Privacy policy

Version of [INSERT date]. This policy explains what personal data the One Academy learning platform (the “Platform”) collects, why, how we keep it and what your rights are.

1. Who we are

The data controller is [INSERT the full legal name of the church organisation], registration number [INSERT number], address: [INSERT address], Thailand (“we”). For questions about your data, write to [INSERT email for data requests].

2. What data we collect

Account data: name, email address, password (stored only as a secure hash), site language.
If you sign in with Google: your Google account ID, name and verified email address.
If you sign in with Telegram: your Telegram ID, name, username and your permission for the academy bot to message you.
Learning data: courses and lessons you opened, progress, where you stopped in videos and audio, quiz results, answers to open questions, notes, reviews, questions to teachers, badges and certificates.
Purchase data: orders, amounts, payment method and payment status. We never receive or store your card number; the payment provider handles it.
Technical data: IP address, browser and device type, sign-in times — for security and abuse prevention.

3. Why we use your data

To create and run your account and give you access to courses.
To save your progress and send reminders, reports, congratulations and certificates (you can turn reminders off in your settings).
To take payments, grant access to paid courses and keep payment records.
To answer your questions and requests.
To protect the Platform from spam, break-ins and fraud.
To improve the courses using anonymous statistics (for example, where learners most often stop).

Legal bases: your consent, performance of the contract (the public offer) and our legitimate interest in keeping the Platform secure. We do not sell your data or use it for third-party advertising.

4. Who we share data with

Only with services the Platform cannot work without, and only as much as they need:

hosting and file storage: [INSERT provider, e.g. DigitalOcean or Hetzner, and the server location];
sending email: [INSERT email service];
payments: [INSERT payment providers, e.g. Stripe, YooKassa];
sign-in with Google (Google LLC) and Telegram (Telegram FZ-LLC), if you choose them;
bot protection: Cloudflare Turnstile;
lesson videos may load from YouTube or Vimeo, which receive your IP address and follow their own policies.

We may also disclose data when the law requires it. Some services are located outside your country; when we transfer data to them, we require adequate protection.

5. Cookies

We only use necessary cookies: to keep you signed in (session), to remember the site language and colour theme, to protect the Google sign-in and for the “I am not a robot” check. We do not use third-party advertising or analytics cookies. If you turn cookies off in your browser, you will not be able to sign in.

6. How long we keep data

Account and learning data: as long as the account exists. Payment records: as long as accounting law requires [INSERT period, e.g. 5 years]. Technical logs: no longer than [INSERT period, e.g. 90 days]. Database backups are kept for 14 days.

7. How we protect data

The site only works over a secure connection (HTTPS), passwords are stored as secure hashes, and only staff who need it for their work can see your data. We keep backups and limit sign-in attempts.

8. Your rights

You can ask for a copy of your data, correct it, delete your account and all related data, restrict processing or withdraw your consent. Write to [INSERT email for data requests]; we answer within 30 days. You may also complain to the data protection authority of your country.

9. Children

The Platform is meant for people aged [INSERT age, e.g. 16] and over. Younger children may study with their parents’ consent and supervision.

10. Changes

We may update this policy. We will announce important changes on the site or by email. The current version is always on this page.

11. Contact

[INSERT full legal name], [INSERT address]. Email: [INSERT email]. Phone: [INSERT phone].

[CHECK WITH A LAWYER: compliance with Thailand’s Personal Data Protection Act (PDPA), the GDPR for learners in the EU and Russian Federal Law No. 152-FZ for learners in Russia.]

2. What data we collect

Account data: name, email address, password (stored only as a secure hash), site language.

If you sign in with Google: your Google account ID, name and verified email address.

If you sign in with Telegram: your Telegram ID, name, username and your permission for the academy bot to message you.

Learning data: courses and lessons you opened, progress, where you stopped in videos and audio, quiz results, answers to open questions, notes, reviews, questions to teachers, badges and certificates.

Purchase data: orders, amounts, payment method and payment status. We never receive or store your card number; the payment provider handles it.

Technical data: IP address, browser and device type, sign-in times — for security and abuse prevention.

3. Why we use your data

To create and run your account and give you access to courses.

To save your progress and send reminders, reports, congratulations and certificates (you can turn reminders off in your settings).

To take payments, grant access to paid courses and keep payment records.

To answer your questions and requests.

To protect the Platform from spam, break-ins and fraud.

To improve the courses using anonymous statistics (for example, where learners most often stop).

Legal bases: your consent, performance of the contract (the public offer) and our legitimate interest in keeping the Platform secure. We do not sell your data or use it for third-party advertising.

4. Who we share data with

Only with services the Platform cannot work without, and only as much as they need:

hosting and file storage: [INSERT provider, e.g. DigitalOcean or Hetzner, and the server location];

sending email: [INSERT email service];

payments: [INSERT payment providers, e.g. Stripe, YooKassa];

sign-in with Google (Google LLC) and Telegram (Telegram FZ-LLC), if you choose them;

bot protection: Cloudflare Turnstile;

lesson videos may load from YouTube or Vimeo, which receive your IP address and follow their own policies.

We may also disclose data when the law requires it. Some services are located outside your country; when we transfer data to them, we require adequate protection.

5. Cookies