Privacy Policy

This privacy policy explains how AI for Global Goals Ltd ("Elandi", "we", "us", "our") collects, uses, shares and protects personal data when you visit our website or use the Elandi platform (together, the Platform). It also explains your rights and how to contact us.

1. Who we are

AI for Global Goals Ltd is a private limited company registered in England and Wales (company number 12035444). Our registered office is 27 Old Gloucester Street, London, United Kingdom, WC1N 3AX.

For any question about this policy or your personal data, email our privacy team at privacy@elandi.ai.

When we are the controller

We are the controller of personal data when you create a personal account, buy a learning plan or subscription, browse our website, sign up for our communications, or contact us.

When we act for your organisation

If your employer, school or another organisation gives you access to Elandi (for example by inviting you to a team or assigning you a learning plan), that organisation is usually the controller of the personal data processed for that purpose, and we process it on their behalf under our contract with them. Their own privacy notice applies, and requests about that data are best sent to them. We will help them respond. We remain the controller for running and securing the Platform and for your own account details.

2. The personal data we collect

Special category data and other people's data

We do not ask for special category data (for example about health, ethnicity, religion, sexual orientation or political opinions) or criminal offence data. Please do not include it in your uploads or messages. Contact privacy@elandi.ai before using Elandi for learning that needs this kind of information.

If what you upload contains other people's personal data, you are responsible for making sure you are allowed to share it with us.

What you must provide

We need your email address to create your account and sign you in, and payment details to sell you a subscription or learning plan. Without them we cannot provide those features. Everything else, such as a CV, dictation or push notifications, is optional.

3. Where we get it from

• From you, when you register, fill in your profile, use the Platform, buy something, or contact us.
• Automatically, from your device as you use the Platform (see section 6 and our Cookie Policy).
• From your organisation, if it invites you or assigns you learning plans: typically your name, email address, team and group.
• From sign-in providers, if you choose to sign in with Google or GitHub: your name, email address and profile picture.
• From Stripe, about the status of your payments.

4. How we use it and our lawful bases

The lawful bases below apply where we are the controller. Where we process learning data on your organisation's behalf, your organisation decides the lawful basis and explains it in its own privacy notice.

Where we rely on legitimate interests, we have balanced them against your rights. You can ask us for details and you can object (see section 10).

5. How we use AI

Elandi is built on AI. To generate your learning plans, answer your questions, transcribe audio and video, and mark your answers, we send the relevant parts of your learning content to the AI providers listed in section 7. We do not send your name, email address or other account details. They process it to return a result to us.

• Training. We do not use your personal data to train our own AI models. Our terms allow us to use content that has been anonymised, so that it can no longer identify you or your organisation, to develop and improve Elandi. We have opted out of Deepgram's model-improvement programme for the audio we send it.
• AI output can be wrong. Check important information independently.
• Automated marking. Some answers, assessments and exams are marked by AI, and awards are issued automatically when you meet the published requirements. These results are about your learning; we do not use them to make decisions that have legal or similarly significant effects on you. If your organisation uses your results in decisions about you, it is responsible for those decisions. If you think an AI mark is wrong, contact us and a person will review it.

6. Analytics

We use PostHog, hosted in the European Union, to understand how people use the Platform.

• Without your consent, PostHog still receives basic usage events (pages viewed, features used, referring site or campaign) together with your IP address and device information. It sets no cookies and keeps no identifier in your browser; visits are counted with a hash of your IP address and device information that changes every day.
• If you accept analytics cookies, PostHog also records how you interact with our pages, such as clicks, recognises you across visits, links this activity to your account using your email address, and records sessions so we can see where the Platform is hard to use. Text you type into forms is masked in these recordings. If you also accept, Google Analytics measures visits to our website.
• From our servers, we send PostHog key account events, such as signing up, being assigned or buying a learning plan, subscription payments and earning an award, linked to your internal account number rather than your name or email address.

You can change your choice at any time with Cookie settings at the bottom of our website pages. See our Cookie Policy for details.

