Privacy policy

Runes Academy ("we", "us") runs the website at www.runesacademy.com and the student portal. We are the controller of the personal data described here. Our address is [Registered business address]. You can reach us about privacy through our contact form.

• Account details: your name, email address and a password, which is stored only in hashed form.
• Learning data: the courses you enrol in, your progress, quiz answers and assignment work you submit.
• Payment data: handled by Stripe. We receive confirmation of a purchase and limited details such as the amount and the last digits of a card, never your full card number.
• Messages: anything you send us through email or the contact page.
• Technical data: basic device, browser and page-view information used to keep the site secure and understand how it is used.

• To provide your account and courses and to save your progress. Basis: performing our contract with you.
• To take payments, issue receipts and handle refunds. Basis: contract and legal obligations.
• To answer questions and give support. Basis: our legitimate interest in helping you, or your request.
• To keep the academy secure and improve it. Basis: our legitimate interests.
• To send you product or newsletter emails, only if you have opted in. Basis: your consent, which you can withdraw at any time.

We do not sell your personal data and we do not use it for advertising profiles.

We use a small number of trusted providers to run the academy. They process data only on our instructions.

• Supabase: authentication and the database that stores accounts and progress.
• Stripe: payment processing.
• Vercel: website hosting and privacy-friendly page analytics.

We may also disclose data where the law requires it or to protect our rights and the safety of others.

Some providers process data outside your country, including in the United States. Where that happens we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

We keep account and learning data while your account is open. If you ask us to delete your account we remove or anonymise it, except for records we must keep by law, such as invoices, which are held for the period tax rules require.

Depending on where you live, including under the GDPR and UK GDPR, you can ask us to:

• give you a copy of the data we hold about you;
• correct anything that is wrong;
• delete your data or restrict how we use it;
• move your data to another service;
• stop using your data where we rely on legitimate interests, or withdraw consent.

Send a request through the contact form and we will respond within one month. You also have the right to complain to your local data protection authority.

The academy is intended for adults and for young people with a parent or guardian's permission. We do not knowingly collect data from children under 16 without it. If you believe we have, tell us and we will delete it.

Passwords are hashed, connections are encrypted, and access to student data is restricted by account. No system is perfectly secure, so please use a strong, unique password.

If we make material changes we will update the date at the top of this page and, where appropriate, tell you by email.