Privacy Policy
Last updated: 28 October 2026
Beta policy, first effective 1 September 2026
1. Who operates this service
Programme Designer is a beta service for designing and reviewing academic programmes. It is operated by the same team and legal entity that runs our other course-authoring product, under a separate brand for this beta. If you have any question about who is processing your data, contact john@simvirtua.com.
2. Information we collect
- Account information: email address and name when you sign up.
- Programme content: the programmes, modules, and outcomes you create in the tool.
- Usage data: basic analytics about how the beta is used, so we can improve it.
3. How we use your information
- To provide and improve the programme design and review features.
- To respond to support requests and, occasionally, ask for beta feedback.
- To understand usage patterns across the beta so we can prioritise fixes and features.
4. AI processing of your programme content
When you use the AI programme advisor, the relevant parts of your programme content are sent to a third-party AI model provider so that the AI can read your spec and generate suggestions. The providers that can receive it are listed in section 5. We do not use your programme content to train any AI model. What an AI provider says about its own training and retention practices is that provider's statement, attributed to it in the list in section 5.
AI processing takes place in the regions of the selected AI provider, outside the EU unless your organisation routes AI to its own endpoint.
Some AI data is stored, depending on the feature and on your settings. The list below shows each kind of stored AI data, when it is stored, who can read it and how long it is kept.
| What is stored | When and what | Who can read it | How long it is kept |
|---|---|---|---|
| AI usage records | When and what For every AI request. Who made the request, which feature it came from and, for a course, which course, the model and provider, token counts, cost in credits, response time, the outcome, and for a failed request the first 120 characters of the error message. | Who can read it
| How long it is kept Kept until the account is deleted. |
| Prompt summaries | When and what Only when an organisation turns on prompt logging. A short description of each request: the feature used and any course, lesson and title text it concerned, up to 60 characters each, plus the length of any content sent. Never the full prompt. | Who can read it
| How long it is kept Kept until the account is deleted. |
| Captured prompts and responses | When and what Only when a user turns on capture for themselves, or an organisation turns it on for its members. The full request: system prompt, messages, the AI response and any tool calls. Images are replaced with a short placeholder. Teaching Guide material is also replaced with a short placeholder, and so is the AI response to a request that used it. Where the guide is available to the AI, earlier AI replies in the conversation, and any reply that follows them, are replaced too. This is because the guide is private to its author. Email addresses and phone numbers are redacted only when the organisation turns on personal-data redaction. | Who can read it
| How long it is kept Deleted automatically after the chosen period of 1 to 365 days (default 30). The period is fixed when the prompt is captured, so changing the setting later does not change when prompts already captured expire. |
| Prompts held for image processing | When and what When the selected AI model cannot process an image at the time of the request. The full prompt and conversation turns, with the images held separately in private storage. | Who can read it
| How long it is kept The images are deleted automatically after 30 days unless the request has been retried. The prompt text is kept until the account is deleted. When the account is deleted the prompt record is removed, but the held images are not automatically deleted. |
| Saved Programme Designer answers and reviews | When and what Only when a user chooses to save a Programme Designer answer or review. The full answer or review text, up to 100,000 characters, with its findings and, for a saved answer, the question asked. | Who can read it
| How long it is kept Kept until the programme is deleted. |
| Opening text of Help and Programme Designer questions | When and what For every question asked of the Help assistant or the Programme Designer. The first 300 characters of the question, with the feature and time it was asked. Never the answer. | Who can read it
| How long it is kept Kept until the account is deleted. |
5. Hosting and other sub-processors
The database, file storage, authentication and application are hosted in the United States (Supabase US-East and Vercel US regions).
We rely on the third parties below to run the beta. Each is listed with where it processes data and what it is used for; uses that apply only when you turn on a feature are listed separately. Every addition, removal or correction to this list is recorded in the change history on our Trust page.
Always used
| Third party | Location | Purpose and data |
|---|---|---|
| Supabase | Location USA | Purpose and data Database, authentication (including SAML single sign-on) and file storage for the whole platform Data: Account details (name, email, username); Course, programme and file content; AI usage records and stored AI data; Sign-in and session data Always |
| Vercel | Location USA + Edge | Purpose and data Application hosting and serverless functions Data: All request data, including IP address and the content of each request Always Web Analytics: page views and visit counts Data: Pages visited; Referrer; Device, browser and country, derived from the request Always Speed Insights: page performance measurements Data: Page URL; Performance timings; Device and browser type Always Retention: Vercel states that on the Hobby plan CourseFoundry uses, Web Analytics data is guaranteed to be kept for a 1-month reporting window, and that Vercel may store data for longer Vercel states: On the Hobby plan, Web Analytics data is guaranteed to be stored and viewable for a 1-month reporting window, and Vercel may store data for longer. Source, checked 26 September 2026. |
| Resend | Location USA | Purpose and data Transactional email delivery Data: Recipient email address and name; Email content Always Retention: Resend states it retains email data for 30 days Resend states: Email data, including content, metadata, delivery events and logs, is retained for 30 days on all standard plans. Source, checked 24 September 2026. |
| Cloudflare | Location Global CDN | Purpose and data Turnstile bot protection on sign-up, sign-in, password reset and enquiry forms Data: IP address; Browser and TLS fingerprint; User agent Always |
| Anthropic | Location USA (data at rest); inference may run globally | Purpose and data Default AI provider for AI Forge, chat, agent, workflows, the learner tutor and the Programme Designer Data: Prompts, including course and programme content; Pasted images; AI responses Always Anthropic states: API inputs and outputs are deleted within 30 days of receipt, or kept up to 2 years if flagged for a usage-policy violation. Source, checked 24 September 2026. Anthropic states: API inputs and outputs are not used to train its models by default. Source, checked 24 September 2026. |
