Privacy Policy — courses.instilligent.com

Last updated: 2026-07-21 Effective: 2026-07-21

---

1. Who We Are

This Privacy Policy applies to the courses storefront at courses.instilligent.com and to purchases of digital courses ("Courses") sold through it.

• Company name: Instilligent Limited
• NZBN: 9429041896853
• Registered office: Auckland, New Zealand
• Privacy contact: [email protected]
• Operational / support contact: [email protected]

Instilligent Limited is the Privacy Act agency responsible for the personal information described in this policy. We are a New Zealand company registered under the Companies Act 1993.

This document is the courses-storefront-specific privacy policy. It is a narrowed and re-scoped version of the parent Instilligent Limited Privacy Policy published at instilligent.com/pages/privacy. Where the parent policy and this document overlap, the more specific terms in this document apply to your use of courses.instilligent.com. For our other products (Modular Compliance, BossBoard, CodeHumanist, ProofOnce) the relevant product-specific notice or the parent policy applies.

2. What This Policy Covers

This policy describes how we collect, use, store, share, and protect personal information in connection with:

• The storefront at courses.instilligent.com, where you browse and purchase Courses.
• The Course delivery platform (currently EzyCourse), a third-party learning-management system where your purchased Course content is delivered, your account is hosted, and your progress is tracked.
• The payment flow (Stripe), through which Course purchases are processed.
• Customer support by email at [email protected].
• Privacy contact by email at [email protected].

This policy does not cover:

• The certifying bodies, vendors, or examination programmes that a Course may help you prepare for. Their privacy practices are their own — see the relevant body's privacy policy.
• Third-party sites we link to from inside Course content. We do not control those sites.
• Other Instilligent Limited products (see §1).

This policy works alongside the Terms and Conditions (T&Cs), Refund Policy, and Product Disclaimer that are separately published on the storefront.

3. What Personal Information We Collect

We collect only what we need to sell, deliver, and support the Courses you buy. The categories of personal information involved are:

3.1 Account information

• Name (where you choose to give it).
• Email address (required — Course delivery is by email-keyed account).
• Account credentials (handled by EzyCourse, not stored by us in plaintext).

3.2 Purchase information

• The Course(s) you bought.
• Date and amount of purchase.
• Country of purchase (where Stripe surfaces it).
• A Stripe payment-token reference and the last four digits of the payment card, plus the card brand — for receipts, refund processing, and chargeback investigation. We do not store full card numbers; full card details are handled by Stripe under their PCI-DSS obligations.
• GST-status and any business-buyer affirmation made at checkout (see T&Cs §12 and Refund §6).

3.3 Course progress and study activity

• Lessons viewed, practice questions answered or revealed, downloads completed, completion status, and time-stamps for the above — held inside EzyCourse and read back from EzyCourse where needed for support, refund-eligibility assessment (see Refund §3), or aggregated improvement analysis (see §5).

3.4 Support correspondence

• Emails you send to [email protected] or [email protected], including the content of the message, your email address, any attachments you send, and any reply thread.

3.5 Technical information collected automatically

• IP address (used for fraud-screening at checkout, abuse detection, and approximate geographic location for currency / consumer-law applicability).
• Browser type, operating system, device type.
• Referring URL and the path you took through the storefront.
• Error logs and performance metrics.

3.6 Cookies and similar tracking

• The storefront may use cookies and similar technologies for session, security, and analytics purposes. See §10 for detail; specific cookies depend on the storefront's current operational state and will be listed in §10 once confirmed.

We do not intentionally collect special-category or sensitive information (such as health information, biometric data, or information about ethnicity, religion, or political views) through the storefront or the Course flow. If you send sensitive information to us in support correspondence we treat it with the same care described in §3.4 and §11.

We also ask, in the Product Disclaimer §2, that you do not send us confidential examination content that you may be bound to keep confidential under a third-party exam-taker NDA. If you do send it, we will not retain it or use it.

