. If you answer the optional questions, we also store which courses interest you, your profession, and your experience level. If you type a WhatsApp number, we store it together with the time you gave it. If you arrived through one of our links that names a campaign, such as a link in a video description or an ad, we also store that campaign's name with your signup.

We use this to tell you when the courses launch and to decide which courses to build first, and the campaign name to learn which of our links bring people to the waitlist. The country your connection comes from is used only to preselect the country code in the phone field and to pick the regional price the course pages and course cards show you and a purchase charges; it is not saved with your signup, and an order keeps the price region it picked, not your connection's country. Once you have an account, that country is also kept with each sign-in and with the lesson video your account has open, as the If you create an account section explains.

The WhatsApp number is optional. Typing one is your consent to receive a message from us about the launch and the courses you asked about, and we record the time you gave it. We do not use it for anything else, and we never call it.

To take it back, email us from the address you signed up with and we will remove the number.

If you create an account

An account stores your name, your email address, whether you have confirmed that address, and a scrambled (hashed) version of your password, never the password itself. Each time you sign in we keep a record of the session, including the IP address, the browser and the country it came from. Your account's picture is drawn from its id by code that is part of this site, on our servers and in your browser; nothing is sent to, or fetched from, another service to make it. On your Account settings page you can see the browsers and devices signed in to your account, each with its browser, its operating system, the country it signed in from, the day it signed in and the day it was last active, but not its IP address, and sign out any of them other than the one you are using, which deletes its session record.

We also keep an activity log tied to your account: when you signed in, and from which country; when your email address was confirmed, by its link, by resetting your password, or by us on your behalf; when you started a purchase; when a course was granted to you or removed; when we signed your account out of every device; when your account was given, or had removed, access to run the site as an administrator; when you changed your name, without keeping the old or the new name; when we corrected your name or email address at your request, without keeping the old or the new one, and, for an address, how many of your devices were signed out with it; when you changed your password, and whether your other devices were signed out with it; when you signed out one of your other devices, or all of them, and how many; when a new sign-in, or we, signed one of your devices out; with any single device that is signed out, its browser, its operating system, its country and when it had signed in; for each lesson, the first time each day that you opened its video; for each lesson file, the first time each day that you downloaded it; for each lesson, the first time each day that you tried to open its video, or download one of its files, and could not, including because another of your devices had a video open; for each lesson, the first time each day that you moved its video to the device you were using while another had one open, with the country of each of the two devices; when we removed one of your lesson comments, with the text of the comment; and when we closed, reopened or deleted your account, with the reason for a closure. What the log records about payments and refunds is described in the When you buy a course section.

When you start a lesson video, a short code is shown in small print in a corner of the video for its first 20 seconds, so that a recording of a lesson that is shared can be traced back to the account it came from and the day it was watched. The code stays the same for a lesson through the day, and it is kept in the activity log with the record of the video first being opened that day. A course's intro video, which anyone can watch, shows no code. We also use these records to count how many of a course's lesson videos you opened after buying it, which we see beside your order to check a refund against the Refund Policy.

Each browser you are signed in on counts as one of your devices. Your account can be signed in on up to two devices at a time: signing in on another one signs you out on the one you used longest ago, and deletes any session records of yours that had already expired. Lesson videos play on one device at a time. While a lesson video is open, we keep one record for your account: which of your devices it is on, which lesson, when that device last asked for the video, and the country its connection comes from. Opening a video on another device within about ten minutes of that asks you first, and moving the video there stops it on the first device.

Sharing course access is against our terms. To find accounts that are being shared, the activity log also keeps a note for us when your account signs in from a country that none of your other signed-in devices is in; when signing in signs out a device that had signed in less than a day before; and when you move a video to a device in a different country from the one that had it open. A note keeps the countries involved and, for a device that was signed out, its browser and operating system, never an IP address. Nothing happens to your account because of a note: on the pages that only we can open to run the site, we see the notes beside the devices your account is signed in on, each as your Account settings page shows it, and we may sign a device out, contact you, or act as our terms describe.

