1. Who we are
This Privacy Policy explains how CourseHire, operated by CourseHire, to be incorporated as Coursehire Limited (pending CRO approval) (“we”, “us”), collects, uses, and protects your personal data. We are the data controller for the personal data described below. We have not appointed a data protection officer; privacy questions and requests go to info@coursehire.com. This policy applies to the CourseHire website and to the CourseHire Android app, which opens the website in your phone's browser and collects nothing of its own.
2. What data we collect
- Account data: name (required), email, username, role (Learner/Job Seeker, Tutor, University, Employer, Government, Organisation), country, bio, website, and profile photo (stored with our file storage provider, and public on the profile of Tutor, University, Employer, Government, and Organisation accounts) — either entered by you or provided by Google if you sign in that way. We also record whether, and when, your email address was confirmed
- Email confirmation data: when you confirm your login email or a profile contact email, we send a one-time link and 6-digit code to that address. We store only scrambled (hashed) versions of the link and code, the address being confirmed, a failed-attempt count, an expiry time (30 minutes), and when we last sent you one, so we can limit how often emails are sent. Once a code is used, replaced, or expired it is of no further use and is removed
- Address and tax details (private): every account gives a postal address (street address, city, postcode, and country), and may add a tax number (such as a VAT, GST, or TIN number). We use them for tax records, invoices, working out the tax due on a purchase, and legal reporting duties. Only you can see them: they never appear on a profile, in search, or in any list another user or an administrator can browse. We share them with Stripe to calculate tax, and with a tax authority when the law requires it
- Authentication data: a securely hashed password (for email/password accounts) or an authentication token from Google (for Google sign-in) — we never see or store your Google password
- Payment data: payments are not open yet, so none has been collected. Once they open, we do not store your card details. Payments are handled entirely by Stripe; we store only the resulting transaction record (amount, a payment reference ID, and whether the payment was later refunded or disputed)
- Identity verification data: if you complete certificate verification, your government ID and a selfie are collected and processed directly by Stripe Identity. We store only the verification outcome (verified / not verified), not the documents themselves
- Learner profile details: city, phone number, an optional contact email, an uploaded CV file (PDF or Word), and up to three education entries and four skills, all optional and private by default. Individual tutors can add the same education and skills; these appear on their public tutor profile. Phone numbers are not currently shown to anyone other than the person who entered them. A contact email is only ever shown after you have confirmed it. For the other details, you choose whether they are visible to employers reviewing your job applications (Hidden, or Employers only) from a setting on your profile. Your CV is stored securely with our file storage provider, Vercel Blob, and is never publicly downloadable — every download checks your visibility setting and the requester's role first
- Organisation profile details: for Tutor, University, Employer, Government, and Organisation accounts — an “about us” description, country and city, (for accounts other than Individual Tutors) a full street address, a social media profile link, and a public contact email (shown only after you have confirmed you can read mail at that address). Unlike the learner details above, this information is shown publicly on the account's profile page by design, so that learners and other visitors can find and contact you, and the account can be found through the Platform's search bar. If you add a phone number, it is visible only to you for now and is not shown on the public profile. For University, Employer, Government, and Organisation accounts we also record whether an administrator has approved a verified badge, and when
- Learning data: enrollments, lecture progress, quiz attempts and scores, issued certificates, and the ratings you give to courses you are enrolled in (an overall score and up to three optional scores from 1 to 5). A rating is stored against your account so that you can change or remove it and so that each learner can rate a course only once, but it is shown publicly only as part of the course's averages and count. Your name is never shown with a rating. If we remove a rating for breaking our rules, we keep it, with the reason, a note, the date, and who removed it, so the same rating can't simply be submitted again. We also record how much of a course you have completed, which decides whether you can rate it
- Course content you upload: if you are a Provider, the course details, lecture videos, quizzes, and materials you publish. Lecture videos are stored with Vercel Blob and are streamed only to learners enrolled in that course and to you. We also record which lectures each learner has watched through, so that the watch-through lock works
- Following: who you follow and who follows you. Follower and following lists are shown on public profiles
- Messages to us: when you email info@coursehire.com(including to say you are interested in learner sponsorship), we keep your email address and what you tell us so we can reply and keep a record of the conversation
- Jobs data: job postings you create, applications you submit (including any CV file, resume link or cover letter you provide; a CV sent with an application is kept in private storage and can be opened only by the employer who posted that job), and your results on a job's skills checks if the Provider added any: for a multiple-choice quiz, your score and pass/fail; for a task-based work sample, the link you submit, your confirmation that it is your own work, and the Provider's pass/fail decision
