Privacy Policy

Important privacy information

To use the service we ask you to enter information about your learning preferences and your goals, your email address, and your name if you choose to give it. We also collect automatically from your browser and device: your IP address, your approximate location derived from it, your language settings, your time zone, your device and browser type, and the campaign parameters on the link you arrived through. We need this data to provide the service, to build the plan you asked for, to take payment, and — only where you have switched it on — to analyse how the service is used and to measure advertising.

For analytics and advertising measurement we use third-party solutions. Where those are switched on, some data is processed on the servers of Whop, Neon, Vercel, PostHog, Customer.io and Meta. Every one of them is named in section 5, with what it receives and why. We do not use any processor that is not on that list, and if the list changes this page changes with it.

Two things worth knowing before you read further. First, the analytics switch and the advertising switch have a default that depends on where you are: in the European Economic Area, the United Kingdom and Switzerland they start off and a banner asks before anything runs; everywhere else they start on, no banner is shown, and the Privacy choices control in the footer turns either of them off at any time. Section 6 explains how we tell. Second, if your browser sends a Global Privacy Control signal we treat that as your answer: both switches stay off, wherever you are, and we do not ask again.

Read the policy below to know what we do with data (section 3), what rights you have (section 7), who the controller is (section 1), and how to influence personalised advertising (section 6). If anything is still unclear, email support@lessonsinpractice.com.

Privacy Policy

Version 2.0.

This Privacy Policy explains what personal data is collected when you use the website at lessonsinpractice.com (the "Website"), and the course, account and services provided through it (together, the "Service"), and how that personal data is processed.

By using the Service you confirm that you have read and understood this Privacy Policy, and that you are over 18 years of age. If you are not, or you do not agree, please stop using the Service, email us and ask for your data to be deleted, and cancel any active subscription.

"GDPR" means Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data.

"EEA" means the member states of the European Union and the European Free Trade Association. For the purposes of this policy it also includes the United Kingdom.

"Process", in respect of personal data, includes to collect, store, use, and disclose to others.

Contents:

1. Personal data controller
2. Categories of personal data we collect
3. For what purposes we process your personal data
4. Under what legal bases we process your personal data
5. With whom we share your personal data
6. Cookies and similar technologies, your choices
7. How you can exercise your privacy rights
8. Age limitation
9. International data transfers
10. Automated decisions
11. Changes to this Privacy Policy
12. For California residents
13. Data retention
14. Contact us

1. Personal data controller

Jonathan, contactable at support@lessonsinpractice.com, is the controller of the personal data described on this page. If you want that data deleted, email us and we will do it — section 7 says how and how long it takes.

2. Categories of personal data we collect

We collect data you give us voluntarily, for example when you answer a quiz question or type in your email address. We also collect data automatically, for example your IP address. A small amount reaches us from third parties, and section 2.3 says exactly which.

We do not buy personal data, we do not enrich it from data brokers, and we do not scrape it from anywhere.

2.1. Data you give us

Your quiz answers. Every question you answer while going through the quiz. These are what your plan is built from, and they are the reason the plan differs between two people who answer differently.

Your email address, and your name if you give it. The name is optional; it appears on your certificate and on your plan if you provide one.

Your account and progress. Which lessons you have opened and completed, and your certificate if you earn one.

We do not ask for and do not want your card details, your government identification, your health, or anything else in the special categories that data protection law treats separately.

2.2. User-generated content

Some quiz screens have a free-text box, and you may write to our support address. What you type in those places reaches us and is stored with the rest of your record.

The exercises inside the lessons are different and it is worth being explicit about it: what you type into a lesson exercise never leaves your browser. There is no server round trip, no API call, and no third party involved. Whether you have completed an exercise before is remembered in your own browser's storage, and clearing that storage erases it for good, including for us — because we never had it.

2.3. Data provided by third parties

We do not offer social sign-in, so no social network passes us a profile.

Our payment provider tells us that a payment succeeded, renewed, failed, or was refunded, and passes us the email address used at checkout together with the amount, the currency, the date and the plan. It does not pass us your card number, and section 2.4.5 explains why we never see one.

