Privacy Policy

Last updated: 13 September 2026

This Privacy Policy explains how [LEGAL ENTITY NAME] ("Sprightly", "we", "us") collects and uses personal data when you use the Sprightly teaching platform. It should be read alongside our Terms of Service and Cookie Policy.

1. Controller vs processor

For personal data of Instructors (account owners) we are the data controller. For the personal data of Learners that an Instructor collects through their workspace, the Instructor is the controller and Sprightly acts as a processor on their behalf, processing that data only to provide the platform.

2. Data we collect

• Account data — name, email, password hash, workspace and role information.
• Content — courses, lessons, videos, files, quiz and assignment submissions, comments and messages you create.
• Usage data — log data, device/browser information, and interactions used to operate and secure the service.
• Billing data — where applicable, subscription and payment metadata (card details are handled by our payment processor, not stored by us).

3. How we use data

• to provide, maintain and secure the platform;
• to authenticate users and prevent abuse;
• to deliver course content, assessments and communications;
• to provide support and respond to your requests;
• to improve the service and comply with our legal obligations.

4. Legal bases (where GDPR/UK GDPR applies)

We rely on: performance of a contract (to provide the service); legitimate interests (to secure and improve the platform); consent (where required, e.g. certain cookies); and legal obligation. Where we act as a processor for Learner data, the Instructor is responsible for the lawful basis.

5. Sub-processors

We use trusted third-party providers to run the platform, including for cloud hosting and database, secure video hosting and delivery, transactional email, authentication, and AI processing. Each is bound by appropriate data-protection terms. A current list of sub-processors is available on request at privacy@sprightly.school.

6. Student and education data

Where Sprightly is used in an education setting, we process Learner data only on the documented instructions of the Instructor. We do not sell Learner data or use it to build advertising profiles. Instructors are responsible for obtaining any consents required for minors and for complying with applicable education-privacy laws in their jurisdiction.

7. Data retention

We keep personal data for as long as needed to provide the service and for legitimate business or legal purposes. When an account is closed, we make data available for export for a reasonable period and then delete or anonymise it in line with our retention practices.

8. Security

We use technical and organisational measures to protect personal data, including access controls, encryption in transit, and row-level data isolation between workspaces. No system is perfectly secure, but we work to protect your data and to notify you of material incidents as required by law.

9. International transfers

Personal data may be processed in countries other than your own. Where it is, we use appropriate safeguards (such as standard contractual clauses) as required by applicable law.

10. Your rights

Depending on your location, you may have rights to access, correct, delete, restrict or object to processing of your personal data, and to data portability. To exercise these rights, contact us at privacy@sprightly.school. If you are a Learner, please contact your Instructor first, as they control your data.

11. Cookies

We use only essential and preference cookies. See our Cookie Policy for details.

12. Changes to this policy

We may update this policy from time to time and will post the new version here with an updated date. Material changes will be notified where required.

13. Contact

For any privacy question, contact privacy@sprightly.school or write to us at [REGISTERED ADDRESS].