Privacy

Draft written 9 August 2026.

Draft. This page has not been reviewed or approved by the platform owner yet. Lines marked “owner to supply” are facts this platform cannot know about itself and must be filled in before the page is relied on.

This page describes what CEJ Experts actually stores, why it stores it, and how long it keeps it. It is written from the system itself rather than from a template, so where the platform does something you might not expect — certificates that are never deleted, analytics that have no consent banner yet — it says so.

1. Who holds this data

Owner to supplythe legal name and registered address of the business that operates CEJ Experts and decides how this data is used, plus a privacy contact address if it is different from the support address on the contact page.

2. What is stored

Everything below is stored because a specific feature needs it.

Your account

Your email address, your name if you give one, your role (learner or author), when the account was created, and the sign-in credentials handled by the authentication system. This is what lets you sign in and what a certificate is issued against.

Enrolments

Which courses you enrolled in, when, the exact course version pinned to that enrolment, whether it is active or complete, and a link to the order if you paid for it.

Attempts and scores

Each assessment attempt: when you started, when you submitted, your answers, your score and whether you passed. This is the evidence behind a certificate, which is why it is kept rather than discarded after marking.

Learning-record evidence

For imported SCORM or cmi5 course packages, the statements the package sends back — that you launched it, how far you got, what it scored you — plus its bookmark and resume data. These are evidence of what happened inside the package. They never decide whether you passed; this platform’s own assessment does that.

Certificates

The record that you passed a specific version of a specific course on a specific date, and the credit hours attached to it. See section 6.

Orders

For a paid course or bundle: what you bought, the price at the moment you bought it, the currency, which payment provider took the money, the provider’s reference for the payment, and whether it succeeded. Card numbers are not part of this — see section 3.

Messages, groups and skills

Notifications sent to you and whether you have read them; membership of any group or branch an administrator puts you in; and skill records with the evidence behind them, including who verified a skill and when.

AI practice

If you use the Learning Playground, the conversation you had with it and the rubric score generated from that transcript. Practice is never counted towards a pass. If the owner switches the AI features off, the feature stops for everyone and no new transcripts are created.

3. Payment card details

Card details never reach this platform. When you buy a course you are sent to the payment provider’s own hosted checkout page; you type your card details there, into the provider’s systems. What comes back to CEJ Experts is the amount, the currency, whether the payment succeeded, and the provider’s reference for it. There is no card number, expiry date or security code anywhere in this platform’s data.

4. Analytics and error monitoring

The platform can run product analytics and browser error monitoring, and both are switched off unless the owner configures keys for them. With no keys configured, nothing is initialised and no analytics or error data leaves your browser.

Being straight about the current state: there is no cookie or consent banner in the platform today. If the keys are configured, analytics run for every visitor rather than only for visitors who agreed. A consent control is a known gap and a stated follow-up, not something already built, and it is recorded as such in the platform’s own settings page.

Owner to supplya decision, before analytics keys are switched on in production: whether the regions CEJ Experts sells into require consent first, and therefore whether the consent control must ship before the keys do.

5. Cookies

Signing in sets a session cookie and a refresh token. They are what keep you signed in across page loads; the platform does not work without them, and they are not used for advertising. Clearing them signs you out.

Those are not the only cookies that can exist here. If the owner configures the product-analytics key described in section 4, the analytics library loads in your browser and sets its own cookies on this domain, to recognise the same browser across page loads and to record when you leave a page. With no key configured that library never loads and those cookies are never set. There is no banner to accept or reject them today — section 4 says so plainly, and says what has to change.

6. How long things are kept

Your account, enrolments and attempts are kept while your account is open.

Certificates are different. A certificate is the record that you earned continuing-education credit, and it is the thing a regulator, a board or an employer may ask you to produce years after the course. So the platform treats it as a permanent record: an administrator who tries to delete an account that has a passed attempt is refused, in those words, and told to archive the account instead. If you ask us to close your account, we can remove the rest of your data, but the certificate record and the passed attempt behind it stay.

Owner to supplythe minimum period certificate records must be kept for — set by the accreditation body or the rules of the jurisdiction the business is established in — and whether an archived learner’s name stays on the record or is reduced to a reference number after that period.

7. Who else sees it

• Administrators of this portal. Author accounts can see learners, enrolments, attempt results and certificates in the admin console, because that is how a course is run and a certificate is issued.
• The payment provider, for a purchase: it takes the payment and holds the card details, under its own privacy terms.
• The services the platform runs on — its database and application hosting — which process the data on our instructions in order to serve the platform.
• Analytics and error monitoring providers, but only if those keys are configured; see section 4.
• Any integration an administrator connects, for example a calendar or mail provider. Where an integration is connected, this platform stores which provider is connected and its status — never the provider’s access tokens.
• The AI model provider. The Learning Playground and the author drafting assistant are not run on this platform’s own hardware: they call OpenRouter at openrouter.ai. So when you practise in the Playground, the conversation you type is sent to OpenRouter to produce the reply and the rubric score, and when an author drafts assessment questions the course text they submit is sent there too. Both leave this platform to be processed by a company this business does not run. If the owner switches the AI features off, nothing is sent. OpenRouter is a router rather than a model host: it passes each request on to a further company that runs the model and returns the answer. Which one that is depends on the model configured and on OpenRouter’s own routing, so your text reaches at least two companies, not one.

Your data is not sold, and this platform does not train any model of its own on it. What OpenRouter does with text sent to its API is governed by OpenRouter’s own terms and its agreement with the business, not by this page — so this page states the fact that the data goes there rather than making a promise on a third party’s behalf that it cannot enforce.

Owner to supplythe confirmed list of processors for the production deployment — the database and hosting providers, the payment provider, the analytics or monitoring providers actually configured, and the AI provider named above — with the country each one stores data in, and the data-processing terms agreed with the AI provider, including whether API content is excluded from its model training. Where the AI provider is a router that forwards the request to a further model host, the terms of that host count too: the reader is told who receives the text, and the chain has to be established before this page can claim to be complete.

8. Asking about your data

Write to us through the contact page to ask what is held about you, to correct something wrong, to get a copy, or to close your account. Section 6 explains the one thing we cannot remove.

Administrators can export the platform’s full data as a file for backup purposes; that export is an administrator function, not something that sends your data anywhere on its own.

9. Security

Sign-in uses an HTTP-only session cookie, so page scripts cannot read your token. Card details never reach this platform at all (section 3), and where an administrator connects an integration the platform stores its status rather than the provider’s access tokens (section 7).

What this page will not do is tell you the platform is secure in general. The intended model is that access rules live inside the platform’s own backend functions rather than only in the interface, so hiding a button is never the protection. That rule was applied to the codebase over time, and not every function has been brought up to it: an access-control review is open, individual functions found to be missing or under-enforcing a check are tracked and closed one by one, and until that review is finished this page cannot honestly present the enforcement as complete. Multi-factor sign-in and an audit log of administrator actions are not built at all. None of this is a closed list of the platform’s weaknesses; it is a description of how they are being found and fixed.

Owner to supplya decision on whether the open access-control review must be finished before the platform holds real learner data, and — for the jurisdiction the business is established in — who notifies affected people if there is a breach, and within what period.

10. Changes to this page

If what the platform stores changes, this page changes with it. The draft date at the top tells you which version you are reading.