Our advertising and analytics providers return measurement in aggregate — how many people who saw an advertisement went on to buy — rather than personal data about you.

2.4. Data we collect automatically

2.4.1. Data about how you found us

We record the referring page or application, and the campaign parameters and click identifiers on the link you followed: which advertisement, on which platform, and which creative angle it used. This is how we find out which advertisements are worth paying for. It is stored in a first-party cookie set by our own site, against a random identifier rather than against your name.

The advertisement's headline text is not stored. It is reduced to a short fingerprint, so we can still ask which headline a group of people saw without keeping the text itself.

2.4.2. Device and location data

Language settings, IP address, time zone, device and browser type, operating system, and the approximate location — country and region, not an address — that your IP address implies.

We are a website and not a mobile application, so there is no device advertising identifier, no hardware identifier and no mobile carrier in the list, and there is no precise or GPS location at any point.

2.4.3. Usage data

Which screens you were shown, which answers you picked, which buttons you clicked, how far through the quiz you got, which lessons you opened, and what you bought.

2.4.4. Advertising identifiers

Because this is a website, the identifiers are ours and the advertising platform's rather than your device's:

• a random identifier we generate for advertising measurement, so that a returning visitor is recognised as the same person rather than as a new one. It is not your name and it is not derived from anything about you. It exists only while your advertising switch is on, and turning that switch off deletes it immediately;
• the click identifiers the advertising platform attaches to the link you followed;
• a cryptographic hash of your email address, sent to the advertising platform so it can match a purchase to an advertisement. Only while your advertising switch is on. Section 3.8 describes this.

2.4.5. Transaction data

When you pay, your card details go to our payment provider and its own processors. We do not collect or store your card number and never see it. We receive the date, the amount, the currency, the plan, the payment method type, whether the payment renewed, and whether it was refunded.

2.4.6. Cookies and similar technologies

Every cookie we set is listed by name in section 6, with what it holds and how long it lasts.

3. For what purposes we process your personal data

3.1. To provide our Service

To run the Website, create and hold your account, keep you signed in, deliver the lessons, and fix errors and technical faults.

Our database is Neon, and the Website is hosted and served by Vercel. Both are named again in section 5 with what each receives.

3.2. To customise your experience

Your quiz answers produce your plan: which lessons you are shown, in what order, over how many days. This is the product rather than a side effect of it, and section 10 explains what it does and does not decide.

3.3. To manage your account

To sign you in — we send a link to your email address rather than using a password — and to send you service messages about your account, your payments, security, and changes to these documents.

3.4. To provide you with customer support

Support runs on ordinary email to support@lessonsinpractice.com. There is no third-party helpdesk product involved, so a support conversation is held by us and by our email provider and nobody else. What you write to us is stored with your record so that the next person to answer you has the history.

3.5. To deliver the lessons and their exercises

The lessons are text we wrote, served from our own site. The exercises inside them run entirely in your browser, as section 2.2 describes. No third party receives your lesson activity, your notes, or anything you type into an exercise.

3.6. To research and analyse your use of the Service, to improve it

To understand where people leave the quiz, which version of a screen performs better, and which lessons get read — and so to decide what to build, fix or drop.

Two different things happen here and they rest on different grounds.

Our own server records which screens were shown, against a short-lived random identifier with no name or email attached. That never leaves our systems, is not a thing we look people up by, and is our legitimate interest in knowing whether the business works. It is not covered by a switch, because it is not tracking.

Everything that goes to PostHog, our product analytics provider, is covered by the analytics switch in section 6, whose default depends on your region (section 6). We serve PostHog through our own domain, which means the requests go to us first; it does not mean the data stays with us.

3.7. To send you marketing communications

Only if you said yes. We ask separately, once, on its own screen, with two buttons of equal weight. If you say no, you do not get marketing and nothing else about your account changes. If you say yes, every marketing email carries an unsubscribe link that works immediately. We use Customer.io to send it.

To be plain about the thing that is easiest to blur: your email address is used to create your account whether or not you opt in to marketing, and it is used for marketing only if you opt in. The first is not a way of doing the second.