To slow down password guessing and other abuse, every request to our sign-in service is counted per IP address, whether or not you have an account: signing in, creating an account, asking for a password reset or a new confirmation link, changing your name or your password, seeing or signing out your devices, and the check a page makes to see whether you are signed in, which pages make for visitors who are not signed in too. Each count is stored with the IP address, lasts about a minute, and is deleted after it expires, as later requests arrive.

When you are enrolled in a course, we also store your enrolment and which lessons you have completed. When you have completed every lesson of a course, we store the date, and show it with the name on your account on a certificate of completion that only you can open, while you are enrolled.

When you are enrolled in a course, you can rate each of its lessons from one to five stars and leave one comment on each lesson. We store your rating, with when you gave it and when you last changed it, and your comment, with when you posted it; while you are enrolled you can change your rating. Anyone who can open the lesson sees your comment with the name on your account and the date you posted it, and sees the lesson's average rating and how many ratings it has; they never see your email address or which rating is yours. While you can open the lesson, you can delete your comment yourself on its page, which removes it at once, and, while you are enrolled, post a new one. We may remove a comment that breaks our terms. On the pages that only we can open to run the site, we see each comment with the account it came from and that account's rating of the lesson.

We may close an account as our terms allow: when it is used to attack the site, to share course access with others, or to break the terms. A closed account is signed out on every device and can no longer sign in. Nothing else about it is deleted, and it is kept as this page describes. If we closed it by mistake, we reopen it.

Email we send you

We send our email through Resend, an email service that sends it on our behalf. These kinds of email go through it: the announcement that a course has launched, which goes to everyone on the waitlist who chose that course or did not choose any; the link to confirm your email address when you create an account; the link to reset your password if you ask for one; an email telling you your password was changed, when you change it from your Account settings page; when someone tries to create an account with an address that already has one, an email to that address saying so; and, for a course you buy, an email when we confirm that the money for your local transfer arrived and your access is open, when we close a local-transfer order you told us you paid because the money did not arrive, and when an order is refunded, saying whether your access to the course has ended. We send no other email through it today.

For the waitlist, Resend holds a copy of your email address, the language you signed up in, and which courses' announcements you will get: the courses you chose, or every course if you did not choose one. That is how each course's announcement reaches the right people, in their language. It does not receive your WhatsApp number, your profession, or your experience level. The copy is made when you sign up, and once for the people who signed up before we started using Resend; it is brought up to date before each course is announced.

For your account, Resend receives your email address and each message we send you, which carries a link: the confirmation link when you create the account, and again whenever you enter the right password to sign in before confirming it, or ask for a new one; the reset link when you ask to reset your password; the email telling you your password was changed, with a link to reset it; and, if someone tries to create an account with your address, the email saying so, with links to sign in and to reset your password. For an order, Resend receives your email address and the email about it, which names the course and the order number and links to the course, the order, or your orders page. It keeps each message, like every email it sends for us, together with a record of whether it was delivered.

Resend stores all of this in the United States. It deletes each email it sent for us, and its delivery record, after 30 days. Your address, your language and the courses whose announcements you will get stay in Resend for as long as your waitlist entry exists: when we delete the entry, we delete them from Resend with it.

Every announcement carries an unsubscribe link. Using it tells Resend to send you no more announcements from us. It does not delete your waitlist entry; to have that deleted, email us as the Your rights and choices section explains.

Bot protection

Our forms use Cloudflare Turnstile to check that a submission comes from a person. It loads a small Cloudflare script in your browser, and when you submit a form we send its token to Cloudflare to verify it. Cloudflare processes your connection details for that check under its own privacy policy.

Hosting, storage, and analytics

The site runs on Cloudflare Workers, and everything above is stored in a Cloudflare D1 database; the copy that Resend holds is described in the Email we send you section. Cloudflare Web Analytics gives us aggregated traffic figures, such as how many people visited which pages, without cookies and without tracking you across sites. Course videos are streamed from Cloudflare Stream. The link that plays a video includes your IP address, so that it only plays on your internet connection, and it stops working after about ten minutes; Cloudflare checks it while you watch. We do not store that address with the video or in the activity log.

We also use Google Analytics to understand how visitors find and use the site. When a page loads, the site sends Google the page address, the page you came from, your browser, device and screen size, your language, and an approximate location worked out from your IP address. While you use a page, it also records interactions such as how far you scroll, which links to other sites you click, and which files you download. Google Analytics does not store the IP address itself. We do not link this to your waitlist entry or your account, and we have not connected it to any advertising service. Google processes it under its own privacy policy.

