Privacy policy

Last updated: 19 October 2026

This policy explains what data Daftra Academy collects about you when you browse its site, create an account or learn on it; why it is collected; who can see it; and the choices you have. "The Academy", "we" and "us" mean the Daftra Academy platform and the team that runs it. Daftra Academy is part of the Daftra service, which is owned and operated by Izam, Inc.

What you give us when you create an account

When you register, we ask for:

Your first name and last name.
Your email address, which you sign in with and which we write to.
Your country.
A password. We never keep it as you typed it, only in a hashed form from which the original cannot be recovered.

We also record the language your browser prefers, so we can show you the platform in it, and the time you agreed to the terms of use and to this policy.

What you add to your profile

On the settings page you may add any of the following, all of it optional: a profile photo, a phone number with its country code, your city, your date of birth, your gender, a short bio, links to your social media accounts, your job title and your employer. We also keep your preferences: interface language, light or dark appearance, time zone, and whether you want course announcements by email.

Your learning activity

When you learn on the platform we keep a record of what you do, because tracking your progress and issuing your certificate depend on it:

The courses you enrolled in, when you enrolled in each and when you completed it.
The lessons you completed, your progress, and where you stopped in each video so you can pick up from there.
Your assessment attempts: your answers, scores and results.
The certificates you have earned, your badges, and your streak of consecutive learning days.
Courses you saved for later, and the notifications you have read.
Your private notes on lessons, which are yours alone and are not visible to instructors.
Your comments in lesson discussions, and your ratings and reviews of courses.

Your certificates and public verification

This is the one place where we deliberately make some of your data available to anyone, so we set it out in detail.

Every certificate carries its own number and a QR code that leads to its verification page. Anyone who knows a certificate's number, such as an employer you are applying to, can open the verification page without an account and see these details, and only these:

The certificate number.
Its status: valid or revoked.
Your name as it was printed on the certificate when it was issued.
The name of the certificate.
The date it was issued.
An expiry date, which is currently empty because our certificates do not expire.

The verification page does not show your email address, your account, your progress, your scores, or any other course you have taken. We ask search engines not to index verification pages, and we limit how many requests can be made to them in quick succession. Certificate numbers are sequential and printed on the certificate itself, however, so anyone who has the number can see the details above.

Your name is kept on a certificate exactly as it was on the day it was issued, so changing the name on your account later does not change it. If you close your account, your certificates stay valid and their verification pages go on showing your name as printed. If you find a mistake on your certificate, write to us: a corrected copy can be issued under the same number.

The certificate's PDF file opens through a private link containing a random code, and anyone who has that link can open the file, so share it with care. If you choose to add a certificate to your LinkedIn profile, we send you to LinkedIn with the certificate's name, number, month and year of issue, and the link to its verification page. We do not send LinkedIn the link to the file.

What other people can see

Reviews: you can rate a course once you have completed it. Your star rating counts towards the course's average straight away. The text of a review is published only after our team has checked it, and then appears publicly on the course page and the instructor's page with your full name and profile photo.
Lesson discussions: your comments and replies can be seen, with your name and photo, by everyone who can open the same lesson.
Instructors: an instructor sees only your name and what you have done in their own course. They do not see your email, phone, country, city, employer, date of birth, gender, bio or links, the other courses you are taking, or your private notes.
The Academy's team: authorised staff can see account data as far as running the platform and supporting learners requires. They may keep internal notes on an account, or view the platform as the account holder sees it for support purposes. Administrative actions on accounts, such as deactivation or a change of permissions, are recorded together with the name of whoever took them.

Your profile page inside the platform is private to you and is not shown to visitors.

The contact form

When you write to us through the "Contact us" page, we keep your name, your email address, your phone number with its country code if you gave one, the type of enquiry, your message and the language of the page, and we send a copy of your message to the Academy team's mailbox for follow-up. To fight spam we also keep a description of your browser and a fingerprint derived from your IP address with a secret key. We do not keep the address itself.

If you subscribe to the newsletter, we keep your email address and language and send you a confirmation email. Your subscription is complete only once you confirm it from that email. The confirmation email contains an unsubscribe link that works at any time. We also keep a fingerprint of your IP address with the subscription, as described above. Authorised staff may export the list of subscribers in order to send the newsletter.