Service emails are not marketing and are described in section 3.3. You cannot unsubscribe from them while you have an active subscription, because one of them is the reminder we send three days before every charge and that is the one email it would be wrong of us to let you switch off.

3.8. To personalise and measure our advertising

Only while your advertising switch is on (its default depends on your region — section 6). While it is on, we tell Meta that a lead or a purchase happened and pass identifiers — including a cryptographic hash of your email address — so that it can match the event to an advertisement. We send this from our server as well as from your browser, and the two are de-duplicated against a shared event identifier. Meta may also use this to show you our advertisements, and to build audiences of people who behaved similarly.

While the switch is off, we send Meta nothing about you at all. Section 6 has the switches, and the general opt-outs that work across every site rather than just this one.

3.9. To process your payments

Whop is our payment provider and the merchant of record on every charge. It handles checkout, subscriptions, renewals, cancellations and refunds, and it authorises the charge against the payment method you gave it. It receives your email address and the details of your purchase. Card details go to Whop and its own processors and never reach us.

3.10. To enforce our Terms and to prevent and combat fraud

To enforce our Terms of Service, to detect and prevent fraudulent payments, chargeback abuse and account sharing, and to defend a legal claim. This can involve disclosing data to our payment provider or, where a dispute requires it, to law enforcement.

3.11. To comply with legal obligations

Where the law requires it — accounting and tax records, and a lawful request from a court or an authority.

We do not use a third-party consent management platform. The consent banner and the Privacy choices control are ours, served from our own site, and the record of what you chose is a single first-party cookie described in section 6.

3.12. To generate and issue certificates of completion

If you complete the course we generate a certificate carrying your name, if you gave one, and the date. We generate it ourselves; no third party is involved and none receives your name for this purpose. What that certificate is and is not worth is set out in our Disclaimers.

4. Under what legal bases we process your personal data

4.1. Your consent

Marketing emails, product analytics, and advertising measurement. You may withdraw any of these at any time — the unsubscribe link in any marketing email, or the Privacy choices control in the footer of this page — and withdrawing does not make what we did beforehand unlawful.

4.2. To perform our contract with you

Creating and running your account, building and delivering your plan and the lessons, taking payment, handling cancellations and refunds, sending you service messages, and answering your support requests.

4.3. Our legitimate interests, where they are not overridden by your rights

Measuring our own funnel on our own servers, against a short-lived random identifier with no name attached, because we need to know whether the business works. Enforcing our Terms, and preventing and addressing fraud and unauthorised use, because otherwise the price is paid by everyone who is not doing it. Keeping the Service secure and available.

4.4. Compliance with legal obligations

Tax and accounting records, and lawful requests from authorities.

5. With whom we share your personal data

Every company below actually processes data for us today. Nobody else does. If that list changes, this page changes.

5.1. Service providers

Whop — payments and merchant of record. Checkout, subscriptions, renewals, cancellations and refunds. Receives your email address and the details of your purchase. Card details go to Whop and its processors and never reach us.

Neon — our database. Stores everything described in section 2. Hosted in the region named in our infrastructure configuration.

Vercel — hosting. Serves the Website and processes the technical data any web server sees, including your IP address.

PostHog — product analytics. Receives the usage data in section 2.4.3 against a random identifier, and only while your analytics switch is on.

Customer.io — email. Receives your email address, your name if you gave it, the options you picked in the quiz, and your plan and progress — enough to send the right email at the right time and to stop sending you ones that do not apply to you. It receives the options you tapped and never anything you typed into a free-text box.

Meta — advertising. Receives conversion events and the identifiers in section 2.4.4, and only while your advertising switch is on.

We may also use an error-reporting service to record technical faults. If we do, it receives error diagnostics rather than the data in section 2, and we will name it here before it does.

5.2. Law enforcement agencies and other public authorities

We will disclose personal data where the law requires it, to respond to a lawful request from a court, a regulator or a law enforcement agency, and to establish or defend a legal claim.

5.3. Third parties as part of a merger or acquisition

If the business is sold, merged, or transferred, customer data is one of the assets that moves with it. You would be told before anything about the handling of your data changed.