4. How We Collect It

We collect personal information in the following ways:

• You give it to us directly when you browse the storefront, create an account, complete the Stripe checkout, register on EzyCourse, or contact [email protected] or [email protected].
• EzyCourse collects it on our behalf when you set up your learning-platform account, work through Course material, take practice exams, or download Course assets. We receive this data from EzyCourse so we can support you, assess refund eligibility, and improve the Courses.
• Stripe collects payment information when you check out. We receive a token, the last four digits of the card, the card brand, and the result of the charge — we do not see your full card details.
• Our infrastructure collects technical information automatically when you load the storefront — IP address, request metadata, browser type, etc. (see §3.5).
• Third parties give us limited information, principally Stripe (payment confirmation, dispute / chargeback notifications) and where applicable our email-deliverability and infrastructure providers (delivery, bounce, and security signals).

5. How We Use Your Information

We use your personal information for the following purposes, consistent with Information Privacy Principles 1, 2, 3, and 10 of the New Zealand Privacy Act 2020:

5.1 To deliver the Courses you bought

• Process your Stripe payment and issue a receipt.
• Provision your account on EzyCourse.
• Grant access to the Course material you have purchased.
• Notify you of important Course-related events (access activation, material updates, withdrawal — see T&Cs §6).

5.2 To support you

• Respond to questions, refund requests, and complaints you send to [email protected] or [email protected].
• Assess refund eligibility against the conditions in the Refund Policy (including the 14-day money-back window and any statutory rights under Refund §6).
• Investigate fraud, abuse, and chargebacks (see Refund §9 and T&Cs §13A).

5.3 To improve the Courses

• Analyse Course-progress data in aggregate to identify content that is unclear, broken, frequently abandoned, or commonly wrong on practice questions.
• Review support correspondence in aggregate to spot recurring issues.

5.4 To meet our legal obligations

• Tax and financial-records retention (Inland Revenue Department requirements).
• Compliance with the Privacy Act 2020, the Fair Trading Act 1986, the Consumer Guarantees Act 1993, and Stripe's merchant requirements.
• Responding to lawful requests from regulators, courts, or law enforcement.

5.5 To run a small amount of cross-promotion

• See §13. We may, where commercially relevant, surface other Instilligent Limited products to course buyers and use limited matching between course-buyer email and Instilligent SaaS Stripe records for attribution. §13 describes this in full and gives you an opt-out.

We do not use Course-buyer data for broad-market direct-marketing campaigns that are unrelated to either the Courses you bought or the Instilligent Limited product family.

6. Who We Share It With

We share personal information only with the third-party providers we need to run the storefront, deliver the Courses, take payment, and support you. We do not sell personal information.

Provider	Purpose	Data shared	Jurisdiction	Their privacy policy
Stripe, Inc.	Payment processing, fraud screening, chargeback handling	Name (if given), email, card details (held by Stripe, not us), purchase amount, currency, IP, billing country	United States	stripe.com/privacy
EzyCourse	Course delivery, account hosting, progress tracking, in-platform messaging	Name, email, account credentials, Course progress, downloads	United States (AWS US-East per EzyCourse documentation)	ezycourse.com/privacy-policy
Microsoft Corporation (Microsoft 365)	Inbound email for [email protected] and [email protected]; reply-thread storage	Your email address, message content, attachments	United States (with regional sub-processing)	privacy.microsoft.com
Cloudflare, Inc.	CDN, DNS, edge security in front of courses.instilligent.com	IP address, request metadata, security signals	United States (global edge)	cloudflare.com/privacypolicy
Chatbase, Inc.	AI chat widget embedded on the storefront (embed.min.js) — handles in-page customer questions	Chat message content you type, IP address, browser fingerprint, page URL	United States	chatbase.co/legal/privacy-policy

In addition:

• Our other Instilligent Limited products (Modular Compliance, BossBoard, CodeHumanist, ProofOnce) — only in the limited circumstance described in §13 (funnel attribution), and only if you have not opted out.
• Professional advisers (lawyers, accountants, auditors) — bound by their own professional confidentiality obligations.
• Regulators, courts, and law enforcement — only where required by law, or where we believe in good faith that disclosure is necessary to protect rights, safety, or property.
• A successor entity — if Instilligent Limited is sold, merged, or restructured, personal information held by the courses-storefront business may transfer as part of that transaction, subject to the receiving entity providing equivalent protection.

We do not share Course-buyer data with advertising networks, data brokers, or third-party marketing platforms for their own purposes.