Search and reading articles

We record what visitors search for in courses and on the blog, aggregated into one counter per search term, without linking it to an account, an IP address or a session, so we can learn what people look for and do not find. A term searched fewer than five times is deleted once nobody has searched for it for 90 days, and a term that found results is deleted once nobody has searched for it for 180 days. A term searched often that found nothing is kept, because it shows us what is missing.

To count each reader of an article once a day, your browser keeps a random identifier that is sent when you open an article. We turn it into a fingerprint tied to that day and that article which lasts only until the end of the day, and the only thing stored in our database is one more read.

Usage statistics (Google Analytics)

When it is enabled on the site, we use Google Analytics 4 to understand how the platform is used. Google then receives the addresses of the pages you visit, and specific events that we send, such as enrolling in a course, completing a lesson or an assessment, searching, or switching language. These events carry only identifiers of courses, lessons and assessments, the language, a score band, and the search term with its number of results.

We do not send Google your name, email, phone, account number or postal address: the list of what may be sent is fixed in the platform's own code, and any field outside it is refused. We ask Google to mask part of your IP address, and we switch off Google signals and ad personalisation. Google Analytics sets its own cookies in your browser.

The site does not currently ask for consent before loading Google Analytics. If you would rather not be counted, you can block its cookies in your browser's settings, or install Google's Google Analytics opt-out add-on. The platform works the same either way.

Cookies and browser storage

Session cookie: keeps you signed in, and cannot be read by scripts running in the page. If you choose "Remember me" when signing in, we set an additional cookie that keeps you signed in for longer.
Request forgery protection token: checks that forms submitted to us came from our own pages.
Signed-in indicator: a cookie holding a single value meaning "someone is signed in", so the site can show the right buttons. It does not identify you.
Language: a cookie that remembers the language you chose, for one year.
Local storage: your browser keeps your choice of light or dark appearance, your caption preference in the video player, and the random identifier used to count article reads.
Google Analytics: cookies set by Google when statistics are enabled.

We do not sell your data. To run the platform we rely on service providers who process data on our behalf:

The hosting and database providers the platform runs on.
Cloud storage providers. Profile photos and the site's images are kept in a media store whose files are served through direct links, so anyone who knows the link to your photo can open it. Certificate files are kept in a separate store that is not publicly accessible.
The email delivery provider our messages to you pass through, such as emails about certificates, badges, course announcements, password resets and newsletter confirmation.
Google, through Google Analytics as described above.
YouTube and Vimeo, through which some lesson videos are shown. We use their privacy-enhanced embeds, but the provider still receives your browser's request when the video loads.
LinkedIn, only when you yourself choose to add a certificate to your profile there.

Some of these providers may have their servers outside your country. As with Daftra's other services, your data may be stored in and accessed from Canada, and transferred over the internet across borders to the providers above, as set out in Daftra's terms and conditions.

How we protect your data

We ask for your current password before you change your email or password, and before you download a copy of your data or close your account. The "Security and privacy" page shows the devices you are signed in on, with the browser, IP address and time of last activity for each, and lets you end any of those sessions. No system can guarantee absolute protection, but we design the platform to reveal no more of your data than it needs to.

Your rights and choices

Viewing and correcting: you can edit your profile and preferences at any time on the settings page.
A copy of your data: from the "Security and privacy" page you can download a single JSON file containing your account and profile details, the courses you enrolled in, the lessons you completed, and your certificates.
Closing your account: from the same page, after entering your password. This cannot be undone. When you close your account we replace your name with "Former learner" and your email with a random address that receives no mail; we remove your country, phone, city, date of birth, gender, bio, links, job title, employer and photo from the account; and we end all of your sessions. Your learning record is not deleted: it stays attached to the account once your identity has been removed from it. Your comments and reviews appear under "Former learner", and your certificates remain valid in your name as printed, as explained above.
Emails: you can turn off course announcement emails on the settings page, and unsubscribe from the newsletter at any time.
Other requests: for any other request about your data, write to us through the contact page.

How long we keep data

We keep your account and learning data for as long as your account is open; when you close it, what is described above happens. The platform does not currently delete contact messages or newsletter records automatically after a set period. If you would like to ask about them, write to us.

Changes to this policy

We may change this policy whenever what the platform does with your data changes, and we update the "Last updated" date at the top each time we do.

Contact us

For any question about this policy or your data, write to us through the contact page.