5.4. What we do not do

We do not sell your personal data. We do not rent it. We do not share it with anyone for their own marketing. There are no resellers, affiliates or agents in this arrangement: the list in section 5.1 is the whole list.

6. Cookies and similar technologies, your choices

Cookies are small text files placed on your device while you browse. We also use your browser's local storage for the same purposes, and where we do, the entry is listed here alongside the cookie it belongs with.

We use a small number, and they fall into three groups.

Strictly necessary

These make the site work, and they have no switch. If you block them, parts of the site will not function.

lc_run, 7 days, first-party. Which version of the quiz you are part-way through, and a random identifier for that run. It is what lets us connect a purchase back to the screens that produced it. It holds no name and no email.

lc_consent, 1 year, first-party. The two choices below. This one is necessary and has no switch of its own, because it is the record of what you chose: if declining set no cookie, we would have no way to remember that you declined and would ask again on every page. A reader who turns everything off and then sees a cookie appear deserves to know it is this one.

A session cookie holding your sign-in token, first-party. Set when you sign in, cleared when you sign out. It is not tracking.

Advertising measurement

Set only while the advertising switch is on. See "Your cookie choices" below for what it is set to before you have said anything.

lc_attr, 30 days, first-party. Which advertisement brought you here: the campaign parameters and click identifiers on the link you followed, and which angle it was. It records your first visit and your most recent one.

lc_xid, 2 years, first-party, plus a copy in your browser's local storage. A random identifier for advertising measurement, so a returning visitor is recognised as the same person rather than as a new one. It is not your name and it is not derived from anything about you. It is not created while the advertising switch is off, and turning advertising measurement off deletes it — from the cookie and from the local storage copy, both at once, straight away.

Cookies set by Meta, including _fbp and, where you arrived from a Meta advertisement, _fbc. These are set by Meta's own script, which we do not load at all until your advertising switch is on.

Analytics

Set only while the analytics switch is on. See "Your cookie choices" below for what it is set to before you have said anything.

Cookies set by PostHog, named in the form ph_…_posthog, holding a random identifier and session state. Served through our own domain. Not set until your analytics switch is on; when you turn the switch off, PostHog is reconfigured to hold nothing beyond the current page.

Your cookie choices

We treat product analytics and advertising as two separate switches, and they work independently. Turning off advertising does not turn off analytics, and turning off analytics does not leave you in the advertising one.

What the switches are set to before you have said anything depends on where you are. Where the law requires your permission first — the European Economic Area, the United Kingdom and Switzerland — both switches start off, and on your first visit a banner asks. You can allow both, allow neither, or open the choices and set them one at a time. Your answer is stored in lc_consent so that we do not ask again. Everywhere else both switches start on, no banner is shown, and the Privacy choices control described below is how you turn either of them off; that choice is stored in the same cookie and kept.

We tell the two regions apart from the time zone your browser reports, which is the only signal we have — this site is not behind a service that tells us your country. The rule is written to err on the side of asking: every European time zone gets the banner, including ones outside the European Economic Area. If your browser sends a Global Privacy Control signal, both switches are off wherever you are and the banner does not appear.

To change either switch at any time, use the Privacy choices control in the footer of this page. Changes take effect immediately, without a reload.

You can also clear our cookies, which resets both switches, or email support@lessonsinpractice.com and we will suppress your data. Clearing cookies will sign you out.

Most browsers also let you manage and clear cookies yourself, usually under a Preferences, Settings or Privacy menu, and offer a private browsing mode that discards them at the end of the session.

Global Privacy Control, and Do Not Track

If your browser sends a Global Privacy Control signal, that is your answer. Both switches stay off and you are not asked, because asking someone who has already told us is nagging rather than diligence.

You can still turn either switch on yourself from the Privacy choices control if you want to — a choice you make here is more specific and more recent than a browser-wide setting, so it takes precedence over it.

A "Do Not Track" header is treated the same way as Global Privacy Control by our site. We would rather honour an ambiguous signal than argue about it.

Opting out of personalised advertising more generally

Beyond the advertising switch on this site, you can opt out of personalised advertising across many sites at once through the industry programmes run by the Digital Advertising Alliance, the European Interactive Digital Advertising Alliance and the Network Advertising Initiative, and through the ad settings of the platform itself — for us, that means Meta's own ad preferences.

