Privacy Policy

This policy explains what personal information Capital Academy collects, why we collect it, who we share it with, and the rights you have over it, including how your conversations with CAPA are handled.

Effective: 1 August 2026Last updated: 1 August 2026

Language

This document is published in several languages for your convenience. The English version is the legally binding version. Where a translation differs from the English text, the English text prevails.

1. Introduction and who we are

Capital Academy is committed to protecting the privacy, confidentiality and security of personal information. This Privacy Policy explains how we collect, use, store, share, transfer and protect personal information when you interact with our website, learning platform, CAPA AI services, assessments, certifications, support channels and events (together, the "Services").

The controller of your personal information is Capital Academy Tech Ltd., a company incorporated in the Dubai International Financial Centre (DIFC), Dubai, United Arab Emirates, under DIFC Licence No. CL9551, with its registered office at Gate Avenue, Level 1, DIFC, Dubai, UAE ("Capital Academy", "we", "us", "our").

We process personal information in accordance with the DIFC Data Protection Law, and, where they apply to a particular individual or activity, the EU General Data Protection Regulation (GDPR), the UK GDPR, the UAE Personal Data Protection Law and other applicable privacy legislation.

This policy should be read together with our Learner Terms of Service, Website Terms of Use, Cookie Policy and AI Usage and Responsible Use Policy. Where a separate privacy notice is provided for a specific service, that notice prevails to the extent of any inconsistency.

2. Who this policy covers

This policy applies whenever we process personal information relating to:

visitors to capitalacademy.ai
registered learners and prospective learners
learners whose access is provided through an employer, university or other organisation
team owners and administrators of team plans
experts, instructors, guest speakers and contributors
Influence Network participants
event, webinar and podcast participants
newsletter subscribers and people who contact our support team

It applies whether we collect information directly from you, automatically through technology, or from an authorised third party such as your employer, university or our identity verification provider.

3. What we collect

The categories of personal information we hold depend on how you use the Services.

Identity and profile: Your name, email address, country, preferred language, profile photograph if you upload one, professional title, and, where a programme requires it, date of birth and government-issued identity details.
Account and security: Username, a cryptographically hashed password (never stored in readable form), account and subscription status, registration date, sign-in and token-refresh records, and a device fingerprint used to bind protected media to your session.
Learning records: Classes, bundles and certifications you are enrolled in, lesson and chapter progress, video/book/podcast completion, quiz and flashcard activity, assignment submissions, exam attempts and scores, certificates and digital credentials, and CPD learning hours where applicable.
CAPA and AI interactions: The questions and prompts you send to CAPA, its responses, your conversation history within a class, voice audio where you use voice tutoring, avatar session metadata, feedback you give on AI answers, and per-modality usage counts used to apply fair-use allowances.
Payment records: Transaction references, payment status, billing details, invoices, purchase and renewal history, and tax information where required. We never receive or store your full card number or card authentication credentials. Those go directly to our payment provider.
Technical data: IP address, browser and device type, operating system, language and time-zone settings, referring page, session identifiers, and error and security logs.
Usage data: Pages and features viewed, search queries, navigation paths, session duration and content engagement.
Communications: Support requests, contact and enterprise enquiry forms, feedback and course reviews, appeals, survey responses, and event or webinar registrations.
Organisation data: Where your access comes through a team or organisation: the organisation name, your seat assignment, role, and the enrolment, progress and certification reports made available to authorised administrators.

Please do not enter sensitive personal information, confidential employer information, credentials or payment details into CAPA or into free-text fields. We do not need it, and the Services are not designed to receive it.

4. How we collect it

4.1 Directly from you

When you create an account, enrol in a class, buy a plan or add-on, sit an assessment, use CAPA, contact support, register for an event, subscribe to updates, or apply to join our Influence Network.

4.2 Automatically

Through cookies and similar technologies, server and security logs, and session technologies. Non-essential technologies are used only with your consent where the law requires it. See our Cookie Policy.

4.3 From third parties

From employers, universities and other organisations that provide your access; from our identity verification and payment providers; and from partner institutions in connection with co-issued certifications.

4.4 Generated as you learn

Progress records, assessment results, credential records, AI interaction history, learning analytics and system activity logs are created as a by-product of delivering the Services.

5. How we use your information

We use personal information to:

create and administer your account and authenticate you
deliver classes, bundles, certifications and learning content
run CAPA and other AI-supported learning features, and apply fair-use allowances
administer assessments and final exams and protect their integrity
verify identity where a programme or credential requires it
issue, correct, replace and verify certificates and digital credentials
take payment, manage subscriptions, add-ons and renewals, and issue invoices
provide support and respond to enquiries, appeals and complaints
personalise recommendations and your dashboard
protect the security of the platform, prevent fraud and investigate misuse or academic misconduct
improve our content, platform and AI systems
send service messages, and marketing where permitted or with your consent
comply with legal, tax, accounting and accreditation obligations, and establish or defend legal claims

We do not sell your personal information, and we do not use it for third-party advertising.

6. Our legal bases

Where the DIFC Data Protection Law, the GDPR, the UK GDPR or similar legislation applies, we rely on one or more of the following.

Performance of a contract: Creating your account, delivering the classes and features you purchased, running CAPA within your entitlements, administering exams, issuing certificates, taking payment and providing support.
Legitimate interests: Securing the platform, preventing fraud and account sharing, protecting academic integrity and the value of our credentials, improving our content and AI systems, service analytics, and defending legal claims. We balance these against your rights each time we rely on them.
Legal obligation: Tax, accounting and financial reporting duties, responding to lawful requests from competent authorities, and accreditation record-keeping.
Consent: Non-essential cookies, marketing communications, biometric identity checks where consent is required, and optional surveys or research. You can withdraw consent at any time; withdrawal does not affect processing already carried out.

