Inbox Academy logo

InboxAcademy — Privacy Policy

Effective Date: April 3, 2026 Legal Entity: AvaCode Solutions LLC-FZ Registered in: Meydan Free Zone, Dubai, UAE Data Hosting: Google Cloud Platform — EU Region Contact: legal@inboxacademy.io

This Privacy Policy explains how we collect, use, and protect your personal data when you use InboxAcademy.

1. Who We Are

InboxAcademy is operated by AvaCode Solutions LLC-FZ, registered in Meydan Free Zone, Dubai, UAE. We are the data controller for personal data collected through the Platform. For all privacy-related enquiries, contact us at legal@inboxacademy.io.

2. Scope of This Policy

This Privacy Policy applies to:

3. Data We Collect

3.1 Course Providers

When you register and use the Platform, we collect:

3.2 Optional Google Workspace OAuth Import

If you choose to connect your Google Workspace account to use our optional learner import feature, we access only the data needed to import email addresses of users in your workspace as Learners for your courses. We do not collect Google Workspace details as part of standard account registration.

3.3 Learners

Learners do not create accounts on InboxAcademy. We collect the following data either as provided by the Course Provider, submitted by you during self-enrolment, or collected through your participation in a course:

Personalised content is delivered via secure, time-limited JWT token links. No password or account login is required for Learners.

Quiz responses and assignment submissions are shared with the relevant Course Provider through the Platform so they can deliver, assess, and manage the course.

3.4 Website Visitors

When you visit our website, we collect usage and behavioural data including pages visited, session duration, device type, approximate location, IP address, browser type, and referring URL. This data is collected via Google Analytics 4 (GA4).

Your IP address is also used to determine your approximate country of residence via IP geolocation. This is used solely to decide whether to display a cookie consent banner, in accordance with applicable privacy regulations. No additional personal data is collected or stored as part of this process.

For details on how analytics cookies are managed and how to opt out, see Section 4.

4. Cookies

4.1 Necessary Cookies

The Platform uses strictly necessary cookies essential for the operation of the service, such as maintaining your authenticated session and ensuring secure access. These cookies do not require your consent and cannot be opted out of while using the Platform.

4.2 Analytics Cookies (Website Only)

Our public website uses Google Analytics to understand how visitors interact with our site. Our approach to your privacy depends on your location:

How to manage your preferences (All Users)

Regardless of where you live, you have full control over your data:

On this site: You can instantly change your preferences or withdraw consent by clicking Cookie Settings.

Globally: You can permanently prevent Google Analytics from using your data on any website by installing the Google Analytics Opt-out Browser Add-on.

More Info: For details on how Google handles your data, please see the Google Privacy & Terms.

4.3 No Advertising Cookies

InboxAcademy does not use advertising or tracking cookies for targeted advertising purposes. We do not sell your data to third parties for marketing purposes.

5. How We Use Your Data

We use the data we collect to:

6. Legal Basis for Processing (GDPR)

For users located in the European Economic Area (EEA) or the United Kingdom, we process personal data under the following legal bases:

Regardless of your location, InboxAcademy is committed to handling all personal data with care and transparency in accordance with this Privacy Policy.

7. Data Sharing & Third Parties

We do not sell your personal data. We share data with the following trusted third-party service providers solely to operate the Platform:

We may also disclose your data where required by law, court order, or to protect the rights, property, or safety of InboxAcademy, our users, or others.

8. Learner Email Addresses & Course Providers

As a Learner, your email address is collected either when you self-enrol or when a Course Provider enrols you. If you self-enrol, your email address will be shared with the Course Provider of that course so they can deliver and manage the course you are enrolled in.

Neither InboxAcademy nor Course Providers may use Learner email addresses for any purpose unrelated to the delivery of the specific course the Learner is enrolled in. This includes, but is not limited to, marketing communications, third-party data sharing, or any other non-educational use. Course Providers are contractually bound to this restriction through their agreement with InboxAcademy.

Learner email addresses will not be sold or shared with any third party, except where required by law or where disclosure is requested by a competent legal authority.

9. Data Retention

We retain personal data for as long as necessary to provide the Platform services and as required by applicable law:

10. Data Security

All data is hosted on Google Cloud Platform in the EU region. We implement appropriate technical and organisational security measures to protect your personal data, including encryption in transit (TLS) and access controls.

While we take data security seriously, no system can be guaranteed to be 100% secure. In the event of a data breach that poses a risk to your rights and freedoms, we will notify affected parties and relevant authorities in accordance with applicable law.

11. Your Rights

Depending on your location, you may have rights regarding your personal data. For users in the EEA and the United Kingdom, these include at a minimum:

To exercise any of these rights, simply contact us at legal@inboxacademy.io. We will respond within 30 days.

12. Minors

InboxAcademy does not collect age information from Learners and cannot independently verify the age of individuals using the Platform. Course Providers are solely responsible for ensuring that their courses are appropriate for their intended audience, and for obtaining any required parental or guardian consent where their courses involve minors. InboxAcademy assumes no liability for Course Provider content delivered to minors where the Course Provider has failed to meet these obligations.

13. International Data Transfers

All personal data collected through the Platform is primarily hosted on Google Cloud Platform servers located in the European Union, ensuring a high standard of data protection by default.

Where data is processed by third-party providers such as OpenAI, those transfers are governed by the provider's own Data Processing Agreement (DPA) and appropriate safeguards, including Standard Contractual Clauses (SCCs) approved by the European Commission where applicable. InboxAcademy takes reasonable steps to minimise the transfer of personal data outside the EEA, including where available using EU-region endpoints provided by third-party services.

14. Changes to This Policy & User Acceptance

We may update this Privacy Policy from time to time. Material changes will be communicated to registered Course Providers via email at least 14 days before they take effect. The "Effective Date" at the top of this document reflects the date of the most recent revision. Continued use of the Platform after the effective date constitutes acceptance of the updated Policy.

By registering as a Course Provider, you agree to this Privacy Policy as part of your acceptance of the InboxAcademy Terms of Service. By enrolling in a course — whether through self-enrolment or via a Course Provider — Learners acknowledge that their data will be processed in accordance with this Privacy Policy. Where Learners are enrolled by a Course Provider, the Course Provider is responsible for ensuring that their Learners are made aware of this Privacy Policy prior to or at the time of enrolment.

15. Contact & Data Protection Enquiries

For any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Changelog

All versions are available in the AvaCode Solutions public-contracts repository on GitHub.