Privacy Policy

VidLearn Academy (“we”, “us”) runs this website, an online learning platform based in Sri Lanka. We decide how the personal data described here is used, and we are responsible for it under Sri Lanka’s Personal Data Protection Act, No. 9 of 2022.

• Your account: your name, email address and role. If you set a password, we store only a one-way scrambled form of it (a scrypt hash), which we cannot turn back into your password.
• Your mobile number: we ask for it when you join. If it is a Sri Lankan mobile, we confirm it is yours with a code sent by text message.
• If you sign in with Google: your Google account ID, name, email address and profile photo, which Google shares when you agree. We never receive your Google password, and we do not ask for access to anything else in your Google account, such as Gmail, Drive or your contacts.
• Details you choose to add: a profile photo, headline, bio, city, learning goal and education level. Instructors can also publish a public profile.
• Your learning: the courses you join, your progress and where you stopped in each video, your private lesson notes, quiz answers and scores, the files you submit for assignments and the grades and feedback on them, your certificates, reviews and saved courses.
• Purchases: which course you bought, the price, the date and whether the payment went through. Card payments are handled by our payment provider; we never receive or store your full card number.
• Messages: what you send through the contact form, and your email address if you subscribe to our newsletter.
• Sign-in records: when you sign in we record the IP address and a description of the browser or device used, to keep you signed in and to spot misuse. Our servers also keep short-lived technical logs.

• To run your account and give you the courses you have joined.
• To save your progress, grade quizzes, and issue certificates when you finish a course.
• To let a course’s instructors follow their students’ progress and mark their work.
• To confirm your mobile number, and to contact you about your account and the courses you have joined or bought.
• Only if you agree: to call, text or WhatsApp you with course advice and offers. You can switch this off at any time under Profile → Security, or simply tell the person who calls you.
• To answer your messages and, if you subscribed, send our newsletter.
• To keep the service and your account secure, and to meet our legal obligations.

We use your data because you asked us to provide a service (your account and courses), because you agreed (calls about courses and offers, the newsletter, signing in with Google), because we need to keep the platform safe, or because the law requires it. We do not sell your data, and we do not use advertising or analytics trackers.

• Instructors of a course you joined see your name, photo, progress, quiz results and assignment submissions for that course.
• Everyone can see what you publish: reviews show your name and photo, public instructor profiles are public, and anyone with a certificate’s ID can check your name, the course and the date it was issued.
• Our staff can see account details where they need to, for example to help with a support request. Our course advisors see the name, email and mobile number of people who agreed to calls.
• Private lesson notes are visible only to you.

We use a small number of providers, each only for its own part of the service:

• DigitalOcean hosts our servers and database, in its data centre in Bangalore, India. Your data is therefore stored outside Sri Lanka.
• Mux stores and streams course videos. When you play a video, Mux receives your IP address and device details, as any video service must to deliver it.
• Resend sends our emails, such as password resets and enrolment confirmations. It receives your name, email address and the message.
• Text.lk sends our text messages, such as the code that confirms your mobile number. It receives your number and the message.
• Google, only if you choose to sign in with Google.
• Our payment provider, when you pay for a course.

We set two cookies, both needed for the site to work:

• vidlearn_session keeps you signed in. It lasts 30 days, or until you sign out.
• vidlearn_google exists only while you sign in with Google, for at most ten minutes, to make sure the sign-in that returns is the one you started.

We do not use advertising or analytics cookies.

We keep your account and learning records for as long as your account exists. Sign-in sessions expire after 30 days. Database backups are replaced on a rolling basis and kept for 14 days.

If you ask us to delete your account, we will remove it and your learning records within 30 days — including your certificates, which then can no longer be verified. We may keep purchase records for as long as tax and accounting law requires.

The site is served only over encrypted connections (HTTPS). Passwords and sign-in tokens are stored only as one-way hashes. Course videos and lesson files are delivered only to people allowed to see them, and access to the database is restricted to the people who run the service. No system is perfectly secure; if a breach affects your data, we will tell you and the authorities as the law requires.

You can:

• ask for a copy of the personal data we hold about you;
• correct it — most of it you can edit yourself on your profile page;
• ask us to delete it;
• withdraw your consent — switch off calls from a course advisor, or disconnect Google, under Profile → Security, or ask us to take you off the newsletter;
• object to how we use it.

To use any of these rights, write to us through the contact page. We will reply promptly and within the time the law allows. If you are not satisfied with our answer, you can complain to Sri Lanka’s Data Protection Authority.

Learners under 18 should use VidLearn Academy with a parent’s or guardian’s permission. If you are a parent or guardian and believe your child gave us personal data without it, contact us and we will help.

When we change this policy we will update the date at the top. If a change affects how we use data you have already given us, we will tell you on the site or by email before it takes effect.