7. International Data Transfers (IPP 12)

Under Information Privacy Principle 12 of the New Zealand Privacy Act 2020, we are required to be transparent when personal information is sent overseas and to take reasonable steps to ensure the overseas recipient is subject to privacy obligations comparable to those of the New Zealand Privacy Act.

Personal information collected through courses.instilligent.com is processed outside New Zealand. The principal offshore processing locations are:

• Stripe (United States) — payment processing.
• EzyCourse (United States — AWS US-East per EzyCourse documentation) — Course delivery and progress tracking.
• Microsoft 365 (United States, with regional sub-processing) — inbound and outbound email for support@ and privacy@.
• Cloudflare (global edge, US-headquartered) — DNS, CDN, edge security.
• Chatbase (United States) — in-page AI chat widget; only when you initiate a chat conversation on the storefront.

For each provider we take reasonable steps to confirm they are subject to privacy obligations comparable to the NZ Privacy Act 2020, including by:

• Selecting providers based in jurisdictions with established privacy frameworks (the United States under applicable Federal and State laws and, where the provider supports them, contractual standard data-protection clauses).
• Reviewing each provider's published privacy policy and security posture before adoption.
• Entering into data-processing agreements with providers that offer one (Stripe and Microsoft do).

If you would like more information about the safeguards we have in place for offshore transfers, contact [email protected].

8. How Long We Keep It

We keep personal information only for as long as we need it, or as long as the law requires. The retention picture for course-storefront data is:

• Course-purchase records (Stripe receipts, our own transaction ledger) — 7 years from the date of transaction, to meet New Zealand tax and financial-records requirements.
• EzyCourse account + Course progress data — for the duration of your EzyCourse account, plus a reasonable closure-grace period for support and dispute resolution. If you ask us to delete your EzyCourse account, we will pass that request to EzyCourse; please note EzyCourse may retain some data under its own retention policy.
• Support correspondence ([email protected]) — generally up to 3 years from the last contact, to maintain context across follow-up enquiries and to support fraud and chargeback investigation.
• Privacy correspondence ([email protected]) — generally up to 3 years from resolution, to demonstrate Privacy Act 2020 compliance.
• Web-server access logs and error logs — generally up to 90 days, longer where retained for security incident investigation.
• Aggregated and de-identified analytics — may be retained indefinitely because it can no longer be associated with any identifiable individual.

When personal information is no longer required, we take reasonable steps to destroy or de-identify it in a secure manner (Information Privacy Principle 9).

These periods are best-effort operational targets and may be shortened on your request where we are not required to retain the information by law.

9. Your Rights Under the Privacy Act 2020

You have the following rights in relation to personal information we hold about you:

9.1 Access (IPP 6)

You may request a copy of the personal information we hold about you. We will respond within 20 working days. We may charge a reasonable fee in limited circumstances (for example, very large or repeated requests).

9.2 Correction (IPP 7)

If you believe information we hold about you is inaccurate, incomplete, misleading, or out of date, you may ask us to correct it. We will respond within 20 working days and either make the correction or, if we decline, explain why and attach a statement of your view to the record.

9.3 Deletion

You may ask us to delete personal information we hold about you. We will comply unless we are required to retain it (for example, transaction records under the 7-year tax retention rule in §8, or records reasonably needed to defend a current dispute). Some data is held by EzyCourse on our behalf — we will pass your deletion request to EzyCourse and let you know the outcome.

9.4 Opt-out of Cross-Promotion

You may opt out of the §13 cross-promotion and funnel-attribution matching at any time. See §13 for the opt-out mechanism.

9.5 Complaints

If you believe we have breached the Privacy Act 2020 you may:

• Contact us directly at [email protected]. We aim to acknowledge complaints within 5 working days and to substantively respond within 20 working days.
• If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner (privacy.org.nz).

To exercise any of these rights, contact [email protected]. We may need to verify your identity before acting on a request, particularly for access and deletion.

10. Cookies and Tracking on the Storefront

The following cookies and similar technologies are in use on courses.instilligent.com at the date of this policy. We will update this section when the inventory changes.

