Privacy Policy

Controller

Personal data we process

• Contact and enquiry data: name, email, organisation, role, training interest, cohort preferences, messages, and communication history.
• Account and learner data: login identifiers, session records, course enrolment, module progress, activity submissions, discussion or homework content, certificates, and support requests.
• AI learning data: learner prompts, assistant responses, safety warnings, usage metadata, and related context needed to deliver the learner assistant and course exercises.
• Payment and administration data: invoice, VAT, payment status, payment provider references, refunds, and financial records. AidGPT does not store full card numbers.
• Technical data: IP address, browser or device data, pages visited, server logs, security events, essential cookies, local storage needed to operate the service, and privacy-focused analytics.

Purposes and legal bases

AI-assisted training data

AidGPT is designed for responsible AI learning. Learners must not submit beneficiary details, safeguarding material, HR records, confidential donor information, procurement decisions, medical or legal material, secrets, or other sensitive content unless a separate written agreement expressly permits it and appropriate safeguards are in place.

AI-assisted features may process prompts, responses, and activity context through service providers acting under contract. We use this data to provide the training experience, monitor safety, prevent abuse, support learners, and improve course quality. We do not use the public site or learner assistant to make solely automated decisions that produce legal or similarly significant effects about learners.

Newsletter subscriptions and protected resources

When you request AidGPT newsletter updates, we hold a pending subscription request before you confirm through the email we send. While the request is pending, Resend receives the submitted email address to deliver the transactional confirmation email on our behalf. That transactional delivery does not create or update a CRM record or a Resend marketing Contact.

After confirmation, we create or update the related CRM record. Where suppression does not apply, we queue synchronisation with a Resend marketing Contact, including your selected interests and subscription preferences. An existing do-not-contact setting in our CRM or an existing suppression at Resend can prevent that synchronisation and marketing delivery. We do not clear a global unsubscribe recorded by Resend. We opt that Contact out of AidGPT updates and remove it from AidGPT subscriber and interest groups, while leaving unrelated preferences unchanged. Resend otherwise processes marketing delivery and preference information on our behalf.

PDF-only access to a protected resource does not add you to marketing updates. Address-bearing resource requests are retained for 30 days to provide and protect that access. If you separately choose newsletter updates, the newsletter confirmation process applies.

Every newsletter includes a way to unsubscribe or withdraw your consent. We may receive Indicative delivery, open and click reporting from our email provider to assess whether communications are reaching subscribers; these measures are not treated as precise engagement evidence.

Who receives personal data

We share personal data only where needed for the purposes above, including with hosting, database, email, analytics, payment, security, and AI infrastructure providers; course facilitators and support staff; professional advisers; auditors; public authorities; or a successor organisation if there is a restructuring. Current operational providers may include Vercel, Resend, Revolut, Umami analytics, and contracted AI service providers.

Some providers may process data outside Cyprus or the European Economic Area. Where that happens, we use appropriate safeguards such as adequacy decisions, Standard Contractual Clauses, processor agreements, and risk-based security measures.

Retention

• Training enquiries and contact records are normally kept for up to 3 years after the last meaningful interaction, unless a longer period is needed for an active relationship or dispute.
• Learner account, progress, certificate, and course records are kept while the account is active and then for as long as needed to provide access, verify completion, support audit needs, or meet legal obligations.
• Payment, invoice, VAT, and accounting records may be kept for up to 7 years or longer if required by Cyprus or EU law.
• Security logs and technical records are kept for the shortest practical period, normally up to 12 months, unless they are needed to investigate abuse, fraud, or security incidents.
• Address-bearing protected-resource requests are retained for 30 days. Newsletter subscription records are retained while needed to manage your consent, preferences, and any applicable suppression or legal obligations.

Data subject rights

Subject to the conditions and limits in data protection law, you may request access, rectification, erasure, restriction, portability, or objection to processing. Where processing is based on consent, you may withdraw that consent at any time without affecting earlier processing.

You can contact us at mariejosee@marketimpact.org to exercise these rights. You also have the right to lodge a complaint with the Cyprus Commissioner for Personal Data Protection or another competent supervisory authority.

Cookies and local storage

AidGPT records anonymous page paths and four fixed, content-free funnel events: application form started, application submitted, team-training contact form started and team-training contact form submitted. These events contain no form content and use no persistent visitor identity.

We use essential cookies and similar technologies to provide login sessions, security, and site functionality. We may use local storage for preferences such as theme selection. We use privacy-focused analytics to understand aggregate site use and improve the service. If we add non-essential tracking that requires consent, we will request consent before using it.

Children, security, and updates

AidGPT is intended for adult professionals and is not directed at children under 18. We use technical and organisational measures to protect personal data, including access controls, secure hosting, monitoring, and staff confidentiality. No online service can be guaranteed fully secure.

We may update this policy as our services, providers, or legal obligations change. Material changes will be posted on this page and, where appropriate, notified to affected users.