- Invite-only course lists: when a course provider makes a course invite-only, it can list email addresses of the people who may take it. We store those addresses and the date we emailed an invitation (we send one invitation per address, with a link to the course). The provider can see the name, email address, lesson progress, exam result and certificate status of people who take that course, and we show this only to that provider. If you are on such a list and don't want to be, ignore the invitation and email us, and we will remove the address
- Employer activity record: for accounts that post jobs, we record when they first answer each application (when it is moved out of “submitted”), when they close or renew a listing, and when they were last active, and we work out their reply rate, usual reply time, share of past listings that ended in a hire, and usual time to close. Signed-in users see these totals on that employer's job listings. The totals show nothing about individual applicants
- Trial-to-hire data (Ireland-based employers and workers only, once this feature opens): if a trial placement is offered and accepted, we record the role, work location, daily wage, dates, the employer's minimum-wage attestation, both parties' acceptance of the generated trial agreement and its timestamps, the employer's end-of-trial attendance confirmation, the resulting hire/no-hire decision, and the Stripe payment and transfer records for the wage and platform fee
- Sponsorship records: when a Provider pays to sponsor a course or job, we record which item, the amount, how long the sponsorship runs, and the Stripe payment reference
- Terms and marketing consent: the date you accepted our Terms of Service, and whether — and when — you opted in to marketing emails. Every account also gets a unique unsubscribe token, generated whether or not you've opted in, so an unsubscribe link is always ready to work
- Upload and moderation records: for every course and lecture, who created or uploaded it and when, plus their confirmation that they held the rights or a licence to publish it. If a strike is issued against an account, we record the reason, who issued it, and when. If a strike is successfully appealed, we also record that it was overturned, by whom, when, and why
- Email abuse-prevention records: each time we send a verification email, we note the address it went to and a scrambled (hashed) version of the network address that asked for it, so we can stop one person requesting emails over and over, including to other people's addresses. We never store the network address itself in these records
- Technical data: standard web server logs (such as IP address, browser type, and the pages requested) generated by our hosting provider, kept for security and to keep the Platform running
- Anonymous usage counts: we use Vercel Web Analytics to count visits and clicks, such as which pages are viewed, the country and type of device, and whether a sign-up or application was started. It does not use cookies, does not follow you from one site to another, and does not store your name, email address or account details. We do not use advertising trackers
3. Why we process this data
We only use personal data when we have a legal basis under GDPR, and these are the ones we rely on:
- To perform our contract with you — creating your account, running courses, processing payments, issuing certificates, and operating the jobs board. This includes showing public profiles and course averages, hosting lecture videos, and marking a job's multiple-choice skills check automatically against the pass mark the Provider set. That marking is a result the Provider uses; the hiring decision is always made by a person at the Provider, not by us
- Legitimate interests — preventing fraud, impersonation, and abuse (including confirming that email addresses belong to the people using them, limiting repeated email requests, and spotting duplicate, refunded, or disputed payments) and keeping the Platform secure, and keeping moderation records (strikes, removed ratings) so we can enforce our Terms, and understanding in aggregate how the Platform is used so we can improve it (the anonymous usage counts above). You can object to processing based on legitimate interests at any time (see Your rights)
- Legal obligation — keeping financial records required for tax and accounting purposes, and reporting seller income to tax authorities where the law requires it (for example under the EU's DAC7 rules)
- Consent — where we ask for it separately, such as for optional marketing communications
4. Who we share data with
We share data with the following processors, only as needed to run the Platform:
- Stripe — payment processing (including sponsorship purchases), tax calculation, Connect payouts to Providers, trial-to-hire wage transfers to workers, and identity verification
- Resend — sending our emails, such as email confirmation codes and links. It receives the recipient's email address, the name used in the greeting, and the content of the message
- Daily.co — live video sessions
- Vercel — hosting, anonymous visit counts (Vercel Web Analytics), and Vercel Blob storage for uploaded CV files, profile photos, and lecture videos
- Google — only if you choose to sign in with Google
- Our hosting and database providers — to run and store the Platform's infrastructure
- Course and job Providers — purpose limited: a course Provider only sees learners enrolled in that specific course, and an employer only sees applications submitted to that specific job listing, or trial agreement data for a trial they specifically offered that worker. We don't share your enrollment, application, or trial data with other Providers, other employers, or publicly. (This is separate from an organisation's own public profile details, described above, which that organisation has chosen to publish.)
