Privacy Policy & UK GDPR Notice

• Art. 6(1)(b) contract — creating your account, delivering courses, recording progress, marking assessments and issuing certificates.
• Art. 6(1)(c) legal obligation — statutory record-keeping, tax and accounting obligations, and responding to lawful requests.
• Art. 6(1)(f) legitimate interests — platform security, fraud and abuse prevention, certificate integrity, aggregated product analytics and defence of legal claims. A balancing test is available on request.
• Art. 6(1)(a) consent — marketing emails and non-essential cookies, withdrawable at any time.

Maicourses uses AI assistance for the course adviser chat and for text-to-speech narration of lesson content, delivered through the Lovable AI Gateway (which routes to model providers such as OpenAI, Anthropic and Google). These features are advisory and supportive only.

Assessment marking is rule-based against a stored answer key held server-side; it is not model-generated. No legal or similarly significant decision concerning you is made solely by automated means within the meaning of Art. 22 UK GDPR. Certificates are issued only when the published completion requirements are met, and a human review path is available on request.

AI-assisted surfaces are labelled at the point of interaction. Prompts sent to model providers are subject to enterprise terms that prohibit training on customer content. Do not paste sensitive personal data into the course adviser.

Personal data is shared only with vetted sub-processors under written agreements:

• Lovable Cloud / Supabase — database, authentication, storage and server functions
• Lovable AI Gateway — AI adviser and narration features only
• Transactional email provider — account, sign-in and certificate emails sent from notify.maicourses.com
• Google — only where you choose Google sign-in
• Sponsoring organisations — where a partner funds your place, we may confirm enrolment and completion status only

We do not sell personal data. We disclose data to law enforcement only on production of valid legal process.

Where personal data leaves the UK, transfers rely on one of:

• UK adequacy regulations (for example EU/EEA recipients);
• the UK International Data Transfer Addendum to the EU Standard Contractual Clauses;
• EU–US Data Privacy Framework certification of the recipient;
• other lawful safeguards under Art. 46 UK GDPR.

Transfer risk assessments are documented and available on request.

• AES-256 encryption at rest and TLS 1.2+ in transit
• Row-Level Security enforced on every table holding learner data
• Assessment answer keys held server-side and never exposed to the browser
• SHA-256 content fingerprints on lesson content and assignment submissions
• Role-based access with least-privilege service accounts
• Breach response plan with a 72-hour ICO notification commitment
• Vendor reviews on all sub-processors

Maicourses is hosted on certified cloud infrastructure whose providers maintain SOC 2 Type II and ISO 27001 certifications. Maicourses itself is not independently certified.

Under the UK GDPR you have the right of access, rectification, erasure, restriction, portability, objection, and the right to withdraw consent at any time. Where Maicourses acts as processor for a sponsoring organisation, please contact that organisation first; we will assist them in responding.

To exercise a right, use the data request form. We respond within one month, extendable by two months for complex requests with notice.

You may complain to the Information Commissioner's Office at ico.org.uk (telephone 0303 123 1113). We would appreciate the chance to resolve your concern first.

Maicourses is intended for adult professional learners. It is not directed at, and must not be used by, anyone under 16 without verifiable parental or institutional consent. We do not knowingly collect data from children.

This notice is reviewed at least annually. Material changes, such as new sub-processors or expanded purposes, are notified by email to registered learners at least 14 days before they take effect. The current version date appears at the top of this page.