Privacy notice

What we use, why, and the legal basis

• Your account. The email address you sign in with (or Apple’s private relay address), your account ID, and when the account was created and last signed in. If you sign in with Google or Apple, they confirm your identity and share your email address, and may share your name and profile picture. We use this to send the sign-in links you ask for, recognise you and link your access and progress to you. Legal basis: performing our contract with you.
• Your agreement to the Terms. Which version of the Terms of Use you agreed to and when. Legal basis: our contract, and our legitimate interest in being able to show what was agreed.
• Access and purchase records. Whether you have access, when it started and ends, purchase or offer references, and any refund or revocation. These are stored against your account ID, not your email address. Legal basis: our contract; once payments are taken, also our legal obligations to keep tax and accounting records.
• Learning progress. Lessons you mark complete, lessons you save, checklist ticks, your answers and position in the practice shifts, and when each last changed, so you can continue on any device. Legal basis: our contract.
• Certificate details. The name you choose for your completion certificate and the date it was issued. The certificate image itself is created in your browser and is not stored by us. Legal basis: our contract.
• Promo code checks. To stop people guessing codes, when you try a code while signed out we keep a keyed, one-way scrambled version of your network address and the time of each code that isn’t recognised; the address itself isn’t stored, and these records are removed after about a day. When you are signed in, the time of each code attempt is recorded against your account. Legal basis: our legitimate interest in keeping the service secure and preventing abuse.
• Security and technical logs. Like any website, our hosting provider processes technical information such as your network address, browser type and the pages requested, to deliver the site and protect it. Legal basis: our legitimate interest in running a secure service.
• Messages you send us. If you email us or use the contact form, your name, email address, the topic and your message, to answer it and deal with any request. To stop the form being flooded, we also keep a keyed, one-way scrambled version of the sender’s network address for each form message; the address itself isn’t stored, and these records are removed after about a day. Legal basis: our legitimate interest in responding and in preventing abuse of the form, or our contract where the message is about your access or a refund.

Where we rely on legitimate interests, you can object, as explained below.

What we don’t do

We don’t send newsletters or marketing emails, we don’t sell your data, and this site has no analytics, advertising or tracking tools added to it. The only emails our system sends are the sign-in links you request; Paddle sends receipts for purchases.

We don’t ask for health information, and the site is not designed to hold patient details. Please never enter patient information, identifiable case details or other confidential workplace information anywhere on the site or in emails to us.

Who handles your data

• Lovable hosts the site and provides its account, sign-in email and database service (Lovable Cloud), acting on our behalf. It uses its own infrastructure providers to do so.
• Google or Apple, only if you choose to sign in with them. Their own privacy policies apply to their sign-in services.
• Our email provider, for messages you send to firstshiftireland@gmail.com. Contact form messages are stored in Lovable Cloud.
• Paddle (Paddle.com Market Limited, based in the United Kingdom) is our online reseller and the Merchant of Record for orders. When you buy, we give Paddle your account email address and account ID with the order; Paddle collects your payment details and billing country, processes the payment, charges VAT and sends your receipt. Paddle handles payment data as a separate controller under its own privacy notice. Card details are entered in Paddle’s secure checkout and never reach us; we receive the order reference, amount, and whether it was paid or refunded.

Links to official and other resources take you to sites run by other organisations, whose own privacy practices apply.

Transfers outside the European Economic Area

Some of the providers above, or their infrastructure providers, may process data outside the EEA, including in the United States. We have not yet confirmed the exact location of every service. Where data is transferred outside the EEA, it should be protected by an EU adequacy decision (such as the EU–US Data Privacy Framework, for certified companies) or by the European Commission’s standard contractual clauses. You can email us to ask for more detail about the safeguards that apply.

How long we keep it

• Account, Terms agreement, learning progress and certificate details: kept while your account exists, so your access and progress are there when you return. Our rule is to keep an account for 12 months after the later of the end of your access or your last use of it (signing in, or saving or completing a lesson), and to email you at least 30 days before it is deleted. The warning emails and automatic deletion are not running yet, so no account is currently deleted automatically; we will update this notice when they start. You can ask us to delete your account at any time.
• Access, purchase, refund and offer records: kept for as long as needed to provide your access, handle refunds and disputes, enforce offer limits and meet tax and accounting obligations. They may be kept for those purposes after an account is deleted, linked only to an account ID.
• Promo code checks: signed-out records are removed after about a day; signed-in attempts are kept with your account.
• Messages you send us by email or the contact form: as long as needed to deal with your request and any follow-up. Contact form rate-limit records are removed after about a day.
• Backups and hosting logs: kept by our hosting provider for its own limited periods, which we have not yet confirmed in detail.

Signing out removes your learning progress and sign-in from that browser; it does not delete your account. Cookies & storage explains what is kept in your browser.

Your rights

You have the right to ask for a copy of your personal data, to have it corrected, to have it deleted, to restrict how it is used, to object to uses based on legitimate interests, and to receive data you gave us in a portable format. Some rights depend on the circumstances. To use any of them, email firstshiftireland@gmail.com from the address you sign in with. We will reply within one month, or tell you within that month if we need longer and why.

You can also complain to the Data Protection Commission, Ireland’s data protection regulator. We would appreciate the chance to sort out your concern first.

Changes to this notice

We will update this notice when how we use personal data changes, and show the new effective date at the top.