We may also disclose data to a tax authority, regulator, court, or the police where the law requires it, and to our professional advisers (such as lawyers and accountants) under a duty of confidentiality. If the business is sold or merged, personal data may pass to the new owner, who must keep using it in line with this policy.
We do not sell your personal data.
5. International data transfers
Some of our processors (including Stripe, Vercel, Resend, Daily.co, and Google) may process data outside the European Economic Area, including in the United States. Where this happens, we rely on appropriate safeguards such as the EU–US Data Privacy Framework (where the processor is certified), Standard Contractual Clauses, or another applicable adequacy decision. You can ask us for a copy of the safeguards that apply.
6. Data retention
We keep your data for as long as your account is active. If you delete your account, we delete or anonymise your personal data within 30 days of your request, except where we're required to keep records for longer. In particular we keep financial and tax records (invoices, payment references, tax numbers on them) for the period the law requires, which in Ireland is generally six years. You can ask us to close your account and delete your data by emailing info@coursehire.com from the address on the account. Accounts that are never confirmed may be removed. Web server logs are kept only for a short period set by our hosting provider.
One-time email confirmation codes and links are kept only as scrambled (hashed) values and stop working after 30 minutes, once used, or once replaced by a newer one. The abuse-prevention records of verification emails sent (the address and the scrambled network address) are deleted after 24 hours.
Upload records (who created or uploaded a piece of content, and when) and moderation records (strikes issued, by whom, and why) are an exception: we retain these for as long as needed to resolve a dispute that has been raised over that content, and for a reasonable period afterwards in case it re-escalates — even if the content itself has since been removed or the account deleted. This is necessary to operate our repeat-infringer policy.
7. Marketing communications
Marketing emails require your explicit, separate opt-in — a dedicated checkbox at signup, unticked by default. We never treat agreeing to our Terms or creating an account as consent to marketing. If you opt in, we record the time you did so; this is our record of consent under GDPR.
Every marketing email we send includes a one-click unsubscribe link tied to a unique token on your account, so you can withdraw consent at any time without needing to sign in. Withdrawing consent does not affect essential account or transactional emails (such as receipts, security notices, password resets, or email confirmation codes), which aren't marketing and don't require opt-in.
8. Your rights
Under GDPR, you have the right to the following. We will reply within one month, and we may need to confirm it is you first. There is no charge unless a request is clearly unfounded or excessive.
- Access the personal data we hold about you
- Correct inaccurate data
- Request deletion of your data
- Restrict or object to certain processing
- Receive your data in a portable format
- Withdraw consent at any time, where processing is based on consent
- Ask that a decision about you is not based only on automated processing. We do not make decisions about you that have legal or similarly significant effects by automated means alone
- Lodge a complaint with your national data protection authority — in Ireland, the Data Protection Commission
To exercise any of these rights, contact us at info@coursehire.com.
9. Cookies
We use a session cookie to keep you signed in. These cookies are strictly necessary for the Platform to work, so we do not ask for consent for them. We do not use advertising or tracking cookies. Our visit counts (see “Anonymous usage counts” above) work without cookies. If Google sign-in or Stripe checkout is used, those services may set their own cookies on their own pages, under their own policies.
10. Children's privacy
The Platform is not directed at children under 16, and you must be at least 16 to hold an account. If you believe a child has provided us with personal data without appropriate consent, contact us and we will remove it.
11. Security
We use reasonable technical and organisational measures to protect your data, including encrypted connections, secure password storage, and confirming that email addresses belong to the people using them. No online service can guarantee complete security, so we encourage you to use a strong, unique password. If a personal data breach puts your rights at risk, we will tell the Data Protection Commission within 72 hours where required and tell you without undue delay where the risk to you is high.
12. Changes to this policy
We may update this Privacy Policy from time to time. We'll post the updated version here with a new “last updated” date and, for a material change, tell signed-in users by email or a notice on the Platform.
13. Contact
Questions about this Privacy Policy or your data can be sent to info@coursehire.com.