| OpenAI | Location Not stated by the provider | Purpose and data Search indexing of programme outcomes (embeddings), used for outcome search and benchmarking, on the platform account, whichever AI provider an organisation selects Data: Programme outcome text Always OpenAI states: API data is kept in abuse-monitoring logs for up to 30 days and is not used to train its models. Source, checked 24 September 2026. |
| Google Fonts | Location Not stated by the provider | Purpose and data Web fonts, loaded by the browser from Google Fonts on every page Data: IP address; User agent Always |
Used only when you enable a feature or supply your own key
| Third party | Location | Purpose and data |
|---|---|---|
| jsDelivr | Location Global CDN | Purpose and data Loads the pdf.js library in an author's browser to read a PDF being imported Data: IP address; User agent (browser type and version); Referring site (domain only); The script requested When you enable: PDF imports jsDelivr states: The CDN is operated by Volentio JSD Limited, a company registered in England and Wales. Source, checked 25 September 2026. jsDelivr states: All CDN traffic is served by Cloudflare, Fastly and Gcore, which see the IP address and other information the browser sends. Source, checked 25 September 2026. jsDelivr states: Non-aggregated usage data, which may include IP address, browser, referrer domain and requested URL, is kept until it is analysed and then deleted, unless it is used for security or to improve the service or the law requires longer; aggregated usage data is kept indefinitely. Source, checked 25 September 2026. |
| GitHub | Location USA (primarily) | Purpose and data Programme backups Data: Programme content; GitHub username and access token When you enable: GitHub connection Sign in with GitHub, through Supabase Auth Data: GitHub account name and email When you enable: Sign in with GitHub |
| OpenAI | Location Not stated by the provider | Purpose and data AI features, when OpenAI is the selected provider or an author supplies their own OpenAI key Data: Prompts, including course and programme content; Pasted images; AI responses With your own provider key OpenAI states: API data is kept in abuse-monitoring logs for up to 30 days and is not used to train its models. Source, checked 24 September 2026. |
| Location Any country (Google states Gemini API data may be processed in any country where it or its agents operate) | Purpose and data Gemini AI features, when an organisation or author supplies its own Gemini key Data: Prompts, including course and programme content; Pasted images; AI responses With your own provider key Sign in with Google, through Supabase Auth Data: Google account name and email When you enable: Sign in with Google Google states: Prompts and responses on paid-tier keys are not used to improve its products; free-tier prompts and responses are used to improve its products and may be read by human reviewers. Source, checked 24 September 2026. | |
| Microsoft | Location The geography of the organisation's own Azure resource | Purpose and data AI features routed to an organisation's own Azure OpenAI or Foundry deployment, authenticated with Microsoft Entra Data: Prompts, including course and programme content; Pasted images; AI responses; Entra client credentials With your organisation's own AI endpoint Audit log export to an organisation's Azure Blob Storage or Log Analytics workspace Data: Audit events, including user identifiers and actions taken When you enable: Azure audit export Microsoft states: Prompts and completions are not used to train its models, and Standard deployments process data in the geography the customer chose. Source, checked 24 September 2026. |
| An AI endpoint you configure | Location Wherever the endpoint you configure processes data | Purpose and data AI features routed to an OpenAI-compatible endpoint that you add in Settings, such as a self-hosted model server or another AI provider Data: Prompts, including course and programme content; AI responses; The key you supply for that endpoint With an AI endpoint you configure |
Where personal data is transferred out of the EU, we rely on Standard Contractual Clauses or an equivalent transfer safeguard.
6. Data retention and deletion
We keep your account and programme content while your account is active. You can download a copy of your data, or delete your account yourself, in Settings. You can also ask us to do either by emailing john@simvirtua.com. What account deletion removes, and what is kept and why, is listed below.
| What | What happens | Details |
|---|---|---|
| Your account and the records that belong to it | What happens Removed | Details Account deletion is self-service in Settings and takes effect immediately in the live system. Your profile, any courses you created and their files, your AI usage records, captured prompts, Help and Programme Designer question records, saved Programme Designer answers and reviews you wrote, and the records of prompts held for image processing are removed at once. Two kinds of stored file are not removed from storage when the account is deleted: images held for deferred AI processing, and rendered course output. |
| Security and activity audit events | What happens Kept | Details Kept as a security record, and the link to your account is removed. An event can still contain your email address (for example, invitation and module-invite events), your IP address and your browser details. Events in an organisation stay readable by that organisation's owners and administrators. |
| Programme change-log entries | What happens Kept with your account link removed | Details The author link is removed; the entry is otherwise kept in the programme's change history. |
| Beta feedback messages | What happens Kept | Details The feedback text is kept to improve the product, and your email address and username are removed. The rest of what was recorded with it is kept: your plan and organisation name, the page address and title, the name of any linked course or programme, your browser details, screen size, theme and language, and the app version. |
| Database backups | What happens Kept in backups until they expire | Details Backups may still hold deleted data for up to 7 days, after which it is gone. |
| An organisation's view of a member who leaves | What happens Kept | Details AI usage records and captured prompts made in an organisation stay visible to that organisation's owners and administrators after the member leaves, until the account or the organisation is deleted. |
7. Your rights
Under GDPR and applicable data protection law, you have the right to:
- Access & portability: request a copy of your data.
- Rectification: ask us to correct inaccurate information.
- Erasure: ask us to delete your account and its data.
To exercise any of these rights, email john@simvirtua.com.
8. Cookies
We use only essential cookies needed to keep you signed in. We do not use advertising or tracking cookies.
9. Changes to this policy
This is a beta policy and may be updated as the product evolves. We'll note material changes on this page, and the date at the top shows when it was last updated.
10. Contact
Questions about this policy? Email john@simvirtua.com.