Cloudflare also keeps the site's request logs for us, for at most 7 days, so we can find and fix what goes wrong. Each entry records one request to the site: the address asked for and when; your browser and the other details it sends with the request, such as your language and the page you came from; your IP address and the approximate location Cloudflare works out from it; and what the site answered, with anything the site logged while answering, such as an error, which can name your account by its internal ID. The address asked for can include the code that a link in one of our emails carries, and the code in a confirmation link carries your email address. Cookie values are hidden from these logs.

We also use Sentry, with the data kept in its EU region in Germany, to find and fix errors. When the site runs into an error, in your browser or on our servers, it sends Sentry a report: the error and where in the site's code it happened, which can name your account by its internal ID; the address of the page or request, without anything after a question mark in it; your browser and device, your language and your time zone; and, from your browser, what led up to the error, such as the pages you opened, what you clicked and the requests the page made to the site, but not what you typed. Sentry also receives how long the site takes to load pages and answer requests, with the names of the steps it took (such as which page or which kind of database lookup), never what they contained. When an error happens in your browser, it also receives a recording of the minute or so before it and of the rest of that visit, in which every piece of text, everything you typed, and every image and video are hidden, and lesson content, your account menu and the admin area are blanked out. A report can also carry the identifier PostHog gives your visit, so we can find the same visit in PostHog. A report leaves out your name, email address, IP address, cookies and anything you sent in a form, and Sentry does not load at all on a visit that comes from a password reset link.

Usage analytics and session recordings

We use PostHog, with the data kept in its EU region, to see how the site and the courses are used and to find what is broken. It records the pages you open, what you click, the page you came from, your browser and device, your IP address and the approximate location worked out from it, and errors the site runs into. It also makes session recordings: a replay of how you moved through a page and what was on the screen, with everything you type hidden. A recording leaves out course videos, with what is shown over them, and everything in a lesson except its title and its place in the course: its text, code, quizzes, notes, links and files, and its ratings and comments. It also leaves out your certificates of completion and the list of devices on your Account settings page, and shows nothing of the pages that only we can open to run the site, where learners' details appear. PostHog's AI features review some of these recordings to spot pages that are broken or frustrating to use.

On the waitlist, PostHog records that you joined, which courses you picked, whether you gave a WhatsApp number, and the campaign named by the link you arrived through, if it named one, but not your email address or the number itself. In the terminal on the home page, it records which command or kind of question you typed, from a fixed list, but not the words you typed. Once you sign in or create an account, what PostHog records is linked to your account, including your name and email address. It also records what you do as a learner: creating your account, signing in, starting a purchase and, for a Paddle order, whether the payment went through, a course being granted to you, marking lessons complete, whether your answers to lesson quizzes were right, and downloading lesson files.

PostHog processes this on our behalf, and we have not connected it to any advertising service. We do not use advertising trackers or any analytics service other than those described on this page.

Cookies

The site sets three preference cookies: one remembering your language, one remembering whether you chose the light or dark theme, and one remembering which announcement you closed in the bar at the top of the site, so that it stays closed in that browser; it holds only that announcement's ID and lasts up to a year. Signed-in learners also get a session cookie that keeps them signed in. Google Analytics sets its own cookies, whose names start with _ga, to recognise repeat visits from the same browser; they last up to two years. PostHog keeps an identifier for your browser in a cookie whose name starts with ph_ and in the browser's local storage, to recognise repeat visits; the cookie lasts up to a year. Cloudflare's Turnstile may set its own cookies on Cloudflare's domain. If you arrive through one of our links that names a campaign, the site keeps that name in the browser's session storage, which is cleared when you close the tab, so that it can be stored with your signup if you join the waitlist. When you finish a lesson quiz, the browser keeps your latest score for it in its local storage, on that device only: the score and which questions it covered, with nothing that names you. It is never sent to us, and it is cleared when you clear the site's data in your browser.

Legal basis for each use

UK data protection law, the UK GDPR and the Data Protection Act 2018, lets us use personal data only on a basis it recognises. These are the bases for the uses this page describes.

