Last updated: 20 September 2026
The data controller for this Service is Digital Creative Academy LLC, registered in Switzerland ("we", "us", "our"), operating the Kora platform. For any privacy-related inquiries, contact us at learning-support@digital-creative-academy.com.
This policy explains how we handle personal information. Where separate consent is required, we will request it specifically.
We collect the following information:
Raw session transcripts and personal notes are personal data stored persistently only in your browser's local storage. Voice and transcript fragments pass transiently through the relay during a live session but are not stored there. A short AI-generated summary and learning indicators derived during the session are stored on our servers. Recent excerpts are sent to Gemini to create the short summary, but the raw transcript is not retained in our server database. You can delete local transcripts or notes with their in-app clear controls or by clearing your browser data. Successful account deletion also clears Kora transcripts and notes in the browser used for that request, but cannot clear other devices or downloaded copies. Clear local data on shared devices. Provider processing of submitted excerpts is separate from storage in Kora's database.
We handle personal data under applicable Swiss law and, where applicable, EU or UK GDPR. The legal basis depends on the processing purpose:
Avoid unnecessary sensitive information and personal details about others. Where GDPR Article 9 applies to special-category information, such as health data, an additional permitted condition is required; contractual necessity alone is not sufficient. You can stop further microphone input by muting or ending a session and contact us to withdraw consent where we rely on it, without affecting prior lawful processing.
We do not sell, rent, or share your personal data with third parties for marketing purposes.
Safeguards include protected authentication credentials, encrypted account identifiers, access controls, and encrypted network connections. These measures do not mean every learning record or browser copy is individually encrypted, or that the service is end-to-end encrypted against Kora or its providers.
No system guarantees absolute security. Protect your account and devices, and contact us about suspected unauthorized access. Payment card processing is handled by Stripe.
We use HTTP-only session cookies for authentication. These are used to provide the requested service. We do not use advertising or third-party analytics cookies. Security providers may process technical information to protect the service; any non-essential storage remains subject to applicable consent requirements.
We use your browser's local storage to save session transcripts and personal notes for your convenience. This data remains on your device unless you choose to submit related content through another feature.
Digital Creative Academy LLC is based in Switzerland. Live voice traffic is routed through European infrastructure, but some providers may process support, payment, or text-AI data outside Switzerland, the EEA, or the UK:
International transfers must meet applicable legal requirements. Where required, these include an adequacy decision or appropriate safeguards, such as Standard Contractual Clauses with relevant Swiss or UK adaptations and any necessary supplementary measures. Contact us for the locations and safeguards applicable to your data and how to obtain a copy where applicable. Provider involvement does not remove our own responsibilities.
Account details, enrollments, summaries, mastery indicators, passed Practice evidence, and assessment results are generally retained while your account is active. Failed Practice attempts become eligible for cleanup after 90 days; assessment question sets expire after two hours and are eligible for cleanup after expiry. Database contact records are eligible after 12 months. Unverified accounts may be removed after 48 hours; qualifying inactive unpaid accounts may be removed after 12 months, subject to recorded activity and access status. Actual deletion depends on scheduling and successful cleanup, not an exact deadline.
Successful account deletion removes account-linked learning history and clears local transcripts and notes in the requesting browser. Billing cancellation must be confirmed first; contact support if self-service deletion cannot be completed. Custom programme records lose their account link. Unpublished programmes then become eligible for cleanup, while published programmes may remain with their original topic, learning challenge, and content. Removing the account link does not guarantee anonymity. Contact us to request review or removal of personal information in that content.
Support email is separate from database contact records and is kept according to support needs and applicable obligations; database cleanup does not delete mailbox copies. Backups, provider records, and downloaded or other-device copies may also have separate retention. Payment, security, support, or legal records may be retained for required periods or legitimate claims. Contact us for the scope, timing, and any lawful exception applicable to your deletion request.
Subject to applicable Swiss, EU, or UK law, your rights include:
To exercise any of these rights, contact us at learning-support@digital-creative-academy.com. We may request proportionate identity verification; do not send passwords or payment card details. Under EU or UK GDPR, requests are normally addressed without undue delay and within one month. A permitted extension of up to two further months requires notice and reasons within the first month. Requests are normally free, subject to lawful exceptions. Other applicable deadlines remain unaffected.
Kora uses AI-generated summaries, assessment results, and concept indicators to adapt later learning sessions. Assessment answers are scored against server-held answer keys; some configured calculations also receive deterministic checks, while other Practice feedback is AI-generated. These learning indicators do not produce legal or similarly significant decisions about you. You may contact us to question or correct inaccurate learning records.
If you believe your data protection rights have been violated, you have the right to lodge a complaint with:
Kora is not intended for children under 16 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
Where required, we will notify the relevant supervisory authority within the legally applicable period, including the GDPR's 72-hour period where feasible. We will notify affected individuals without undue delay where a breach is likely to result in a high risk to their rights and freedoms.
We may update this Privacy Policy from time to time. Material changes will be communicated as required by applicable law, and any required consent will be requested specifically. Continued use alone is not consent to new processing that requires it. The "Last updated" date at the top of this page reflects the most recent revision.
For privacy-related questions, contact us at learning-support@digital-creative-academy.com.