Privacy Policy
This policy explains what personal data B-Accuracy LMS collects, why we collect it, who we share it with, and the rights you have over it.
Effective October 18, 2026
Two roles, two policies. When you sign up for an account with us directly, we are the data controller and this policy applies. When you are a learner using a training academy run by one of our customers, that organisation is the controller and we act as their processor — their own privacy policy governs, and our obligations to them are set out in our Data Processing Addendum.
1. Who we are
B-Accuracy LMS is a service operated by B-ACCURACY INFOTECH, whose registered office is at #26, Ethiraj Salai, "Fagun Chambers", Office No. 6, 3rd Floor, Egmore, Chennai - 600 008, Tamil Nadu, India (email: info@baccuracy.com, phone: +91-9600039197, +91-44-28211811). For any privacy question, request or complaint, contact info@baccuracy.com.
2. What we collect
We collect only what the platform needs to function. We do not buy personal data from third parties, and we do not build advertising profiles.
| Category | What it includes |
|---|---|
| Account identity | Email address, password (stored only as a bcrypt hash — never in plain text), first and last name, avatar URL, phone number, biography, timezone, and language preference. |
| Authentication and session | Email verification status and timestamp, last login time, account status, and the access/refresh tokens described under Cookies below. |
| Learning activity | Course enrollments, lesson and module progress, quiz attempts and answers, assignment submissions, SCORM tracking data (CMI records), certificates issued, learning path progress, and batch membership. |
| Engagement | Forum topics and replies, upvotes, personal course notes, experience points, activity streaks, leaderboard position, and in-app notifications. |
| Organisational | Role, department and group membership, manager relationships, and any custom profile fields the Customer defines. |
| Administrative and audit | Audit log records of administrative actions and impersonation sessions, API key usage metadata, and webhook delivery logs. |
| Billing | Plan and subscription status and invoice history. Card, UPI or bank details are handled directly between you and us (invoice, bank transfer or UPI) — an automated payment processor is not yet part of this flow. |
| Live demo | If you try the no-signup live demo: a temporary demo workspace and the activity inside it, deleted automatically shortly after its 30 minutes end. If you choose to leave your email during the demo: that email, whether you opted in to product updates, and where in the demo you left it. We also count which demo steps are used, linked only to a random ID in your browser, not to your name or email. |
We also record standard technical information when you use the Service — IP address, browser type, and request timestamps — for security, abuse prevention and diagnostics.
Data we deliberately do not hold
- Your password. Only a bcrypt hash is stored. We cannot read, recover or tell you your password.
- Your payment card. We do not collect or store card, UPI or bank details ourselves, and no automated payment processor is part of the billing flow today — plan billing is arranged directly between you and us (invoice, bank transfer or UPI).
- Your AI provider keys, in readable form. If you connect your own Anthropic, OpenAI, Google or Azure OpenAI account, the key is encrypted at rest with AES-256-GCM and used only to serve your own tenant’s requests.
3. Why we use it, and our lawful basis
| Purpose | Lawful basis (UK/EU GDPR) |
|---|---|
| Providing the Service — accounts, courses, progress, certificates | Performance of a contract |
| Billing, invoicing and collecting payment | Performance of a contract |
| Transactional email — verification, invitations, notifications | Performance of a contract |
| Drafting a first course with the optional AI assistant, when an admin chooses to use it | Performance of a contract (a feature the admin asks for) |
| Security, fraud prevention, audit logging | Legitimate interests |
| Diagnosing errors and improving reliability | Legitimate interests |
| Marketing email to account holders about the product | Consent, withdrawable at any time |
| Following up when you leave your email in the live demo | Consent — you choose to give it; product updates only if you tick the box |
| Meeting tax, accounting and legal obligations | Legal obligation |
4. Who we share it with
We do not sell personal data. We share it only with the service providers below, each of which is bound by a written agreement to process data only on our instructions.
| Provider | Purpose | Data handled |
|---|---|---|
| Cloud infrastructure hosting | Application and database hosting | All Customer Data stored by the Service |
| Content delivery and domain infrastructure | CDN, DNS, TLS certificate provisioning for custom domains, file and video storage and streaming, and off-server database backups | IP addresses, request metadata, uploaded files and video content, database backups |
| Cloudflare Email Service | Transactional email delivery (verification, invitations, notifications, scheduled reports) | Email address, name, message content |
| Video hosting and streaming (optional) | Video storage and streaming for a small number of older accounts set up before the default above | Video content, viewer IP addresses |
| Anthropic, PBC (Claude API) | Optional AI course drafting assistant: turns what an organisation admin types about their class into a draft course outline | Only the class description and answers typed into the assistant, and the generated draft. We do not send account details (names, email addresses) or any learner records |
We name our email provider above because you already see it directly — an email from our sending domain — and our AI provider because it receives what you type into the AI assistant, so you should know exactly who that is (see below). The infrastructure categories are described rather than branded because which specific cloud host, CDN or video provider we use can change without changing what we do with your data, and we’d rather this page stay accurate than list a name we might swap out next quarter. We’re not withholding it: write to info@baccuracy.com and we’ll tell you exactly who they are. (No payment processor is listed above because none is live yet — see “Your payment card” above.)