Your consent, for the waitlist: your email address and the answers you choose to give, the launch announcements we send you, and the optional WhatsApp number. You give it by joining the waitlist and by typing a number, and you can withdraw it at any time, as the Your rights and choices section explains. Withdrawing it stops what we do from then on; it does not undo what we did before.

A contract with you, for your account and what it needs to work: creating it, signing you in, the confirmation and password reset emails, your enrolments and completed lessons, your course certificates, your lesson ratings and comments, which others who can open the lesson see, and the orders you place, including the WhatsApp receipt for a local transfer, the emails we send you about an order, and checking a refund against the Refund Policy through the record of which lesson videos you opened. Without these we could not give you the account or the courses you ask for.

A legal obligation, for order and payment records, which we keep for as long as the law requires sales records to be kept.

Our legitimate interests: keeping the site and your account secure, through the session record, signing an account out of every device, or of one, when it is used where it should not be, the per-address counts, the activity log, the request logs, bot protection, the email that tells an account's owner someone tried to register with their address, and the email that tells you your password was changed; removing lesson comments that break our terms, and keeping the text of a removed comment in the activity log as the record of what we removed; protecting the course videos from being copied and shared, through video links that play only on your internet connection and the code shown briefly on a lesson video; keeping a course to the person who bought it, by limiting an account to two devices and one lesson video at a time and noting signs that an account is shared, through the country kept with each sign-in and with the video an account has open; understanding how the site and the courses are used, to improve them and fix what is broken, through the request logs, Cloudflare Web Analytics, Google Analytics, PostHog with its session recordings, and Sentry's error reports, performance measurements and error recordings; learning which of our links bring people to the waitlist, through the campaign name stored with a signup; remembering your language, your theme and the announcement you closed; using the country your connection comes from to preselect the phone country code and to show the price for your region; and checking payments, through the price region, charge and second-payment checks described in the When you buy a course section. You can object to any of these, as the Your rights and choices section explains.

You do not have to give us anything. Without an email address we cannot add you to the waitlist, and without a name, an email address and a password we cannot create an account; without an account we cannot sell you a course, and without the receipt we cannot match a local transfer to your order; everything else the waitlist asks for is optional. We make no decision about you by automated means alone that has a legal or similarly significant effect on you.

Who can see your data

Only authorised personnel who need it to operate 9k School. Other learners who can open a lesson see the comments on it, each with the name on its author's account and the date it was posted, and the lesson's average rating and how many ratings it has; they never see anyone's email address or who gave which rating. We do not sell your data or share it with advertisers. Cloudflare stores and processes it on our behalf as our hosting provider, PostHog processes the usage data and recordings described above on our behalf, Sentry processes the error reports, performance measurements and recordings described above on our behalf, and Google receives the visit data described above through Google Analytics. Resend receives the email addresses, languages, lists of courses and messages described in the Email we send you section, to send our email on our behalf. When you buy a course through Paddle's checkout, Paddle receives what it needs to sell you the course and take the payment, as the seller of record. When you pay by local transfer, the local payment service you choose on the payment instructions page carries the payment, and the receipt and message you send us on WhatsApp reach Meta, which runs WhatsApp, as the When you buy a course section explains. Our accountant receives our sales records, to keep our accounts: for each sale and refund, its order number, the course, the payment method, the price region, the amount, its currency and the date, but not your name or email address. Nobody else gets it.

Data sent outside the UK

We are based in the United Kingdom, and some of the services this page names keep or handle your data elsewhere. Resend stores what it holds for us in the United States, and Google processes Google Analytics data in the United States. Cloudflare runs the site in its data centres around the world, answering each request from the one nearest to you, and keeps our database in one location that Cloudflare chooses, which may be outside the UK. PostHog keeps our data in its EU region, and Sentry keeps our data in its EU region, in Germany.

Resend, Google, Cloudflare, PostHog and Sentry are each certified under the UK Extension to the EU-U.S. Data Privacy Framework, known as the UK-US data bridge, which UK law recognises as protecting personal data adequately when it goes to a certified company in the United States. UK law also recognises the European Union as protecting personal data adequately. Cloudflare receives our data under the data bridge and stays bound by its data processing terms with us wherever its data centres handle the data, including outside the United States and the European Union, and it must hold any company it uses to terms as protective as its own. Resend's, Google's, Cloudflare's and Sentry's data processing terms with us also include standard contractual clauses for these transfers, which keep the data protected if a certification ever lapses.

