Privacy Policy

1.Who is responsible for your information

Blue Fountain Interactive Ltd (company number 17372662, registered in England and Wales, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom) runs KoLesson and is the "controller" of the information described in this policy: your account, and everything the service stores and does to work.

The owner of each community you join is a separate, independent controller for what they themselves do with their members' information: for example deciding who to admit, reading the list of members and their email addresses, exporting that list, taking payment from you on their own website, or writing to you from their own systems. Their own privacy notice applies to that, and questions about it go to them. If you cannot reach them, tell us.

You can reach us about privacy through the form on the Support page (choose "Privacy"), at support@kolesson.com, or by post at the address above.

2.What we collect

You give us

• Your email address. It is how you sign in and where we send codes and notifications.
• Your profile: first and last name, and if you add them a photo, a short bio, a location and links. Your profile has a handle made from the first part of your email address.
• What you post and send: posts, comments, poll votes, reactions, pictures, direct messages, and for creators their courses, lessons, videos and events.
• Reports and blocks: what you report and why, and whom you have blocked.
• Your choices: which emails you want, and light or dark mode.
• Messages to us: what you write on the Support page or when asking to start a community (your name, email address and message).

Created as you use KoLesson

• Membership: which communities you belong to, your role, when you joined, how you were added, and the date your access ends if the owner has set one.
• Learning: which lessons you have finished and how far you are through a video.
• Points and levels, earned when other members react to what you post.
• Activity days: the days on which you opened a community (one mark per day, used for your streak and for the owner's activity figures). Your device's time zone is stored so that the day is your day.
• Sign-in records: the time, the kind of device (web, iPhone or Android) and the network (IP) address of each sign-in, of each request for a code and of each wrong code.
• Notifications we have shown or emailed you.
• Server logs: the network address, the page or file asked for, the time and the browser or app version of each request.

From other people

• A community's owner or admin can add you by email address, by hand, from a list, or automatically when you buy from them. We then receive your email address and, if they give it, your name, from them.
• Other members may mention you or reply to you.

We do not ask for, and you should not post, sensitive information about yourself or others, such as health details, unless you are comfortable with the members of that community seeing it.

3.What we do not do

• We do not show advertising and we do not sell or rent personal information to anyone.
• The website and the apps contain no analytics, advertising or tracking software from other companies, and no crash-reporting service.
• We do not track you across other apps or websites.
• We do not store passwords: there are none.
• The apps do not read your contacts, your precise location or your microphone. They open your photos or camera only when you choose a picture to post.
• We do not make decisions about you by automated means that have legal or similarly significant effects.

4.Why we use it, and the legal basis

UK and EU data protection law (the UK GDPR and the GDPR) and Nigeria's Data Protection Act 2023 require us to have a lawful reason for each use. Ours are:

Where we rely on legitimate interests you have the right to object (see "Your rights").

5.Who can see your information

• Members of a community you are in see your name, photo, bio, location and links, your posts, comments, reactions and poll votes there, your points and level, and when you joined.
• The person you message sees your direct messages. If either of you reports a message, the community's team is shown the reported message so that they can act.
• A community's team (owner, admins and moderators) also sees reports, the date your access ends, and a log of moderation actions. The owner and admins can see your email address, can export the list of members with email addresses, and can see activity and course-progress figures for their community.
• Anyone, if a community's owner has switched on its public page, can see that community's name, description, number of members, course titles and, if the owner chooses, the titles of pinned posts. Your profile is not shown there.
• Someone you have blocked, and you, no longer see each other's posts, comments or messages. A community's own team cannot be blocked inside their community.
• We can access the data we hold when that is needed to run, secure and support the service, to investigate a report, or to comply with the law.

We disclose information to courts, regulators or the police only when the law requires it, or when it is necessary to protect someone from serious harm.

6.Companies that handle data for us

We use a small number of providers. They act on our instructions and may not use your information for their own purposes.

Apple and Google distribute the phone apps through their stores and handle your download under their own privacy policies.

If a creator shows a video from YouTube, Vimeo, Loom or Wistia in a lesson or a post, playing it loads the video from that company, which then receives your network address and may set its own cookies under its own privacy policy. Videos uploaded to KoLesson itself are played from our own storage.

