Legal
Privacy Policy
Last updated: 19 August 2026
This explains what the AI Literacy Lab collects, why we hold it, how long we keep it, and what you can ask us to do about it. It covers the website at ailiteracylab.ai and the learning platform you sign in to.
Who we are
The AI Literacy Lab is a product of Bykov-Brett Enterprises Ltd, a company registered in England and Wales, company number 11822030, registered office Flat 401, 48 Ottley Drive, London SE3 9GF.
For the UK GDPR and the Data Protection Act 2018, Bykov-Brett Enterprises Ltd is the data controller for the personal data described here. In this policy, "we" and "us" mean Bykov-Brett Enterprises Ltd trading as the AI Literacy Lab.
What we collect
Your account
When you create a learner account we hold your name, email address, the organisation you give us if any, and a hash of your password. We never store the password itself. If you turn on two-step verification we hold the secret your authenticator app uses. We record when the account was created and whether the email address has been verified.
Signing in with Google or Microsoft
If you use "Sign in with Google" or "Sign in with Microsoft", we ask that provider for three things only: a stable identifier for you, your email address and your name. We do not ask for and cannot see your mail, files, calendar or contacts. We store the provider name, that identifier, and the email address as it stood when you linked the account. We match on the identifier rather than the email, so changing your email at Google or Microsoft does not lose your account.
Your learning record
When you take a module we record which modules you launched, how far through you are, which slides you have visited, your quiz answers and score, whether you completed it, and the date. Where a module reports through SCORM we keep the data the module sends, as it sends it. Certificates are generated from that record.
Feedback
If you fill in the feedback panel on a module we hold your confidence rating before and after, your ratings on the five experience questions, and any comment you write. It is linked to your account so we can tell you have already given feedback on that version.
Podcast listening
If you use the Listen rail we hold your position in each episode so you can pick it up again.
Forms on the website
Our contact form, trial request, organisation enquiry and scholarship application collect what the form asks for, plus the page you submitted from. Downloadable guides and reports ask for your name and email before the file is released.
Scholarship applications. The scholarship form asks about your identity and circumstances. Some of that may be special category data under Article 9 of the UK GDPR, such as information that reveals your race, religion or health. We only collect it because you choose to tell us in support of your application, we rely on your explicit consent to do so, we use it for nothing except assessing scholarship applications, and you can withdraw that consent and ask us to delete the application at any time.
Newsletter
If you subscribe we hold your email address and your subscription state. Our emails contain a tracking pixel and links that pass through our own server, so we can see that a message was opened and which links were clicked. That data is ours and is not shared with an advertising network. Every email carries a one-click unsubscribe, and unsubscribing is permanent unless you ask us to reinstate it.
Technical data
Our servers keep ordinary web logs: IP address, the page requested, the time, and the browser's user-agent string. These are used to keep the service running and to deal with abuse.
Why we hold it, and our lawful basis
| What we do | Lawful basis |
|---|---|
| Give you an account and let you sign in | Performance of a contract with you |
| Deliver modules and keep your progress, scores and certificates | Performance of a contract with you, or the legitimate interests of the organisation that bought your access |
| Report completion to the organisation that bought your seat | Legitimate interests of that organisation in evidencing that its staff were trained |
| Answer enquiries, trial requests and organisation enquiries | Steps taken at your request before entering a contract |
| Assess a scholarship application | Your explicit consent |
| Send the newsletter and measure whether it is read | Your consent, withdrawable at any time |
| Improve modules using feedback and anonymous completion patterns | Our legitimate interest in making the training work |
| Keep the service secure, prevent abuse, keep accounting records | Our legitimate interests, and legal obligation for accounting |
We do not sell your personal data. We do not use it to build advertising profiles, and we do not use your learning record to make an automated decision that has a legal or similarly significant effect on you.
If your employer bought your access
Where an organisation buys seats or a licence, the administrators it nominates can see who has been given access, whether each person launched and completed a module, the completion date and the score. That is the point of the record: it is what lets the organisation evidence that its staff were trained.
They cannot see your password, your two-step verification secret, or the free-text comments you write in module feedback. Feedback comments are reported to the organisation only in aggregate.
If you have questions about why your employer asked you to take a module, or how long they keep the result, ask them. They decide that, not us.
Who else processes your data
We run our own infrastructure rather than a stack of platforms, so this list is short and we would like to keep it that way.
- Cloudflare sits in front of the site and delivers it. It sees the IP address of every request.
- Google Workspace carries our email, including verification links, invitations, password resets and the newsletter.
- Google and Microsoft, only if you choose to sign in with them, and only for the three items described above.
- Google Fonts serves the two typefaces the site uses. Your browser requests them from Google, which means Google sees your IP address when a page loads.
- Calendly, only if you open the booking panel on our contact page, and only for what you type into it.
- YouTube, on the pages that embed a video. Playing an embedded video puts you in contact with Google's services under their terms.
- Stripe, where a card payment is offered. Card details go directly to Stripe. We never see or hold your card number.
Each of these acts under a data processing agreement or its own controller terms. We may also share data with our accountants and legal advisers where necessary, and with authorities where the law requires it.
How long we keep it
| Data | Kept for |
|---|---|
| Learner account and learning record | While the account is open, then 3 years, because a completion record is the evidence of training and is often needed after someone has moved on |
| Enquiries, trial and organisation enquiries | 2 years from the last contact |
| Scholarship applications | 12 months from the decision, then deleted |
| Newsletter subscription | Until you unsubscribe. The record that you unsubscribed is kept permanently, because that is what stops us mailing you again |
| Module feedback | Kept, and reported in aggregate after the identifying link is no longer needed |
| Customer and payment records | 6 years, for tax and accounting |
| Web server logs | 90 days |
Where an organisation holds a licence, the retention it has agreed with us for its learners' records applies alongside this.
International transfers
The platform and its database run on our own servers in the United Kingdom. Some of the providers listed above are based in the United States or process data there. Where that happens we rely on the UK extension to the EU-US Data Privacy Framework where the provider is certified, or on the International Data Transfer Addendum to the European Commission's standard contractual clauses.
Security
Traffic is encrypted in transit. Passwords are stored as hashes, never in a form we can read. Access to the administration side is restricted, protected by two-step verification, and learner accounts can require it too. Learning content is served only to a signed-in session that is entitled to it.
No system is perfect. If we suffer a breach that is likely to put your rights at risk, we will tell you and report it to the Information Commissioner's Office as the law requires.
Your rights
Under UK GDPR you can ask us to:
- give you a copy of the personal data we hold about you
- correct anything that is wrong or incomplete
- delete your data, where we have no continuing reason to hold it
- restrict what we do with it while a question about it is resolved
- send it to you, or to someone else, in a portable format
- stop processing based on legitimate interests, or stop direct marketing, which we will always honour
- withdraw a consent you gave, without affecting what was done before you withdrew it
Write to the address below and we will respond within one month. There is no charge.
One limit worth stating plainly: if your employer bought your access, we may not be able to delete a completion record on your request alone, because the organisation needs it as evidence of training. We will tell you if that is the case and put you in touch with them.
Age
This is workplace training. It is not designed or intended for children, and accounts are for people aged 18 or over. If you believe a child has created an account, tell us and we will remove it.
Changes to this policy
We will update this page when what we do changes, and change the date at the top. If a change materially affects how we use data about you, we will tell account holders by email rather than quietly editing the page.
Contact and complaints
Email: [email protected]
Post: Bykov-Brett Enterprises Ltd, Flat 401, 48 Ottley Drive, London SE3 9GF, United Kingdom
Company number: 11822030
If you are not happy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would rather you came to us first so we can put it right.