To get a copy of these safeguards, email us. Paddle, the local payment service you transfer through, and Meta, which runs WhatsApp, each handle what you give them under their own terms and privacy policies, including where they keep it.

How long we keep it

Waitlist entries are kept until the launch messages have gone out and the waitlist has served its purpose, or until you ask us to delete yours, whichever comes first. Account data is kept while the account exists. A device's session record is deleted when it is signed out, and at your next sign-in once it has expired. The record of the lesson video your account has open is replaced by the next one you open, and is deleted with the session record of the device it is on. A lesson comment is kept until you delete it, we remove it, or the lesson or your account is deleted; a rating, until the lesson or your account is deleted. When we delete an account at your request, we delete its name, email address, password, sessions and the record of the lesson video it had open, completed lessons, course completion dates, lesson ratings and comments, the courses given to it without a purchase, and any waitlist entry under the same address. An account that never placed an order is then deleted altogether; one that did is kept only as the record its orders point to, with no name, email address or password, as the last paragraph of this section explains. The activity log above stays: its entries keep at most the account's internal ID, besides the text of any of your lesson comments we removed, and the log records that the account was deleted. That ID no longer leads to your name or email address in our database, except through the order and payment records we must keep, described below. PostHog keeps that ID with your name and email address until what it holds about the account is deleted; when we delete an account at your request, we delete what PostHog holds about it too, its session recordings included.

Google Analytics deletes the visit data it ties to a browser after at most 14 months; the aggregated reports built from it remain. PostHog deletes usage data and session recordings once they reach the retention period of our PostHog plan, and Sentry deletes error reports, performance measurements and recordings once they reach the retention period of our Sentry plan. Resend deletes each email it sent for us after 30 days, and keeps your address, your language and the courses whose announcements you will get only as long as your waitlist entry. Cloudflare deletes the site's request logs after at most 7 days.

Order and payment records are the record of a sale, so we keep them for as long as we have to keep sales records, even if you ask us to delete your account. For an order paid by local transfer, those records include the WhatsApp chat and the receipt you sent us for it. Orders stay linked to the account that placed them, so that account is kept for that long as well; if you asked us to delete it, it is kept with no name, email address or password.

Your rights and choices

You have the right to ask for a copy of what we hold about you, to have it corrected, and to have it deleted. You can also ask us to limit how we use it, for example while we check a correction you asked for; object to any use based on our legitimate interests, which the Legal basis for each use section lists; receive the data you gave us in a common machine-readable format, to take it elsewhere; and withdraw your consent at any time. Some of these rights have limits in law: for example, we keep order records for as long as the law requires, even if you ask us to delete them, as the How long we keep it section explains.

If you have an account, you can correct your name, change your password and sign out your other devices yourself, while signed in, on your Account settings page, and, while you can open a lesson, delete your comment on it yourself on its page. Everything else, including deleting a comment on a lesson you can no longer open, changing your email address or deleting your account, is done by email. To use any of these rights, email us, from the address you signed up with if you have one, and we will answer within one month. A copy of your data comes as a JSON file, a common machine-readable format. Deleting a waitlist entry removes the email, the number, and the answers together, from our database and from Resend. To stop the course announcements without deleting your entry, use the unsubscribe link at the bottom of any announcement; doing so withdraws your consent to them.

To keep your visits out of Google Analytics, install Google's opt-out browser add-on (tools.google.com/dlpage/gaoptout) or use a content blocker that stops it from loading.

A content blocker that stops PostHog or Sentry from loading keeps your visits out of them too. If you have an account, email us and we will delete what PostHog holds about it.

If you are unhappy with how we have used your data, tell us first and we will try to put it right. You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk/make-a-complaint or by phone on 0303 123 1113.

When you buy a course

No course is on sale yet. From the first sale, this is what happens. There are two ways to pay: through Paddle's checkout or, if you are buying from Egypt, by local transfer. You choose when you buy.