7.Where your data goes

Blue Fountain Interactive Ltd is based in the United Kingdom. KoLesson's server and storage are in the United States, so wherever you are, including the UK, the European Economic Area and Nigeria, your information is transferred to and kept in the United States, and may pass through other countries where our providers operate.

These countries may not protect personal information in the same way as your own. Where our providers offer them, we rely on the standard contractual clauses approved for international transfers under UK and EU law, which are part of the data processing terms of Cloudflare, Amazon Web Services and Expo. Otherwise we rely on the transfer being necessary to provide the service you have asked us for. You can ask us for more detail about the safeguards for your data through the Support page.

8.How long we keep it

When you delete your account

You are signed out everywhere at once. For 14 days nothing else changes, and signing in again cancels the deletion. After 14 days we erase what identifies you: your name becomes "Deleted member"; your email address, photo, bio, location, links and handle are removed; you leave every community; your sessions, sign-in codes, blocks, waiting requests to join, notifications, queued emails, activity days and the event reminders you chose are deleted.

What you wrote (posts, comments, reactions and the direct messages you sent) and your points and course progress records stay, no longer linked to your name or email address, so that conversations other people took part in still make sense. If you want them gone, delete them before you delete your account, or ask us. Copies in backups are overwritten within 12 months; if we ever restore a backup, we erase deleted accounts again.

If you own a community, your account cannot be deleted until the community has another owner or has been closed. Write to us and we will help.

9.Cookies and storage on your device

KoLesson uses only the cookies it needs to sign you in. There are no advertising or analytics cookies, so there is no cookie banner.

Each cookie belongs to the one address you signed in on and is not shared with other communities. Your browser also keeps a few preferences in its own storage (light or dark mode, the community's look, and which posts you have already seen). In the phone apps, the sign-in and those preferences are kept in the device's secure storage.

10.How we protect it

• Every connection to KoLesson is encrypted (HTTPS).
• There are no passwords to steal. Sign-in codes work once, for 15 minutes, and wrong guesses are limited.
• We store only a fingerprint (a one-way hash) of sign-in codes, links and session tokens, never the values themselves.
• A sign-in on one community's address does not work on another's.
• Pictures and videos are private: they are served through links that expire.
• Access to the server and the database is limited to the people who run KoLesson.

No service can promise perfect security. If a breach is likely to put your rights at risk, we will tell you and the regulators as the law requires.

11.Your rights, and how to use them

Wherever you live, you can do these yourself, without asking us:

• Get a copy. Settings, then "Download my data", gives you a file with your profile, memberships, posts, comments, reactions, the messages you sent and the event reminders you chose.
• Correct it. Change your name, photo, bio and location in Settings. Edit or delete your own posts and comments from their menus.
• Delete it. Settings, then "Delete my account"; or, without the app, the Delete my account page.
• Stop emails. Settings, then Email notifications; or the link at the foot of each notification email.

Under the UK GDPR, the EU GDPR and Nigeria's Data Protection Act you also have the right to ask us to: confirm what we hold about you and give you a copy; correct it; erase it; restrict or stop how we use it; object to uses based on our legitimate interests; and receive your data in a form you can move to another service. Where we rely on your consent, you can withdraw it at any time.

To use any of these, write to us through the Support page (choose "Privacy") or at support@kolesson.com. To change your email address, write to us the same way. We may need to check that you are the account's owner, usually by sending a code to its email address. We answer within one month. It is free.

For things a community's owner does with your information on their own account, ask them first; we will help if you cannot reach them.

12.Children

KoLesson is for people aged 16 and over, and is made for adult learners and business communities. We do not knowingly collect information from anyone under 16. If you believe a child under 16 has an account, tell us through the Support page and we will remove it.

13.Changes to this policy

When we change this policy we change the date at the top. If a change is significant (for example a new kind of data, a new purpose or a new provider that receives your content), we will tell you in the app or by email before it applies.

14.Questions and complaints

Please tell us first, through the Support page or at support@kolesson.com, so that we can put things right. You also have the right to complain to a data protection authority at any time:

• United Kingdom: the Information Commissioner's Office (ICO), ico.org.uk/make-a-complaint, telephone 0303 123 1113.
• Nigeria: the Nigeria Data Protection Commission (NDPC), ndpc.gov.ng.
• European Economic Area: the data protection authority of the country where you live or work.