Privacy Notice

Bamboo Works AI Academy is an online learning platform operated by [Bamboo Works legal entity name], [registered address], Philippines. For any question about this notice or your personal data, contact [privacy@bambooworks.io].

Using the platform means you agree to this notice, which is also why signing up asks you to agree to it.

• Account details — your email address, name and role. Used to sign you in, to place you in the right courses and groups, and to send invitations and password resets.
• Learning activity — while you are signed in, we keep a record of which lessons and videos you have watched, how far you got and how long you spent on each module, along with your progress, attempts, scores and certificates. Used to show your progress, let you pick up a video where you left off, award completion and report on course effectiveness. If you are not signed in, we keep no record of which videos you watch.
• What you submit — your free-text answers to exercises, assessments and assignments, and any text you enter in the prompt tools. Used to grade and give feedback on your work.
• Feedback you send us — your message and any screenshot you attach. Screenshots are stored in a private bucket, not a public one.
• Security records — rate-limiting records that include your IP address and email, kept to stop password-guessing and abuse of the sign-in endpoints.

We use strictly necessary cookies only — two of them, both set by us, both part of signing you in:

• Your session — holds your sign-in token so you stay logged in as you move between pages. Without it you could not stay signed in. It lasts until you sign out, and may be split across a few numbered cookies when it is large.
• A short-lived login check — written only while you are signing in, accepting an invitation or resetting your password, and deleted the moment that finishes. It is a one-time random value that proves the browser completing the sign-in is the one that started it, so an intercepted link cannot be used by someone else.

We set no analytics, advertising or tracking cookies, and our error-reporting tool sets no cookies at all. There is nothing here to consent to or opt out of, which is why you see no cookie banner. If that ever changes, this notice changes first and we will ask you before setting anything non-essential.

Lesson videos are embedded through YouTube’s privacy-enhanced player. When we last checked (October 2026), it set no cookies, either before or after a video was played. It does store a few items in your browser’s local storage and IndexedDB under YouTube’s own domain (youtube-nocookie.com) as soon as a lesson page loads, before you press play, and adds a record of your caption setting once a video plays. Those items belong to YouTube’s player, not to us.

We keep the number of third parties small, and we do not sell personal data to anyone.

• Supabase — hosts the database, the authentication system and file storage. This is where your account and learning data live.
• Vercel — hosts and serves the application.
• Sentry — receives error reports so we can fix faults. Reports are scrubbed before they are sent: cookies, request bodies, query strings, IP and authorization headers are dropped, email addresses are redacted, and you are identified only by an opaque account ID.
• Anthropic — grades your written answers and powers the prompt tools. It receives the text you wrote, but not your name or email address, and it is not told which account the text belongs to. Administrators who build courses also send course content they provide, such as outlines and notes, to Anthropic’s AI.
• YouTube / Google — this platform uses YouTube API Services to deliver lesson videos. When a lesson page loads, your browser connects to YouTube and Google directly, so they receive your IP address, details of your browser and the address of this site; once you press play they receive more, as the video itself is streamed from Google’s servers. How Google handles that data is set out in the Google Privacy Policy, and your use of the videos is subject to the YouTube Terms of Service.
• Email delivery — invitation and password-reset messages are sent through our authentication provider’s mail service, which handles your email address and the one-time link in order to deliver the message.

Your data is kept for as long as your account is active. When an account is deleted, the personal data attached to it is removed from our database along with it.

Some content you created — for example a feedback item — may remain after deletion with the link to you removed, so that it no longer identifies you. A detailed retention schedule covering each category is [being finalised and will be published here].

You can ask for a copy of your data, ask us to correct it, or ask us to delete your account. You can start an export or a deletion request yourself from your profile, under Data & Privacy, or contact us at [privacy@bambooworks.io].

If you are in the Philippines, the Data Privacy Act of 2012 (RA 10173) gives you these rights and the right to complain to the National Privacy Commission. If you are in the EU or UK, the GDPR gives you equivalent rights and the right to complain to your local supervisory authority.

If we change how we handle personal data we will update this page and change the date at the top. Material changes will be notified to you in the application.