Cookie / token	Set by	Purpose	Duration
`NEXT_LOCALE_V2`	Storefront (Next.js framework)	Remembers your language/locale preference	1 year
EzyCourse session cookies	EzyCourse (after login)	Maintain your authenticated session, prevent cross-site request forgery, route requests to the right tenant	Session (cleared on logout)
Cloudflare security cookies (e.g. `__cf_bm`)	Cloudflare	Bot detection, DDoS protection, edge security in front of the storefront	Up to 30 minutes
Chatbase tokens	Chatbase (only if you start a chat)	Maintain your conversation context during a chat session	Session
Stripe checkout cookies	Stripe (during the Stripe-hosted checkout flow only)	Payment session, fraud prevention	Per Stripe; see their privacy policy

The storefront does not currently set Google Analytics, GTM, Facebook Pixel, advertising-network, or other behavioural-tracking cookies pre-login. The parent Instilligent corporate site (instilligent.com) uses Google Analytics 4 with a Klaro consent UI; equivalent analytics may be added to the courses storefront in future, in which case this section will be updated and (where required) consent will be sought via a banner.

You can control cookies through your browser settings (block, delete, or be notified). Disabling strictly-necessary cookies will break the checkout and login. If a consent banner is shown on the storefront, your choices in that banner override the defaults described above.

11. Children and Age

Our Courses are designed for adults and business users. Consistent with T&Cs §3, you must be at least 18 years old to purchase or use a Course (or have the consent of a parent or legal guardian who agrees to the T&Cs on your behalf).

We do not knowingly collect personal information from children under 13. If you become aware that a child has provided us with personal information through courses.instilligent.com without parental consent, please contact [email protected] and we will delete that information promptly.

The Courses do not include games, advertising-funded content, or features specifically designed to appeal to children.

12. AI-Assisted Services and AI Training

Course material is produced using an automated AI pipeline operated by Instilligent Limited, as described in Product Disclaimer §6. This raises two distinct AI-related privacy considerations that we address here directly:

12.1 We do not use your personal information to train external AI models

Personal information you give us — your name, email, support correspondence, Course progress, payment details — is not used to train, fine-tune, or evaluate any third-party machine-learning or artificial-intelligence model. We use AI tooling to produce Course content, not to train AI on you.

Where we use AI-assisted internal tooling (for example, to triage support email or to summarise a complaint thread for our own analysis), any third-party AI provider we use is bound to not retain or train on the content we send for that purpose. We select providers on this basis. We do not currently route customer support correspondence through any AI provider that retains content for training.

12.2 You may not use our Course content to train AI models

This is a contractual prohibition set out in T&Cs §7 and reinforced in Product Disclaimer §6 — see those documents for the substantive restriction and remedies. We mention it here only so you can see how the AI boundary works in both directions (you don't train on us; we don't train on you).

12.3 Statistical and aggregated improvement

Aggregated, de-identified Course-progress data and aggregated support-correspondence themes may be used to improve future Course material — including via internal AI-assisted analysis. This use does not identify you individually.

13. Cross-Promotion With Other Instilligent SaaS

Instilligent Limited operates several other software products in addition to the Courses sold through this storefront, currently including Modular Compliance, BossBoard, and Mastering Moss. Some Courses are designed to introduce concepts that those other products help with, and may include calls-to-action inviting you to try them. This relationship is also disclosed in Product Disclaimer §11.

13.1 Two distinct activities — different consent rules

The cross-promotion has two parts, and each is governed by a different consent rule:

(a) Email-to-email attribution matching — under Information Privacy Principle 10 of the NZ Privacy Act 2020 (use of information for a directly related purpose), we may match the email address you used to buy a Course against the email address on Instilligent SaaS Stripe customer records, to attribute SaaS trial signups and paid conversions to a preceding Course purchase. The match is email-to-email only; we do not import wider personal information from one product into another. This is performed by Instilligent Limited on its own records — no third party sees a combined dataset.

(b) Outbound cross-promotion email — sending you a promotional email about another Instilligent product (e.g. "you bought the BossBoard prep course — try BossBoard free for 30 days") is a commercial electronic message under the Unsolicited Electronic Messages Act 2007 ("UEMA"). UEMA requires express or inferred consent before any such message is sent. Purchasing a Course does not by itself give us inferred consent to email you about unrelated SaaS products.

