AcademyPrivacy notice
How BrightPlan Academy handles your information when you sign in.
What we collect and why
| Data | Purpose | Kept |
|---|---|---|
| Name, email, country, company and channel | Create and run your account; show you the right Academy content | Until you delete your account |
| Password (stored only as a salted scrypt hash), authenticator and passkey details | Sign you in securely | Until you delete your account |
| Sign-in sessions (time, IP address, browser) | Keep you signed in and detect misuse | Until the session expires, then up to 30 days |
| Security log (sign-ins, changes, IP address) | Security, fraud prevention, legal obligations | 730 days; after you delete your account it no longer identifies you |
We do not sell or share your personal information for advertising, and we do not use advertising or analytics cookies.
Page-view analytics are off.
Cookies
We use one essential cookie to keep you signed in (and a short-lived one during two-step verification), plus an optional preference cookie that remembers your light or dark appearance choice. The Academy content shown inside this site may set its own cookies; see the Academy privacy notice.
AI Coach
If your organization enables the AI Coach, it is operated by BrightPlan and uses artificial intelligence to answer general financial-education questions. Answers can be wrong or incomplete, are not financial, tax or legal advice, and are not reviewed by a person before you see them. Do not enter account numbers or other sensitive details. You can use the Academy without it. Ask us if you want to know how your questions are stored.
Your rights
Depending on where you live (including under the GDPR and the CCPA/CPRA) you can access, correct, delete and receive a copy of your information, object to or restrict processing, and complain to your data protection authority. Signed in, go to Account settings to edit your details, download your data, or delete your account. We will not treat you differently for using these rights.
Who processes it
Our hosting, database and email providers process data for us under contract. Single sign-on providers chosen by your organization receive only what sign-in requires. We keep data in the region where the service is hosted unless a contract says otherwise.
Contact
Contact your organization administrator or BrightPlan support for privacy requests.