Privacy and cookies

Postcode Academy stores an account email and name, course progress, quiz attempts, certificates, organisation membership, support messages, and tutor conversations. We use them to run training, issue certificates, and let an organisation see only its own learners.

We do not ask for BVN, NIN, postcode-portal passwords, or API secrets. If you paste a secret into the tutor, the message is redacted and you are told to rotate the key.

We do not keep a copy of the official postcode register. Sample buildings in the simulator are invented.

A building code plus a person’s name is personal data when you store it in your own systems. That obligation sits with your organisation, not with this academy, unless you also type it into a support ticket or a tutor chat. Please don’t.

The sign-in cookie is essential. A separate browser flag remembers that you dismissed the cookie notice. There is no advertising cookie.

From Settings you can download a JSON export of your academy records or delete them. Deleting removes progress, certificates, chats, and the academy profile. The sign-in identity itself is managed by the authentication service and may remain until that account is removed there.

Organisation admins and trainers can see completion for people who accepted an invite to their workspace. They cannot see another organisation. Platform administrators can see accounts and certificate ids in order to operate the academy.

Tutor calls, when the model is configured, are sent to the xAI API to produce an answer. Do not include customer lists.