Privacy Policy

What Omni Academy collects, why it is collected, how long it is kept, and what you can ask us to do with it.

The short version: you can read every course without an account and without telling us anything. If you create one, we store what is needed to show you your own progress. We do not sell personal data and we do not run advertising.

1. Who this policy covers

This policy explains how Omni Academy handles personal data in connection with this website. It applies to visitors who browse without an account and to people who hold one.

For the purposes of data protection law we are the controller of the personal data described below. If you have a question about anything in this policy, write to privacy@omniacad.com.

2. What we collect

We collect five kinds of information, and only one of them requires an account.

Account data. If you register, we store your email address, the name you choose to display, and a cryptographic hash of your password. We never store your password itself, and we cannot recover it.
Learning data. If you are signed in, we record which lessons you have opened and completed, your enrolment in a course and its progress, your quiz attempts and the answers you gave, the scores those attempts received, any notes you write against a lesson, and the certificates you have been issued.
Technical data. Our servers keep ordinary web logs, which include the internet protocol address the request came from, the time, the page requested, the referring page and the browser user agent string. These are produced by the act of serving a page and are used for security and for diagnosing faults.
Usage analytics. Where analytics is enabled, we collect aggregated information about which pages are visited and which features are used, so that we can see which courses people read and where they stop.
Messages you send us. If you use the form on the contact page, we store what you typed - your name, the address to reply to, the topic, the subject and the message - together with the account you were signed in to, if you were. We also store a keyed hash of the address the request came from, never the address itself, which is enough to stop one source flooding the form and not enough to identify anybody from the table.

We do not ask for, and have no use for, special category data: your health, your beliefs, your politics or anything comparable. Please do not put such information into a lesson note or a display name.

3. Why we use it, and on what basis

Each kind of data has a purpose, and we do not use it for anything else without telling you.

To provide the service you asked for. Your account data identifies you; your learning data is what makes a progress bar, a resume link, a quiz result and a certificate possible. The lawful basis is the performance of our agreement with you.
To keep the service secure and working. Technical data lets us detect abuse, investigate incidents and fix faults. The lawful basis is our legitimate interest in operating a secure service, balanced against your interests.
To improve the material. Analytics tells us which lessons are read and which are abandoned, which is how we decide what to rewrite. The lawful basis is consent where consent is required, and our legitimate interest otherwise.
To communicate with you about the service, for example to confirm an email address, to reset a password, or to tell you about a material change to these policies. The lawful basis is the performance of our agreement and compliance with our legal obligations.
To answer you. A message sent through the contact form is read by a person and replied to at the address you gave. It is not used to market anything to you, it is not added to a mailing list, and it is not passed to anybody outside the people who answer it. The lawful basis is our legitimate interest in replying to somebody who wrote to us.

We do not use your personal data to make decisions about you by automated means that produce legal or similarly significant effects.

4. Cookies and similar technologies

This site uses as little client-side storage as it can.

A session cookie, set when you sign in, which identifies your browser to the server for the length of your session. Without it you cannot stay signed in. It is strictly necessary and carries no advertising identifier.
A security token used to protect forms against cross-site request forgery. It exists so that only a form rendered by this site can be submitted to it.
Local storage in your own browser for small preferences, such as whether you chose the light or the dark theme. This never leaves your device and is never sent to us.
Analytics storage, where analytics is enabled, which allows a visit to be counted consistently. Where your jurisdiction requires consent for this, it is not set until you give it.

You can clear or block this storage through your browser settings. Blocking the strictly necessary items will prevent you from signing in.

5. Who we share it with

We do not sell personal data. We do not share it with advertisers, data brokers or anybody else for their own marketing purposes. We share it only in these situations.

Service providers who operate parts of the platform on our behalf, such as the hosting provider that runs the servers and the analytics provider that processes usage events. They act on our instructions and may not use the data for their own purposes.
Where we are required to by law, by a court, or by a regulator with the authority to compel disclosure.
Where it is necessary to establish, exercise or defend a legal claim, or to prevent or investigate fraud or a threat to the security of the service or its users.
To a successor organisation if the service is transferred, in which case this policy continues to apply to the data transferred until it is replaced by a policy that is no less protective.

6. Where it is processed

The service and the providers it depends on may process data in countries other than your own. Where personal data is transferred out of a jurisdiction that restricts such transfers, we rely on an appropriate safeguard recognised by that jurisdiction, such as standard contractual clauses or an adequacy decision covering the destination country.

7. How long we keep it

We keep personal data for as long as it is needed for the purpose it was collected for, and no longer.

Account data is kept while your account is open, and is deleted when you close it.
Learning data, including progress, quiz attempts, notes and certificates, is kept while your account is open. Closing your account deletes it, and that deletion cannot be undone.
Web logs are kept for a short period, measured in weeks rather than years, and then discarded. A log preserved as part of a security investigation is kept until the investigation is closed.
Analytics data is retained in aggregate. Aggregate figures that cannot identify anybody may be kept indefinitely.
Messages sent through the contact form are kept for two years, so that a conversation can be picked up again and so that we have a record of what was asked and answered. You may ask us to delete yours sooner, and we will.

8. Your rights

Depending on where you live, you have some or all of the following rights over your personal data. We honour them regardless of whether your jurisdiction compels us to.

Access: to be told whether we hold personal data about you, and to receive a copy of it.
Rectification: to have inaccurate data corrected, and incomplete data completed.
Erasure: to have your personal data deleted. Closing your account does this directly.
Portability: to receive the data you provided to us in a structured, commonly used, machine-readable format.
Restriction and objection: to ask us to stop or limit a particular use, including any use that relies on our legitimate interests.
Withdrawal of consent: where a use relies on your consent, to withdraw it at any time. Withdrawal does not affect processing carried out before you withdrew.

To exercise any of these, write to privacy@omniacad.com from the address associated with your account. We will respond within one month. If we need longer because the request is complex we will tell you why within that month. We do not charge for a request unless it is manifestly unfounded or excessive.

If you are not satisfied with how we have handled a request, you have the right to complain to the data protection authority in your country. We would ask you to raise it with us first, so that we have the opportunity to put it right.

9. Children

This service is not directed at children under thirteen, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, contact privacy@omniacad.com and we will delete it.

10. Security

Passwords are stored only as salted cryptographic hashes using an algorithm designed for the purpose, so a copy of our database would not reveal them. Traffic between your browser and the site is encrypted in transit. Access tokens are held in the server-side session and are never exposed to JavaScript in your browser. Forms are protected against cross-site request forgery, output is escaped at the point it is rendered, and database queries are parameterised.

No service can promise perfect security. If you discover a vulnerability in this site, please report it to security@omniacad.com rather than disclosing it publicly, and give us a reasonable opportunity to fix it. We will not pursue a researcher who reports a genuine issue in good faith and does not access or alter data belonging to other people.

11. Changes to this policy

We may update this policy as the service changes or as the law requires. The date at the foot of this page records when the current version took effect. Where a change materially affects how we use personal data, we will give notice before it takes effect, by a notice on the site or by email where that is appropriate.

12. Contacting us

Privacy questions, requests and complaints should go to privacy@omniacad.com. For anything else, the contact page lists the right address.

This version took effect on 5 October 2026.