How we protect your information

Sensitive areas of the app require signing in. Admin and team dashboards are gated behind authentication and an approval step, so new accounts cannot view client data until an administrator grants access.

Roles are stored in a dedicated table and checked on the server. We never trust a role claim that comes only from the browser.

All client data lives in a managed Postgres database with row-level security policies. Each query is filtered by the signed-in user, so people only see the records they own or have been granted access to.

Public questionnaires submit through validated server functions that sanitise and length-check every field before saving.

The site is served over HTTPS, and all calls to our database and server functions happen over TLS. Authentication tokens are short-lived and refreshed automatically.

We collect the information you provide directly: name, contact details, and the answers you give in questionnaires or class sign-ups. We use that information only to deliver the service you asked for and to follow up with you.

We do not sell your data, and we do not share it with third parties for advertising.

You can request a copy of your data, ask us to correct it, or ask us to delete it at any time. Mailing-list emails include a one-click unsubscribe link.

Found something that looks wrong, or have a question about how your data is handled? Please get in touch and we will respond promptly.

This page describes controls we operate ourselves. It is not a third-party certification or audit attestation.