A clear view of your data.
We operate Learn Courses through AceMedia and AceHost. This guide covers the personal account service currently available on learn.courses. It does not describe a paid course purchase, a live shared chat service or an institution’s separate data arrangements.
What we store
We store your name, email address, password hash, verification status, account role and account creation time. If you use those features, we also store saved course plans, your private notes, academy drafts and uploaded files with their ownership and size records. We store a password hash rather than your original password.
Course interests
We store course-specific interest requests, contact email, confirmation status and consent version separately from enrolment and general newsletters. Guests confirm an email link; verified members can use their account. Unconfirmed requests expire after seven days, and confirmed interests expire after 180 days without activity. You can withdraw through the email link or your signed-in interests page. Expired records are removed when the interest service is used; recovery copies follow the backup retention below.
Where it goes
The account service runs on AceHost. Our production database and private file bucket use AWS in London. Public illustrations and other deliberately public media are delivered through CloudFront. Verification and recovery emails pass through AceHost’s mail relay and Amazon SES to your email provider. Private uploads are not public CDN files.
Sessions, links and recovery copies
Our essential sign-in cookie is HttpOnly, Secure and SameSite=Lax. Signed-in sessions last up to 30 days; anonymous sessions last two hours. Verification and reset links expire after one hour and are single-use. Password replacement revokes existing signed-in sessions.
RDS automated backups cover seven days. We retain the newest 14 successful local archives. Off-host archives expire after 90 days, with superseded versions retained for up to another 30 days. A deleted record can therefore remain in restricted recovery copies until their retention period ends. We use those copies for recovery, not active learning or marketing.
Your controls
You can change your password through account recovery, manage saved plans and private notes, and download your account data after verifying your email. The export includes file records; it does not make private files public or include password hashes, cookies, reset links or AWS credentials.
For deletion, corrections or recovery help, email [email protected] from your account address. We will confirm identity and the affected records before acting. We will not bypass sign-in checks because somebody knows an account’s name. Self-service account deletion and a separate media-erasure workflow are still being built.
Diagnostics and communication
Our hosting and delivery services retain operational request and delivery records to diagnose failures and protect the service. We keep private notes and message bodies out of application diagnostics. Account emails contain no tracking pixels. We do not subscribe you to marketing merely because you create an account.
The guest demo stores its fictional activity in your browser. It is separate from your real account and does not send messages to tutors or other learners.
This is our current account-service data guide. Wider institutional, paid-course and provider-specific notices will be published with those services before they open.