Privacy Policy

This explains what personal information the OTAC Training Hub holds, where it goes, and how to get it deleted. Everything below describes what the platform does now. There are no promises here about things we have not built.

1. Who we are

Online Training & Compliance Limited is the training provider and the data controller: it decides what training is delivered and what information is collected to deliver it.

Otterspool Studios builds and operates the platform as the processor, acting on the training provider's instructions.

Full company details are in the legal notice.

2. What we hold

• Your account — your name, email address and, if you give one, your phone number.
• Your training — which courses you have, how far through you are, and whether you have completed them.
• Your assessments — your exam attempts, the answers you gave and your scores.
• Your certificates — your name is printed into the certificate image itself, and the image is stored in cloud file storage.
• Your conversations with the AI — what you asked the mentor and what it answered, and the full back-and-forth with the assessor, stored against your account.
• Support tickets — what you wrote and any screenshot you attached.
• Enquiries — if you use a form on the public site: your name, company, email, phone, your message, which storefront you used and the web address you came in on. You do not need an account to send one.
• Demonstration sign-ups — if you try a course at an event, we create a record with your name and whatever contact details you give, plus your progress through the demo. This is not an account and you cannot log back into it.
• Payments — we store a reference to the Stripe checkout and the receipt details Stripe gives us back. Card details never reach our servers; you enter them on Stripe's own payment page.
• Your basket — the courses you have added, kept in your own browser, and also saved against your account if you are signed in.

3. Artificial intelligence, and where it happens

The mentor, the assessor and the voice features are provided by OpenAI, whose service runs in the United States. This means information leaves the UK and the European Economic Area:

• Asking the mentor or assessor a question sends your question, the conversation so far, and the course material you are working on.
• Written exam answers are sent for marking.
• Voice — see section 4.

We also use the same service to check the quality of our own exam questions and to help draft course material. That work uses course content, not anything about you.

4. Voice, specifically

When you press to talk, your device records audio and sends it to us. We pass it straight to the transcription service to be turned into text. The recording is not kept. It exists as a temporary file on our server only for as long as the transcription takes, and is deleted immediately afterwards — including when the transcription fails.

The text is kept. Once the transcription comes back it becomes your message, and it is stored against you like anything else you type — in your mentor conversation, your assessor conversation, or your exam answer.

What the transcription provider does with the audio at their end is governed by their own terms, not ours.

5. Who else handles your information

• Google Cloud — hosting, the database and file storage (including your certificates and any screenshots).
• OpenAI (United States) — the mentor, the assessor, exam marking and voice transcription.
• Stripe — payments.
• SendGrid — the emails we send you.

We do not sell your information, and we do not share it for advertising.

6. Cookies and what is stored in your browser

• Browsing the public site sets no cookies at all. The home page, the employers page, the about page, the contact page and the course pages set none.
• Signing in sets one cookie, named session. It is what keeps you signed in. It cannot be read by scripts, it is not sent to other sites, and on the live site it is only sent over an encrypted connection.
• Your basket is kept in your browser's local storage, not in a cookie. It holds course names and prices. It contains nothing that identifies you, and you can clear it by emptying your basket.
• We use no analytics and no advertising or tracking cookies. There is no Google Analytics on this site.
• Some page styling and code is loaded from other companies' servers — Tailwind CSS, jsDelivr, and, once you are signed in, Google Fonts. Those requests tell those companies your IP address and which browser you are using. They do not set cookies here.

7. How long we keep things

We do not delete anything on a timer. There is no automatic expiry, and we are not going to claim one. Your records stay until somebody deletes them — either because you asked, or because an administrator removed them.

To have your information deleted, email support@otacltd.com. When an account is erased we remove:

• your account record, and your name, email and phone with it;
• your course progress and completion records;
• your conversations with the mentor and the assessor;
• your support tickets, whether they were raised from your account or just from your email address;
• your saved basket;
• the certificate image files and any screenshots you attached, deleted from file storage, not merely unlinked.

What remains afterwards is a deletion record containing no personal information — a note that an erasure happened and when — so we can show the request was carried out.

Enquiries are handled separately. An enquiry sent from a public form is not attached to any account, so it is not swept up by an account deletion — deliberately, because matching on an email address alone could delete a different person's enquiry. An administrator deletes these individually after checking what matches your address. Ask at the same address and we will do it.

8. Sending information outside the UK

Hosting, the database and file storage are in the United Kingdom and the European Economic Area. The AI features are not: as set out in section 3, your questions, the course material and your exam answers are processed by OpenAI in the United States. If you would rather not have your words processed there, do not use the mentor, the assessor or the voice features; the written parts of a course do not require them.

9. Your rights

You can ask for a copy of what we hold about you, ask us to correct it, ask us to delete it, object to how we use it, or ask us to restrict it. Email support@otacltd.com and we will act on it.

If you are not satisfied with how we have handled it, you can complain to the Information Commissioner's Office at ico.org.uk.

10. Changes

If we change what the platform does with your information, this page changes with it. It is meant to describe the software as built, so it should never be ahead of the code or behind it.