7. Who we share personal data with

We share personal data only as described here, and we do not sell it.

Service providers

We use the following providers to run Elandi. Where they process personal data on our behalf, they do so under data processing terms that require them to keep it secure and use it only to provide their service to us. Some, including Stripe and the sign-in provider you choose, also process data for their own purposes under their own privacy notices.

Your browser also connects directly to some services: YouTube (in privacy-enhanced mode) when you watch a video on our website, Stripe on payment pages, Deepgram when you use dictation, and your browser vendor's push service if you turn on notifications.

Other recipients

• Your organisation. If you use Elandi through a team, its administrators can see your account and membership details, when you last signed in, any job preparation and application status, and your learning progress. They can also see skills reports and progression for team members, which can draw on your learning beyond the learning plans your organisation assigned.
• Anyone with your award link. Each award or certificate has a page that anyone with its link can open without signing in. It shows your name and email address, the award, and the related learning plan and exam details, including your score and whether you passed.
• Professional advisers such as lawyers, accountants, auditors and insurers.
• Authorities, such as HM Revenue & Customs, regulators, courts or law enforcement, where the law requires it.
• A buyer or successor, if all or part of our business is sold, merged or restructured. They may use your data as described in this policy.

8. International transfers

Our main databases and file storage are in the European Union. Content delivery and some of our providers process data outside it, including in the United States, as shown in section 7. When personal data leaves the UK or the European Economic Area, we protect it with one of these safeguards:

• the destination is covered by UK or EU adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework for providers certified under it; or
• the International Data Transfer Agreement or Addendum approved in the UK, or the European Commission's Standard Contractual Clauses.

Email privacy@elandi.ai for details of the safeguard used for a particular transfer and how to get a copy.

9. How long we keep it

We keep personal data only as long as we need it for the purposes above:

• Account, profile and learning data: while your account is open. When an account is closed, we delete or anonymise this data within a reasonable period, unless we need to keep some of it for the reasons below.
• Data processed for an organisation: as set out in our contract with that organisation, usually until it asks us to delete it or the contract ends.
• Transaction records: six years after the end of the financial year they relate to, to meet tax and accounting rules.
• Technical logs: application logs for seven days and firewall logs for 30 days.
• Backups: deleted data can remain in database backups for up to seven days and in earlier versions of stored files for up to a year.
• Marketing preferences: until you unsubscribe. We keep a record that you unsubscribed so that we do not contact you again.

We may keep data for longer if we need it to deal with a complaint or legal claim.

10. Your rights

Under UK data protection law you have the right to:

• access a copy of your personal data;
• correct data that is inaccurate or incomplete;
• erase your data, in some circumstances;
• restrict how we use your data, in some circumstances;
• object to our use of your data based on legitimate interests, and at any time to direct marketing;
• portability: receive data you gave us, in a machine-readable format, or have it sent to another organisation;
• withdraw consent at any time where we rely on consent, without affecting what we did before; and
• ask for human review of decisions made solely by automated means that significantly affect you.

To use any of these rights, including closing your account, email privacy@elandi.ai. It is free in most cases. We may need to confirm your identity, and we will reply within one month (or tell you if we need longer for a complex request). If your request is about data we process for your organisation, we may pass it to them.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator, at ico.org.uk. We would appreciate the chance to resolve your concern first.

11. Security

We protect personal data with appropriate technical and organisational measures. These include encryption in transit and access controls that limit data to the people who need it. No system is completely secure. We report personal data breaches to the ICO where the law requires, and we tell you without undue delay if a breach is likely to result in a high risk to you.

12. Age

Elandi is intended for people aged 16 and over. We do not knowingly collect personal data from children under 16. If you believe a child has given us their data, contact us and we will delete it.

13. Links to other websites

The Platform may link to or include material from other websites. We are not responsible for how they handle personal data, so please read their privacy policies.

14. Changes to this policy

We review this policy regularly. The date at the top shows when it was last updated. If we make significant changes, we will tell you by email or on the Platform before they take effect.