1. Scope and who we are
xtraLesson Global LLC (QFC), based in Doha, Qatar, provides a connected learning and capability ecosystem for individual learners and for organisations. This policy applies to xtraLesson websites and learning services that link to it, including the public website and learner platform. A specific institutional programme or service may provide an additional privacy notice.
Depending on the relationship and applicable agreement, xtraLesson may act as a controller of personal information or process information on behalf of an institution, employer, government entity, foundation, sponsor or other programme partner.
2. Information we may collect
We collect only the information reasonably needed to operate, secure, improve and support the relevant service.
- Contact and profile data: name, email, organisation, country or market, role, preferred language and information you choose to provide in forms or communications.
- Account and learner data: account identifiers, academy or course access, enrolment, progress, lesson activity, quiz or assessment results, certificates and other learning records where those features are used.
- Organisation and programme context: organisation membership, programme or cohort assignment, access source, seat or licence context and information needed to administer a managed deployment.
- Technical and usage data: IP address, browser/device information, timestamps, security events, pages or features used, referral information and performance data, subject to applicable settings and consent requirements.
- Communications: enquiries, support requests, meeting notes, feedback and other correspondence.
3. How we use information
- Provide, personalise and secure access to xtraLesson websites, academies, courses, Learning Paths and learner services.
- Manage accounts, entitlements, enrolment, learning progress, certificates and support.
- Administer institutional, sponsored or government programmes, including authorised reporting and agreed programme operations.
- Respond to contact, demo, pilot, partnership and support requests.
- Operate, troubleshoot, protect and improve the website, learning experience, content and platform.
- Send service communications and, where permitted, relevant product or marketing communications.
- Meet contractual, legal, regulatory, audit and security obligations.
4. Institutional and programme reporting
When learning is provided through an organisation, programme or sponsor, authorised administrators may receive information about learning that is attributable to that organisation or programme, such as assignment, participation, progress, completion or assessment information, subject to the applicable agreement and permissions.
Organisation membership alone is not intended to make unrelated personal learning activity visible to that organisation. xtraLesson uses learning context and server-side access controls so institutional reporting can be scoped to the appropriate organisation or programme relationship.
5. How we share information
xtraLesson does not sell personal information. We may disclose information only where reasonably necessary for the service, relationship or legal requirement.
- Authorised xtraLesson personnel and contractors with a legitimate operational need.
- Hosting, learning-platform, cloud, media, email, analytics, security and other service providers acting under appropriate arrangements.
- An institution, employer, government entity, foundation, sponsor or programme administrator for learning attributable to its authorised programme context.
- Implementation or delivery partners where needed for an agreed programme.
- Regulators, courts, law-enforcement authorities or professional advisers where required or permitted by law.
- Other parties with your direction or consent where applicable.
6. International processing and service providers
xtraLesson supports users and organisations in multiple markets. Information may therefore be accessed, hosted or processed in countries other than the country where it was collected. Where required, xtraLesson and its clients should use appropriate contractual, organisational or technical safeguards for the relevant transfer and processing relationship.
7. Security
We use reasonable technical and organisational measures intended to protect personal information, including controlled access, HTTPS transport, application security controls, backups, logging and other safeguards appropriate to the service. No online service can guarantee absolute security, and users are responsible for protecting their credentials and reporting suspected misuse promptly.
8. Retention
We retain information for as long as reasonably necessary for the purpose for which it was collected, to maintain appropriate learning or programme records, to meet contractual or legal requirements, to resolve disputes, and to protect the integrity of the service. Retention periods may differ by data category and institutional agreement.
9. Children and young learners
Some xtraLesson academies and programmes may be relevant to young people. Where a programme involves minors, access and personal-information handling should be arranged through the appropriate parent, guardian, school, institution, government entity, NGO, sponsor or other authorised programme structure as required by applicable law and the programme design.
10. Your choices and rights
Depending on applicable law and the relationship in which xtraLesson processes your information, you may have rights to request access, correction, deletion, restriction or objection, to withdraw consent where consent is the basis of processing, or to request information about processing. Identity verification may be required before a request is completed.
To raise a privacy question or request, please use the Contact xtraLesson.
11. Cookies and similar technologies
Our websites and learning services may use cookies and similar technologies for essential operation, security, preferences, analytics and other permitted purposes. See the Cookie Policy for more information.
12. xtraLesson Mobile and device data
When you use xtraLesson Mobile, the app may process device and application information needed for authentication, security, notifications, offline learning, downloads, troubleshooting and reliable operation. Device permissions are requested only where a feature requires them, and the available permissions depend on the operating system and app version.
Offline learning may store selected course resources and learning state on your device until they are synchronised or removed. Push-notification providers and the Apple App Store or Google Play may process information under their own policies. xtraLesson does not treat app-store account information as learner entitlement authority; access remains governed by the xtraLesson account and configured entitlement model.
13. Google Sign-In and account linking
xtraLesson may offer Continue with Google as an optional way to sign in, create a learner account or link a Google account to an existing xtraLesson account.
Information we access
When you choose Google Sign-In, Google may provide xtraLesson with:
• Your Google account's unique identifier.
• Your email address and its verification status.
• Your first and last name, where available through your Google profile.
We request only the basic identity and profile permissions necessary for authentication. Google Sign-In does not give xtraLesson access to your Gmail messages, Google Drive files, contacts or calendars.
How we use this information
We use this information to verify your identity, create or securely link your xtraLesson account, prevent unauthorised account access, and provide access to eligible learning services.
When linking an existing account, we require you to sign in and explicitly initiate the linking process. Accounts are not automatically linked solely because their email addresses match.
Storage and security
xtraLesson stores the account information necessary to operate its learner services, including your email address, profile details and the Google account identifier used to maintain a secure account association.
Google authentication responses are validated through secure server-side processes. Google access tokens and refresh tokens are not retained for ongoing access to Google services.
Sharing and retention
We use Google Sign-In information for authentication and account management. We do not sell Google Sign-In data or use it to provide third-party advertising.
Information may be processed by authorised service providers where necessary to host, secure and operate xtraLesson, as described in this Privacy Policy.
We retain account and identity information only as reasonably necessary for account management, security, applicable legal obligations and the other purposes described in this policy.
Your choices
Google Sign-In is optional. You may use another available authentication method where supported.
You may contact xtraLesson to request information about your account, ask about removing a linked Google identity, or exercise applicable data protection rights.
Google's own processing of your Google account information is governed by Google's Privacy Policy.
14. Changes to this policy
We may update this Privacy Policy as the xtraLesson ecosystem, technology, legal requirements or operating practices change. The current version will be published on this page with its updated date.