Privacy Policy

This notice describes the data used by Octopus Academy’s learning service. Octopus Academy handles account, learning and support data. The seller named in an earlier purchase receipt handles its purchase and payment records under its own privacy notice. No new checkout is active; existing account and transaction records are retained according to this notice.

1. Information used by the service

• Account information: username, account identifier, role, creation date and, for password accounts, a password hash, plus the most recent account activity date. Google sign-in, when available, stores a Google account identifier linked to your service account; it does not store your Google password.
• Session information: a sign-in cookie, a stored hash of the session token and its expiry date.
• Learning activity: answers, attempts, scores, progress, review items, saved tests and study or accessibility preferences.
• Service records: learning analytics, administrative audit records and technical records needed to operate and troubleshoot the service.
• Subscription information: customer, transaction and subscription identifiers, recorded subscription status, billing-period and scheduled cancellation dates from earlier purchases. These records remain linked to your account to preserve and check its existing learning access.
• Messages: the email address and information you choose to send when contacting us.

2. Why information is used

Account and learning information lets you sign in, save work, review answers and resume practice. Preferences adapt your learning experience. Technical and administrative records help protect accounts, investigate faults and manage the service. Contact messages are used to respond to your request.

Where the GDPR applies, account, learning and subscription processing is necessary to provide the requested service and perform our agreement with you. Security and troubleshooting rely on our legitimate interest in operating a safe service. We use support messages to handle your request and retain information required by applicable legal obligations. Consent, where required, is requested separately and can be withdrawn.

If you choose Google sign-in, Google authenticates you and shares an identity token with the service. We verify it to create or find your account using its Google identifier. We do not automatically merge accounts by email address. Google handles its authentication under its Privacy Policy. Password registration does not ask for a separate email address or send a confirmation email.

3. Cookies and browser storage

The service uses the octopus_session cookie to keep you signed in for up to 30 days. Signing out revokes that session. Blocking this cookie prevents authenticated learning features from working. Display preferences are applied to the page and saved with your account.

Google sign-in also uses the essential octopus_oauth_state cookie and a temporary sign-in attempt valid for up to ten minutes to protect the return from Google. The attempt is consumed once and the cookie is cleared when the sign-in callback is handled.

The site does not load a third-party checkout or payment script. We are preparing checkout through 2Checkout (Verifone). Its Privacy Policy describes its own processing and supplements this service notice. Any payment-data sharing for a future checkout must be disclosed before orders open. For an earlier purchase, consult the provider and privacy notice identified in your receipt.

4. Payments and recipients

The seller and payment provider named in an earlier receipt are responsible for the purchase and payment data they processed, under their own notices. The application retains the account links and subscription and transaction identifiers recorded from verified notifications; it does not store card numbers in its learning database.

Authorized administrators can manage accounts and learning content. Our deployment documentation records Vercel hosting and Supabase PostgreSQL, with a migration to the United States and an Irish recovery copy documented in October 2026. Current processing regions, the continued presence of that recovery copy, backup retention, the email provider and international-transfer safeguards are awaiting confirmation by the service operator. These historical records do not establish the current location of every copy or recipient. Contact us for current processing information. See Service operator information for Octopus Academy service and contact information. The reseller's details apply to orders it processes.

5. Retention and deletion

Signing out does not delete your account or learning history. In Settings → Your data, signed-in learners can delete attempts, review items, saved tests, preferences and personal analytics. This action does not delete the account itself or the seller’s purchase or payment records.

Sessions expire after 30 days. Our retention policy is 13 months after creation for learning attempts, answers, results, saved tests, review records, preferences, assignments, analytics and audit records. Accounts and their remaining personal records are deleted after 13 months without sign-in or authenticated activity. For accounts created before activity tracking began, the inactivity period starts from the introduction of that tracking.

Deletion is carried out manually by an administrator, rather than automatically on the expiry date. It permanently removes records from the active database. Subscription ownership and unresolved checkout references are retained while needed to preserve account access and historical records; ended subscription records and notification receipts are removed after 13 months. Support correspondence is reviewed and deleted manually after 13 months under our stated policy. The actual retention and deletion schedules for infrastructure logs and backups still require operator confirmation. Deletion from the active database may not immediately remove a backup. Contact us for the confirmed schedule or to request earlier deletion.

Deleting an account or learning data does not cancel a recurring subscription purchased earlier. The application no longer provides an in-account billing portal. Use the billing or cancellation link in the purchase receipt, or contact the payment provider named there, before requesting account deletion if you wish to stop renewals. The seller and payment provider retain purchase records according to their own policies and legal obligations.

6. Your choices and rights

Depending on the law that applies, you may request access, correction, deletion, restriction or portability of your information, object to processing, or withdraw consent. Contact contact@octopusacademy.school with your request. We may need information to verify that the account is yours; do not send your password or full payment details.

Where the GDPR applies, you may complain to the data protection authority in your country of residence, workplace or the place of an alleged infringement. In France, you can contact the CNIL.

7. Security and updates

Passwords and session tokens are stored as hashes, and access to learning data requires authentication. No service can guarantee absolute security. Report suspected unauthorized access through our contact page. Changes to this notice will be reflected in its update date.