13.2 You opt IN; we do not opt you in by default

Because of (b) above, we do not send cross-promotion emails unless you have explicitly opted in.

Current practice (as of the Effective date): the checkout opt-in control is not yet live. Until it is, we do not send any cross-promotion email about other Instilligent products. You will only receive transactional emails about Courses you have bought (receipts, access, course-update notices required by T&Cs §6) and replies to support correspondence you have initiated.

When the opt-in control ships, it will be offered:

• At checkout, as an optional tickbox: *"I'd like to occasionally hear about other Instilligent products that build on what this Course teaches."*
• In your account settings on the storefront, where you can opt in or opt out at any time.

Purchasing a Course alone never opts you in. If you have not explicitly opted in, you will not receive cross-promotion email.

13.3 You can opt out at any time

Even after opting in, you may opt out at any time. Either:

• Click the unsubscribe link in any cross-promotion email; or
• Email [email protected] with subject line "opt out of cross-promotion" — we will remove your email address from the cross-promotion send list immediately and from cross-promotion attribution matching within 10 working days.

Opting out of cross-promotion does not affect transactional emails about Courses you have bought, replies to support or privacy correspondence you have initiated, or your access to any Course you have already purchased.

13.4 In-product cross-promotion is always available

In-Course recommendations of other Instilligent products (banner messages inside the Course, post-purchase pages on the storefront, calls-to-action embedded in the Course content itself) are not "commercial electronic messages" under UEMA — they are part of the Course product you have purchased and are governed by the Product Disclaimer §11 (commercial-relationship disclosure). These in-product surfaces are shown to all Course buyers regardless of opt-in status, but you can ignore them with no impact on your Course access.

14. Changes to This Policy

We may update this Privacy Policy from time to time — for example, when we add a new provider, change a retention period, or adapt to a change in law. When we make a change we will:

• Update the Last updated date at the top of this document.
• For material changes, take reasonable steps to notify registered users (for example, by email or by an in-platform notice on courses.instilligent.com or in EzyCourse).
• Keep the immediately preceding version available on request from [email protected] for at least 12 months after the change date.

Continued use of the Courses or the storefront after a material change takes effect constitutes acceptance of the updated policy. Material changes do not retroactively reduce your rights in respect of personal information collected before the change date.

15. Notifiable Privacy Breaches

The New Zealand Privacy Act 2020 (Part 6) requires us to notify the Office of the Privacy Commissioner and any affected individuals when we become aware of a "notifiable privacy breach" — broadly, a privacy breach that is reasonably likely to cause serious harm (financial, physical, emotional, or reputational) to one or more affected individuals.

If we become aware that a privacy breach affecting personal information described in this policy is reasonably likely to cause serious harm — for example, unauthorised access to account credentials, exposure of payment-token records, leakage of support correspondence, or any other event meeting the Privacy Act's serious-harm threshold — we will:

• Notify the Office of the Privacy Commissioner as soon as practicable after becoming aware of the breach, as required by section 114 of the Privacy Act 2020.
• Notify each affected individual (or, where individual notification is not reasonably practicable, give public notice) explaining: what happened, when, what personal information was involved, what we are doing about it, and what steps you can take to protect yourself.
• Investigate the cause, contain the breach, and take reasonable steps to prevent recurrence.

We aim to make notifications without undue delay. If you believe you have been affected by a privacy breach we have not yet notified you about, please contact [email protected] immediately.

The right to be notified is separate from and in addition to your other rights under §9 — exercising one does not affect the others.

16. Contact

For any privacy-related query, access request, correction request, deletion request, complaint, or general question about this policy:

• Email: [email protected]
• Company: Instilligent Limited (NZBN: 9429041896853)
• Registered office: Auckland, New Zealand

For operational matters about the Courses themselves (course content, refunds, account access, billing) — see the Terms and Conditions and the Refund Policy and email [email protected].

We aim to respond to privacy enquiries within 5 working days and to resolve complaints within 20 working days. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner at privacy.org.nz.

---

*This policy is published for the courses storefront. Questions for external counsel review are maintained separately in legal/DOUGAL-REVIEW-BRIEF.md (not customer-facing).*