Privacy & Data Protection Policy
Last updated: August 2026
CourseHub is operated by the African Digital Humanities Lab. This policy sets out what personal data the platform collects, why it is held, who it is shared with, how long it is kept, and how you exercise your rights over it.
1. What we collect
| Category | What it includes | Why we hold it |
|---|---|---|
| Account data | Name, email address, hashed password, role (learner or instructor), institution. | To run your account. Required — the platform cannot function without it. |
| Profile data | Photo, pronouns, headline, biography, research interests, DH methods, tools, languages, country and province, ORCID iD, and links you add. | Entirely optional, and supplied by you. Used to build your scholar profile page. |
| Learning data | Enrolments, lesson and video progress, quiz attempts and answers, worksheet and assignment submissions, notebook and code-lab work, certificates. | To teach the courses, mark work, track progress and issue certificates. |
| Community data | Connection requests, direct messages, study-room posts, lesson comments, reports you file about other people's messages. | To run the community features you choose to use, and to moderate them. |
| Technical data | Page-view records (path, timestamp, session key), server error reports, and IP addresses used transiently for rate limiting and abuse prevention. | To keep the service working, secure and diagnosable. |
2. What is public, and what is not
Nothing on your profile is public until you switch it on. The “Show me in the Community directory” setting is off by default. While it is off, your scholar page at your share link is visible only to you.
When you switch it on, these become visible to anyone with the link:
- Your name, photo, pronouns, headline, position and institution;
- Your biography, research interests, methods, tools, languages and what you are open to;
- Your country and province — but never your street address;
- Your education, appointments, publications, projects, certifications and links.
These never appear on a public page, whatever your settings: your email address, street address, quiz results, enrolments, referees, private messages, and any lesson reflections you write.
3. Legal bases
- Performance of a contract — account and learning data, without which we cannot deliver the courses you signed up for.
- Consent — your public profile, community participation, and optional notification email. Consent can be withdrawn at any time by changing the setting.
- Legitimate interests — security, abuse prevention, and aggregate usage statistics that keep the platform running and improving.
4. Who your data is shared with
We do not sell personal data, and we do not use it for advertising. A small number of processors act on our instructions:
- AI providers — messages you send to the Remi advisor and text submitted for AI feedback are sent to our language-model gateway for a response. Do not put sensitive personal information into these conversations.
- Storage providers — Cloudflare R2 and Cloudinary host uploaded images and course video.
- Email provider — used only for account email: password resets, approvals, and notifications you have opted into.
- Error monitoring — server error reports, which can include the URL and user id involved in a failure.
We disclose data to anyone else only where the law requires it.
5. How long it is kept
- Account, profile and learning data: for as long as your account exists.
- Page-view records: retained for platform statistics, but the link to your account is severed when you delete it, leaving rows that no longer identify anyone.
- Everything else attached to your account is deleted with it, immediately and permanently.
6. Your rights
You can exercise the two most important rights yourself, right now, without asking us:
- Access and portability — download a complete JSON export of everything held against your account.
- Correction — edit any profile field yourself at any time.
- Erasure — delete your account and its personal data permanently. This is immediate and cannot be undone.
- Restriction and objection — turn off your public profile, or write to us to object to a specific use.
- Unsubscribe — every email we send carries an unsubscribe link at the foot. Using it stops all CourseHub email to that address — announcements, digests, reminders and course notifications — and keeps working even if you later delete your account. Your account itself is unaffected and you can still sign in.
- Complaint — you may complain to your local data protection authority.
7. Security
Passwords are stored hashed and are never recoverable in plain text. Traffic is served over HTTPS. Access to the production database is restricted to the platform administrators. No system is perfectly secure; if a breach affects your data we will tell you.
8. Children
CourseHub is built for university-level and professional learners and is not intended for children under 16. If a child's account is brought to our attention we will delete it.
9. Contact
Questions about this policy, or a request you cannot complete yourself, can be sent through our contact form. We aim to respond within 30 days.