Privacy Policy

1. Who We Are

CourseSpaces is operated by Toolbox Labs ("we", "us", "our"), a company based in London, United Kingdom. We are the data controller for the personal data described in this policy.

This policy explains what personal data we collect when you visit coursespace.io or use the CourseSpaces platform, why we collect it, the lawful basis on which we process it, and the rights you have over it. It is written to meet our obligations under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Personal Data We Collect

We collect the following categories of personal data:

• Information you give us directly. Your first name and email address when you start a free trial or submit the contact form. If you subscribe, your billing details are collected and held by Stripe — we never see or store your full card number.
• Content you create. Courses, lessons, videos, community posts and any other material you upload to the platform.
• Usage and device data. Pages viewed, approximate location derived from IP address, browser and device type, referring website, and how you interact with the site. Some of this is collected only if you accept cookies.
• Advertising data. If you accept cookies, the Meta (Facebook) Pixel records that you visited the site and whether you started a trial, so we can measure how our advertising performs.

We do not collect special category data (such as health, religious or biometric data) about visitors to this site, and we ask that you do not send it to us.

3. Why We Process Your Data, and Our Lawful Basis

• To provide the service — creating and running your account, hosting your content, processing payments. Lawful basis: performance of a contract.
• To send service messages — trial reminders, security notices, billing confirmations, and setup guidance relating to your account. Lawful basis: performance of a contract and legitimate interests.
• To keep the platform secure — preventing fraud, abuse and automated signups (we use Cloudflare Turnstile for this). Lawful basis: legitimate interests.
• To measure and improve the site — understanding which pages work and which do not. Lawful basis: consent, given through our cookie banner.
• To measure our advertising — the Meta Pixel. Lawful basis: consent, given through our cookie banner. If you decline, the Pixel is never loaded.
• To meet legal obligations — keeping accounting and tax records. Lawful basis: legal obligation.

Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights, and we have concluded they are not. You may object at any time (see section 8).

4. Cookies and the Meta Pixel

We use a small number of cookies that are strictly necessary to run the site — for example, remembering your cookie choice. These do not require consent.

Analytics and advertising cookies, including the Meta (Facebook) Pixel, are only set if you click Accept on our cookie banner. If you click Decline, the Meta Pixel script is not loaded at all and no advertising data is sent. Declining does not affect how the site works.

You can change your mind at any time by clearing your browser's site data for coursespace.io, which will make the banner appear again. Full detail is in our Cookie Policy.

5. Who We Share Your Data With

We do not sell your personal data. We share it only with service providers ("processors") who help us run CourseSpaces, and only to the extent they need it:

• Supabase — database and account hosting.
• Stripe — payment processing and subscription billing. Stripe acts as an independent controller for payment data; see Stripe's own privacy policy.
• VBOUT — email marketing and contact management.
• Emailit — transactional and service email delivery.
• Bunny.net — video hosting, streaming and content delivery.
• Cloudflare — site hosting, content delivery and bot protection (Turnstile).
• Meta Platforms — advertising measurement via the Pixel, only where you have consented.

We may also disclose data where we are required to do so by law, or to establish, exercise or defend legal claims.

6. International Transfers

Some of our processors are based outside the United Kingdom, including in the United States. Where personal data is transferred outside the UK, we rely on the UK Government's adequacy regulations, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, together with appropriate additional safeguards.

7. How Long We Keep Your Data

• Trial accounts that are never converted — retained for three months after the trial ends, then deleted.
• Cancelled subscriptions — your content and data are stored for three months after cancellation so you can return, then deleted.
• Marketing contacts — retained until you unsubscribe or ask us to erase your data.
• Financial records — retained for six years, as required by UK tax law.
• Website analytics — retained in aggregated or pseudonymised form for up to 26 months.

8. Your Rights

Under UK GDPR you have the right to:

• Access — obtain a copy of the personal data we hold about you.
• Rectification — have inaccurate or incomplete data corrected.
• Erasure — ask us to delete your data where there is no overriding reason for us to keep it.
• Restriction — ask us to limit how we use your data while a concern is resolved.
• Portability — receive the data you gave us in a structured, commonly used, machine-readable format.
• Object — object to processing carried out on the basis of legitimate interests, and to direct marketing at any time.
• Withdraw consent — where we rely on consent, withdraw it at any time without affecting processing already carried out.

To exercise any of these rights, contact us using the details in section 11. We will respond within one month. There is no charge, unless a request is manifestly unfounded or excessive.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk, or by calling 0303 123 1113. We would appreciate the chance to address your concerns first.

9. Security

We use encryption in transit (HTTPS across the site and platform), access controls limiting who on our team can see personal data, and reputable infrastructure providers with their own security certifications. No system can be guaranteed completely secure, but we take reasonable and appropriate technical and organisational measures to protect your data, and we will notify you and the ICO of a personal data breach where we are legally required to do so.

10. Children

CourseSpaces is not directed at children under 16, and we do not knowingly collect personal data from them. If you believe a child has given us personal data, please contact us and we will delete it.

11. Contact Us

For any question about this policy or about your personal data:

• Email: support@coursespace.io
• Contact Form: Use the contact form on our website at coursespace.io#contact
• Business Address:
  Toolbox Labs, Office 18125
  182-184 High Street North
  East Ham
  London
  E6 2JA

12. Changes to This Policy

We may update this policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. If the changes are significant, we will tell you by email or with a notice on the site before they take effect.