CourseKit is operated by Better Brain Lab LLC, registered under 2024-001449211 at 30 N Gould Street, Sheridan, WY 82801, United States.
For individuals in the European Union or European Economic Area, our representative under Article 27 of the GDPR is Mohamed Mashhour, Paxlaan 10, 2131 PZ Hoofddorp, Noord-Holland, Netherlands. You may contact the representative on privacy matters, or reach us directly using the details below.
Contact us about privacy at privacy@coursekit.cloud. General support is available at support@coursekit.cloud.
For staff accounts, subscriptions, service security, product administration, and direct support interactions, Better Brain Lab LLC determines the purpose and means of processing and acts as controller.
For learner records, course content, enrollments, progress, submissions, messages, certificates, and school-managed sales records, the school normally determines why the data is processed. The school is controller and CourseKit is its processor. If you are a learner, contact your school first; we will assist it with a verified request.
| Category | Examples | Primary purpose |
|---|---|---|
| Staff and school account | Name, email, role, authentication factors, school settings | Provide and secure the service; administer the contract |
| Learner identity and learning | Name, email, enrollment, progress, submissions, quiz results, messages, certificates | Deliver the school’s learning experience on its instructions |
| Course and uploaded content | Text, images, files, video, comments, live-session details | Host and publish customer-selected content |
| Commerce | Buyer snapshot, order, refund, receipt, currency, provider identifiers | Complete purchases, accounting, fraud prevention, and legal recordkeeping |
| Technical and security | IP address, browser, request time, authentication and audit events, scrubbed error diagnostics | Operate, diagnose, protect, and improve CourseKit |
| Support | Contact details, correspondence, attachments, and resolution notes | Respond to requests and maintain service history |
We receive data from staff and learners directly, from the school that created or imported a record, and from connected providers such as Stripe, Webflow, Zoom, Bunny.net, and email delivery services. We do not buy personal-data lists or sell personal data.
The CourseKit dashboard and secure setup flows use essential session and request-protection cookies. In the staff dashboard we also use first-party PostHog product analytics and session replay to understand and improve how account owners and staff use CourseKit; sensitive inputs (such as passwords and payment fields) are masked, and none of this is used for advertising or shared with advertising networks. The learner runtime remains privacy-limited: it uses school-scoped browser storage to keep a learner signed in and rotates that credential as the session is refreshed, with learner autocapture, page-view profiling, session replay, surveys, and advertising tracking disabled.
We do not use third-party advertising or cross-site tracking cookies. Where a cookie banner or preference control is shown, you can accept or decline non-essential analytics; essential cookies are always required to operate the service. We may also send account owners occasional product and service updates, from which they can opt out at any time.
Where CourseKit acts as controller, we process data when necessary to:
Where CourseKit acts as processor, the school supplies the lawful basis and documented instructions. CourseKit does not use school learner content for advertising or to train general-purpose artificial-intelligence models.
Account identity, authentication, school ownership, and billing details marked as required are needed to create and secure an account or provide a paid plan. Without them, we cannot open the account, complete the requested transaction, or provide the affected service. Optional profile, branding, integration, and course fields can be left blank or disconnected.
CourseKit does not make solely automated decisions in its controller role that produce legal or similarly significant effects for a person. Schools remain responsible for any rules or decisions they apply to learners using exported results or configured course progression.
We host and process personal data in the United States for schools we onboard as U.S.-based, and in the European Union (the Netherlands) for schools we onboard as EU-based, so that EU personal data can be kept in the EU. Some providers operate internationally. When personal data is transferred to a country without an applicable adequacy decision, we use an appropriate transfer mechanism such as Standard Contractual Clauses, alongside technical and organisational safeguards where required. Email privacy@coursekit.cloud to ask which region and safeguard apply to your data and, where available, obtain a copy of it.
The purge removes learner identity and customer content while retaining only the minimum anonymised financial and audit evidence required for legal, accounting, fraud-prevention, or dispute purposes. Read the complete deletion process.
CourseKit uses role-based tenant isolation, multi-factor authentication for staff, encrypted provider credentials, expiring signed downloads, audit trails, transport encryption, secret scrubbing, dependency and application testing, and monitored operational controls. No service can promise absolute security. Please use the coordinated disclosure route if you find a weakness.
Depending on your location and the circumstances, you may have rights to information, access, correction, erasure, restriction, objection, portability, withdrawal of consent, and a review of certain solely automated decisions. Rights are not absolute; for example, a verified legal obligation can require limited records to remain.
Email privacy@coursekit.cloud. We may ask for proportionate identity verification. If CourseKit is processor, we will route the request to the relevant school and assist it. We aim to respond without undue delay and within the period required by applicable law.
You may also complain to Federal Trade Commission or your local data-protection authority.
If you are a resident of California or another U.S. state with a consumer-privacy law, you may have rights to know, access, correct, delete, and obtain a portable copy of your personal information, and to appeal a decision on your request. We do not sell personal information and do not share it for cross-context behavioural advertising, so there is no “sale” or “sharing” to opt out of. We will not discriminate against you for exercising these rights. Where CourseKit acts as a service provider or processor to a school, we handle these requests on the school’s instructions and route them accordingly. To exercise a right, email privacy@coursekit.cloud; an authorised agent may submit a request with proof of authorisation.
Schools decide who may use their learning experience and are responsible for any notices, permissions, parental consent, or other lawful basis required for younger learners. Where a school enrols learners who are children — including learners under 13 in the United States (COPPA) or under the applicable age of digital consent elsewhere — the school is the controller of that data and is responsible for obtaining verifiable parental consent. CourseKit processes such data only on the school’s documented instructions and does not knowingly create learner accounts, or collect children’s personal information, independently of a school. If you believe a child’s data has been provided without appropriate consent, contact privacy@coursekit.cloud and we will assist the relevant school to address it.
We version this policy and will give customers reasonable notice of material changes through the dashboard or account email when appropriate. Questions and requests should be sent to privacy@coursekit.cloud.