Privacy notice

This policy is a working draft prepared for the ISDL pilot. It describes how the platform actually works and will be finalised after legal review, including confirmation of the school's legal entity and data controller.

Who we are

The International School of Disruptive Leadership ("ISDL") is the data controller for personal data processed through this website and platform. Contact for privacy questions: see the Contact page ("Privacy and data requests").

What we collect and why

• Account data (email address, password hash, roles, sign-in metadata) — to provide secure accounts. We never store passwords in readable form.
• Application data (profile details, answers to application questions, optional accommodation requests, scholarship statements, uploaded documents) — to assess your application and administer scholarships. We collect only what the published admissions process needs.
• Learning data (lesson progress, quiz attempts, reflections, assignment submissions, certificates) — to deliver the programme and determine completion.
• Communications (contact form messages, email delivery status) — to respond to you and to ensure important messages arrive.
• Tutor Assist data — see the section below.
• Security logs (IP address and browser information for sign-in and administrative actions) — to protect accounts and maintain an audit trail.

Legal bases

Depending on the applicable law, we rely on taking steps at your request before entering a contract (applications), performing a contract (enrolment), legitimate interests (security, audit, service improvement), and consent where we ask for it (optional updates and draft reminders). You can withdraw consent at any time.

Documents

Uploaded documents are stored privately with our media storage provider (Cloudinary). They are never given public URLs. Authorised staff view them through short-lived signed links, and each access is logged.

AI processing

• Admissions: reviewers may request an AI summary of answers against the published rubric. Only your application answers are sent, with no contact details, to the configured AI provider (OpenAI). Summaries are labelled as AI-generated, are editable, and never make decisions. AI is not used to infer personality, protected characteristics, or future success.
• Tutor Assist: when you use Tutor Assist, your question and the relevant approved course excerpts are sent to OpenAI to generate an answer. We do not send your application, scholarship, payment or profile data. By default we keep Tutor Assist conversation text for up to 30 days so you can continue a conversation, and you can clear it at any time; operational metadata (time, lesson, token counts, status) is kept for monitoring and cost control.
• We do not use your application essays or chats to train AI models. Provider data-use and retention settings are reviewed before launch.

Processors

We use service providers to run the platform: hosting (Vercel), database (Neon), media storage (Cloudinary), transactional email (Resend or another configured provider), and AI (OpenAI). Some providers may process data outside your country; where required, appropriate safeguards are used.

Retention

• Declined applications: up to 12 months after the decision, then deleted or anonymised.
• Withdrawn applications: up to 6 months.
• Learner records and certificates: kept for up to 6 years after completion so certificates can be verified.
• Tutor Assist message text: up to 30 days by default.

Retention periods are configured in the platform and may be adjusted after legal review.

Your rights

Depending on your location, you may have rights to access, correct, delete, restrict or object to processing of your data, and to data portability. Use the contact form (topic "Privacy or data request"). You may also complain to your local data protection authority.

Changes

We will update this notice when our processing changes and show the date of the latest version.