Privacy policy

1. Who we are

CloudIskole(“we”, “us”) operates an online learning platform for students in Sri Lanka. This policy explains what personal information we handle and why. You can reach us at admin@cloudiskole.lk.

2. Information we collect

Information you give us

• Account details - your name, email address and mobile number when you register.
• Profile details - optional information such as your profile photo.
• Payment records - for bank transfers, the deposit slip you upload and the reference number issued to you. We do not collect or store card numbers; when card payments are introduced they will be handled entirely by a licensed payment provider.
• Messages - anything you send us through the contact form or by email.

Information created as you learn

• Courses you enrol in and lessons you complete.
• Quiz and exam attempts, answers and marks.
• Sessions you register for and attend.
• CloudCoins and streaks earned.

Information collected automatically

• Basic technical data such as IP address, browser type and pages visited, used to keep the service secure and working.
• Security and audit records of significant actions on your account, such as sign-ins and payment approvals.

3. How we use your information

• To create and operate your account and deliver the courses you enrol in.
• To record your progress, marks and leaderboard position.
• To send you service messages by email - registration confirmations, enrolment confirmations, payment updates and session reminders.
• To verify and record payments, and to resolve payment disputes.
• To prevent fraud, abuse and unauthorised access.
• To improve our courses and the platform.

We do not sell your personal information, and we do not share it with advertisers.

4. Your choices

• Leaderboard visibility - appearing on the public leaderboard is optional and off unless you choose it. You can change this at any time in your profile.
• Marketing messages - you may opt out at any time. Essential service messages about your account, enrolments and payments will still be sent.
• Access, correction and deletion - you may request a copy of your data, ask us to correct it, or ask us to delete your account by writing to admin@cloudiskole.lk.

Where we must keep records to meet financial or legal obligations - payment and audit records in particular - we will retain those even after an account is closed, and will tell you when this applies.

5. Sharing with service providers

We rely on a small number of providers to run the service. Each receives only the data needed for its function:

• Supabase - database, authentication and file storage.
• Google Cloud - website hosting and delivery.
• Google - if you choose to sign in with a Google account.
• Resend - sending transactional email.
• Cloudinary - hosting and delivering course images and video.
• YouTube - hosting and playing course videos.
• Upstash - rate limiting to prevent abuse, which processes your IP address.

We do not currently send SMS messages - if we introduce that, this section will be updated to name the provider before it goes live.

Some of these providers store data on servers outside Sri Lanka. We choose providers that apply recognised security standards.

6. How we protect your information

• All traffic to and from the site is encrypted in transit (HTTPS).
• Access to your records is enforced at the database level, so one student cannot read another student’s data.
• Payment slips and course materials are stored in private storage reachable only through short-lived, access-checked links.
• Payment and administrative actions are written to an append-only audit log that cannot be edited or deleted after the fact.

No system is perfectly secure. If a breach affects your personal information, we will notify you without undue delay.

7. Cookies

We use cookies that are strictly necessary to run the service - principally to keep you signed in and to protect against cross-site request forgery. We do not use advertising or cross-site tracking cookies. Blocking essential cookies will prevent you from signing in.

8. Children

The platform is intended for students who have completed their G.C.E. Advanced Level examinations, and is not directed at children under 16. If you believe a child under 16 has registered, contact us and we will remove the account.

9. Changes to this policy

We may update this policy as the service develops. The date at the top of this page always reflects the current version, and we will notify registered users by email of any material change.

10. Contact

Questions about this policy or your data can be sent to admin@cloudiskole.lk, or through our contact page.