Through Paddle's checkout, Paddle is the seller of record: Paddle collects your payment details, your email address, and your billing country or address, and processes them under its own privacy policy. We never see or store your full card number.

For an order paid through Paddle, what we record is the order: which course, the price, its currency and price region, when it was placed, the language you were reading the site in when you placed it, which is the language of our emails about the order, and its status (pending, paid, failed, refunded, or expired), together with Paddle's reference for the transaction and the country of your billing address or card, as Paddle reports it. We also keep a full copy of each notice Paddle sends us about a payment, such as that it went through or failed. A notice can include the amount, tax, and currency; the type of payment method; Paddle's references for you, your billing address, and the invoice; and, for a card payment, the card's brand (such as Visa), its last four digits, its expiry date, and the cardholder's name.

The PostHog events described above record that you started a purchase and, for a Paddle order, whether the payment went through. The activity log records that you started a purchase and, once a payment goes through, that the course was granted to you. If a Paddle payment goes through and the country Paddle reports for it is outside the price region you were charged, the log also records that country and the region, so we can see how often a regional price is paid from elsewhere; this never blocks a payment. If Paddle reports charging an amount or currency different from the order's, or applying a discount, the log records what the order expected and what was charged; this never blocks a payment either. If a second payment goes through for a course you had already paid for, for example from two open tabs, the log records it with your other paid order, so we can refund one of them; this never blocks a payment either. The log also records each refund: when we ask Paddle for one, when Paddle rejects one, with the course, the amount and its currency, and when an order is refunded or charged back, with the course and, for a refund we started, the amount and its currency. If Paddle wins a dispute over a charged-back payment and keeps the money, the log records that too, and, unless the order was also refunded, your access to the course is restored. On the payment instructions page, PostHog and Google Analytics also record your clicks as described above, including which of the two services you said you used and the WhatsApp link, whose address carries the prefilled message with the course, the amount, and the order number.

By local transfer, 9K LABS LTD is the seller and Paddle receives nothing. You send the money yourself through one of the local payment services listed on the payment instructions page, which handles the transfer, and what you give it, under its own terms and privacy policy. We record the same order details, without a Paddle reference or a card country: which course, the price, its currency and price region, when it was placed, the language you placed it in, its status, and, if you tell us on the payment instructions page, which service you used and when you told us; the activity log records that you told us, too. When we confirm the money arrived, the activity log records who confirmed it, the amount and its currency, and, if you told us, the service you used; if confirming it fails, the log records that too. If the money does not arrive, we can close the order as not received; the activity log records who closed it, the amount and its currency, the service you said you used, and whether you had told us you sent it. We can still confirm a closed order if its money arrives later, and the log then also records what the order's status was. Our own account with that service also shows us what it shows anyone who receives a transfer, such as the sender's name or account, the amount, and the time.

An order nobody pays for closes by itself and is marked expired: a Paddle checkout you did not finish after a day, and an order to pay by local transfer after a week in which you neither told us you sent the money nor pressed the course's buy button again to return to its payment instructions. If the price changes, or you switch to another local payment service or to paying by card, an earlier transfer order you did not tell us you paid expires straight away, so you only see the current amount. An order you told us you paid never expires on its own. The activity log records each order that expires. Your orders page does not list expired orders, or a Paddle order whose payment failed, but we keep them like every other order, as the How long we keep it section explains.

To finish a transfer, you send us the receipt on WhatsApp with your order number. The message comes from your own WhatsApp account, so with it we receive your WhatsApp phone number and profile name, the message itself, which names the course, the amount, and the order number, and whatever the receipt shows, such as your name, your account details, the amount, and the date. WhatsApp is run by Meta, so the message reaches Meta, which processes it under WhatsApp's own terms and privacy policy. We use the message only to match your transfer to your order and, if you ask for a refund, to send the money back. We keep the chat and the receipt for as long as we keep the order's records, as the How long we keep it section explains. This is separate from the optional waitlist number described in the WhatsApp section above.

Changes to this policy

When what the site does changes, this page changes with it, and the date at the top shows when. Anything new we collect will be described here before we start collecting it.

Contact

Questions about this page, a refund, or your data? Write to us at hello@9k.school.