Two things worth knowing about those. If you opt out of personalised advertising you will still see advertisements; they simply will not be tailored. And clearing your browser cookies can remove the opt-out preferences you set, so you may need to set them again.

One thing that is not a choice, because it is not tracking

Our own server records which screens were shown, against a short-lived random identifier, with no name or email attached. It never leaves our systems and it is how the funnel stays countable for someone who has switched everything else off.

7. How you can exercise your privacy rights

You have the right to:

Access, review, update and correct the personal data we hold about you.

Delete it. You can ask us to erase your personal data, as far as the law permits. Deleting your account deletes your quiz answers, your progress, your certificate and your marketing subscription. It does not delete the records of your purchases and refunds, because we are required to keep those — section 12 says for how long.

Object to or restrict what we do with it, in whole or in part.

Withdraw a consent, at any time, by the routes in section 6. Withdrawing does not make what we did beforehand unlawful.

If you are in the EEA

The right to lodge a complaint with a supervisory authority. We would much rather you told us first so that we can fix it, but you are entitled to complain to the data protection authority in the country where you live or work, or where you think the problem happened, without speaking to us at all.

The right to data portability. If you want your personal data in a machine-readable format, ask and we will send it.

How to ask

Email support@lessonsinpractice.com from the address on your account. We will reply within 30 days, we will not charge you, and we will not ask why.

8. Age limitation

The Service is for adults. We do not knowingly process personal data from anyone under 18 years of age. If you believe a child has given us data, email us and we will delete it.

9. International data transfers

Several of the companies named in section 5 are based in the United States, and our analytics provider is hosted there. Where your personal data leaves the country you live in, it is transferred under the safeguards that apply to that transfer — in particular the Standard Contractual Clauses approved by the European Commission, or an adequacy decision where one covers the destination.

10. Automated decisions

Your quiz answers decide which lessons you are shown, in what order, over how many days. That is automated, and it is the product. It has no legal effect on you and it does not affect your price.

The plans, their prices and the checkout timer are the same for everyone. The price you see does change while you are on the checkout page — the timer starts when you first reach it, and when it runs out the price goes up to the one printed beside it. That depends on the clock and on nothing about you. We do not price by who you are, what you answered, where you are, or what device you arrived on.

11. Changes to this Privacy Policy

We will change this page when what we do changes. If a change is significant we will tell you by email and you will have the chance to read the new version before it takes effect. The date at the top of the page is the date of the last change, and continuing to use the Service after a change means you accept it.

12. For California residents

California's "Shine the Light" law lets California residents ask, once a year, what personal information a business has shared with third parties for those third parties' own direct marketing purposes. Our answer is none: we do not share personal data with anyone for their own marketing. To ask us formally, email support@lessonsinpractice.com with "Request for California Shine the Light Privacy Information" in the subject line and your state of residence in the body, and we will reply to that address.

We do not sell personal information, and we do not accept money for sharing it. Sending conversion events to an advertising platform can amount to "sharing" for cross-context behavioural advertising under California law, so we treat it that way: that is the advertising switch in section 6, the Privacy choices control turns it off in one click, and a Global Privacy Control signal turns it off without your having to ask. That is the opt-out, and it is the same one every visitor gets regardless of where they live.

California residents also have the rights in section 7 — to know, to delete, to correct, and not to be discriminated against for exercising any of them. We do not offer a different price or a worse service to anyone who does.

13. Data retention

Your account and course data — while your account exists, and then deleted.

Quiz answers where you did not create an account — 12 months, then deleted. They are useful for improving the quiz and stop being useful after that.

Records of purchases, refunds and tax — as long as accounting and tax law requires us to keep them, which is longer than the rest and is not something we can shorten on request.

Usage analytics — retained in aggregate. Individual event rows are kept for as long as they are useful for analysis and are not what we look people up by.

Marketing contact data — until you unsubscribe or ask for deletion.

14. Contact us

For anything about this Privacy Policy, about your account, or about your personal data, email support@lessonsinpractice.com, or write to Jonathan at the registered address on our site. A person will answer.