The AI course drafting assistant
When a new organisation sets up its account, an admin can describe their class and our AI assistant drafts a first course for them to edit. Using it is optional — you can skip it and build the course yourself.
- What is sent: only what you type into the assistant (your description of the class and your answers to its questions). We do not send your name, email address or any learner’s data. Please don’t type other people’s personal or sensitive information into it.
- Who processes it: Anthropic, PBC, through its Claude API, in the United States, under a written agreement and on our instructions.
- No training: under Anthropic’s commercial terms, content sent through its API is not used to train its models.
- How long Anthropic keeps it: Anthropic deletes API inputs and outputs within 30 days by default, keeping them longer only where needed to enforce its usage policy or comply with the law.
- What we keep: the conversation and the draft are stored in your organisation’s account, together with a usage record (amount of AI used and its cost) that enforces your plan’s AI allowance. They are deleted with your account data, as described in section 6.
- Human review: the result is only a draft. AI can make mistakes, so nothing it writes is shown to learners until an admin reviews it and publishes the course.
We may also disclose data where legally required, or to establish or defend legal claims. If the business is ever sold or merged, data may transfer as part of that transaction — we will give notice before it takes effect.
5. International transfers
Some providers above operate outside the UK and EEA — including our AI provider in the United States, which receives only what you type into the AI assistant. Where personal data is transferred internationally, we rely on the European Commission’s Standard Contractual Clauses or an applicable adequacy decision, together with technical safeguards including encryption in transit and at rest.
6. How long we keep it
This is two different things depending on how an account ends, and we keep them distinct rather than quoting one number for both:
- Active accounts: for as long as the account exists.
- Using the self-service delete tool: deleting your own data from your account privacy settings removes or anonymises it in our live systems immediately — this is a direct action you take, not a request we queue.
- When an organisation’s subscription ends without anyone using the delete tool first: the organisation has 30 days to export its data, then we delete or irreversibly anonymise what remains within a further 30 days. This is the same process our Data Processing Addendum describes for Customer Data in more detail.
- Live demo: the demo workspace is deleted automatically shortly after its 30 minutes end. An email you choose to leave during the demo is kept only as long as we need it to follow up with you about the Service, and deleted sooner if you ask.
- AI assistant: the conversation, draft and usage record are kept with your organisation’s account data and deleted with it. Our AI provider deletes what it received within 30 days by default (see section 4).
- Billing and tax records: retained for the period required by applicable tax law, typically six to seven years.
- Audit logs: retained for security and accountability, then purged on a rolling schedule.
- Backups: deleted data may persist in our daily database backups for a limited period until those backups rotate out, regardless of which path above removed it.
7. Your rights
Depending on where you live, you may have the right to access, correct, delete, port, restrict or object to the processing of your personal data, and to withdraw consent.
You can exercise the two most important rights yourself, immediately. The platform includes built-in data export and permanent deletion — you do not need to raise a support ticket or wait for us. Find them under your account privacy settings.
For anything else, email info@baccuracy.com. We respond within 30 days. If you are a learner on an academy operated by one of our customers, direct your request to that organisation — we will forward it if it reaches us first.
If you believe we have handled your data improperly you may complain to your local data protection authority. We would appreciate the chance to resolve it first.
8. Cookies
We use a deliberately small number of cookies. We do not use advertising or cross-site tracking cookies, which is why you will not see a consent banner asking you to accept them.
| Cookie | Purpose | Retention | Type |
|---|---|---|---|
| Access token | Authenticates your session | 24 hours | Strictly necessary |
| Refresh token | Issues a new access token without re-entering your password | 7 days | Strictly necessary |
| Theme preference | Remembers light or dark mode | Until cleared | Functional |
Authentication cookies are set with HttpOnly, SameSite=Lax and, in production, the Secure flag. Blocking them will prevent you from signing in.
9. Security
Measures we apply include:
- Tenant isolation enforced at the database layer: every query is automatically scoped to the requesting tenant by the database itself, a rule enforced structurally rather than something our application code has to get right every single time.
- Encryption in transit via TLS. Uploaded files, videos and our off-server database backups are stored encrypted at rest, and connected AI provider keys are additionally encrypted with AES-256-GCM.
- Passwords stored only as bcrypt hashes.
- Role-based access control, with administrative actions written to an audit log.
- Scoped API keys that can be rotated or revoked immediately.
No system is perfectly secure, and we do not claim otherwise. If we become aware of a personal data breach affecting you, we will notify you and the relevant supervisory authority as required by law.
10. Children
The Service is not directed at children under 16 and we do not knowingly collect their data directly. Where a customer uses the platform to train under-16s, that organisation is responsible for obtaining any consent required by local law.
11. Changes to this policy
We will update this page when our practices change and revise the effective date above. For material changes affecting account holders, we will give notice by email before the change takes effect.