Privacy Policy
What we collect, why we collect it, how long we keep it and who else sees it.
Last updated 25 August 2026
What this covers
Draft for review
This policy explains what we collect when you use TheCGMPAcademy.com, why we collect it, how long we keep it and who else sees it. It applies to visitors, trial users, subscribers and the trainers and QA reviewers who counter-sign a training record.
The data controller is J&J Compliance Consulting Group, registered address required.
What we collect
Account data. Your name, work email, company, job title, the industry track you register under and, if you provide one, your supervisor or manager email for optional result delivery.
Learning data. Which packages you open, how much of each video you have watched, your assessment attempts and scores, the questions you ask the AI tutor, and the documents you download. This is what makes a training record mean something, and it is also what an investigator expects the record to be backed by.
Compliance evidence. When you buy something we record your acceptance of the terms, with a timestamp, IP address and the version of the terms you accepted. On orders above the signature threshold we also store the typed name you signed with. This exists so that a payment dispute can be answered accurately.
Payment data. Handled by Stripe. We receive a customer reference, a payment method reference, the last four digits and the outcome. We never receive or store your full card number, and card details never pass through our servers, database or logs.
Technical data. IP address, browser and device, and access logs for protected content. Video playback is watermarked with your name and email to deter and trace unauthorised capture.
Why we collect it
- To create and secure your account, and to enforce which content it may reach.
- To deliver training and to generate the training records that evidence completion.
- To take payment, issue invoices and manage subscriptions.
- To answer payment disputes with an accurate record of what was bought, agreed and accessed.
- To send transactional email: verification, receipts, signing requests and results.
- To review the quality of AI tutor answers and improve the teaching.
How long we keep it
Training records are compliance evidence and are retained permanently unless you ask us to delete them. They stay available to you even if your subscription lapses, and stay exportable for 90 days after access ends.
Payment and dispute evidence is retained as long as required for tax and chargeback purposes. Account data is deleted on request, subject to those obligations.
Your rights
You can access, correct, export or delete your personal data. Profile details are editable in your account; for anything else, email info@thecgmpacademy.com.
Deleting an account does not automatically delete training records where an employer holds them as compliance evidence. records deletion position to be confirmed.
How we protect it
- Everything is served over TLS. Sessions use secure, HTTP-only cookies.
- Assessment answer keys, entitlement checks and AI credentials live only on our servers and never reach the browser.
- Video is delivered as encrypted streams with short-lived, per-user tokens. There is no downloadable video file anywhere in the product.
- Downloads and signature events are logged to an append-only audit trail.
Contact
Privacy questions go to info@thecgmpacademy.com or through our contact page.