7. CAPA and AI processing

CAPA runs on infrastructure Capital Academy operates. Your conversations are not sent to a third-party general-purpose AI vendor, and they are not used to train anyone else's model.

7.1 What we process

When you use CAPA (as text chat, voice tutoring or the AI instructor avatar), we process your prompts and questions, CAPA's responses, the class context you are studying in, your conversation history, voice audio for the duration of a voice session, and per-modality usage counters that enforce your allowance.

7.2 Why we keep conversations

We retain conversation history so CAPA can follow the thread within a class, so you can return to earlier sessions, and so we can operate, secure, moderate and improve the service. Conversation records may also be reviewed where reasonably necessary for support, quality assurance, security investigations, academic integrity investigations or legal compliance. Access is restricted to authorised personnel.

7.3 Model improvement

We may use interaction data to improve our own educational AI, applying aggregation, anonymisation or pseudonymisation where appropriate. We do not use your content to train third-party general-purpose AI models.

7.4 Human oversight

We do not use AI to make solely automated decisions that produce legal or similarly significant effects about you without appropriate human involvement. Decisions that matter (exam results, certificate issuance, academic misconduct findings, account termination) are reviewed by people.

7.5 Transparency

Where you are interacting with AI rather than a person, we tell you, unless it is already obvious from the context. AI-generated study aids are labelled as such.

8. Cookies and similar technologies

We use a small number of cookies to keep you signed in, remember your language, attribute partner referrals and keep the platform secure. We do not use advertising cookies or third-party marketing trackers.

Our Cookie Policy lists each cookie, what it does and how long it lasts, and explains how to change your choices.

10. International transfers

We operate internationally and our providers may process personal information outside your country of residence, including outside the DIFC, the UAE, the UK and the EEA.

Where a transfer requires a safeguard under applicable law, we put one in place (an adequacy decision, Standard Contractual Clauses, the UK International Data Transfer Agreement, or another lawful mechanism), and we assess whether supplementary measures are needed so that transferred information keeps a level of protection consistent with the law that applies to you.

You may request information about the safeguards applied to a specific transfer using the contact details in this policy.

11. How long we keep it

We keep personal information only for as long as it is needed for the purposes described here, then delete, anonymise or securely dispose of it.

Account and profile: For as long as your account is open, and for a limited period afterwards to handle disputes, chargebacks and legal claims.
Learning and assessment records: Retained after account closure where necessary to verify a credential you earned, maintain academic integrity and satisfy accreditation obligations.
Certificates and verification records: Retained for as long as the credential needs to remain verifiable. Records showing that a credential was revoked are retained to protect the integrity of our certification system.
CAPA conversations: Retained to provide continuity and for the operational purposes in section 7, then deleted or anonymised. You can ask us to delete your conversation history.
Payment and tax records: Retained for the periods required by tax, accounting and financial-reporting law.
Security and technical logs: Retained for a limited period for security monitoring, incident investigation and fault diagnosis.
Backups: Information deleted from live systems may persist in encrypted backups for a limited period before being overwritten. Backups are used only for disaster recovery and restoration.

12. How we protect it

We apply administrative, technical and organisational safeguards designed to protect personal information against loss, misuse and unauthorised access, disclosure or alteration. These include encryption in transit, encryption at rest where appropriate, password hashing, short-lived access tokens with rotation, role-based and least-privilege access controls, security logging and monitoring, signed media tokens for protected content, vulnerability management, and secure development practices.

Access to personal information is limited to authorised personnel who need it for their role and who are bound by confidentiality obligations.

If we become aware of a security incident affecting personal information, we will investigate promptly, contain it, assess the impact, and notify affected individuals and the competent supervisory authority where the law requires it. No online service can guarantee absolute security. Please protect your own credentials and tell us immediately if you suspect unauthorised access to your account.

13. Learning analytics

We analyse learning activity (enrolments, lesson completion, assessment performance, engagement with resources, CAPA interactions and study patterns) to improve educational quality, personalise recommendations and dashboards, support learner success and evaluate how well our programmes work.

Learning analytics are designed to support education. They are not used to profile you for employment, credit, insurance or other unrelated purposes. Where we use analytics for research, curriculum development or statistical reporting, we work with aggregated or anonymised information wherever practicable.

14. Certificates and credential verification

To let employers, universities and regulators confirm a credential is genuine, we operate a verification service. It processes only what is needed to confirm authenticity: the holder's name, the class or certification title, completion and issue dates, a unique certificate number, and the credential's validity status.

Verification confirms only that a credential was issued by Capital Academy, remains valid and has not been revoked. It must not be used to harvest data, build databases or create commercial directories of learners.

Where a credential is anchored to a public blockchain, the verification record is designed to be tamper-evident and permanent, and may not be capable of deletion. We publish only the minimum information necessary to verify it. You can ask us to mark a credential as revoked, but the underlying record may persist.

15. Marketing

Where permitted by law or where you have consented, we may send you educational updates, new class and certification announcements, event and webinar invitations, and promotional offers.

You can opt out at any time using the unsubscribe link in any marketing email, by updating your communication preferences in your account, or by contacting us. Opting out of marketing does not stop service messages we need to send you: account and security notifications, payment and renewal notices, certificate issuance, exam information and replies to your enquiries.

16. Your rights

Depending on where you live and the circumstances of the processing, you may have the right to:

access the personal information we hold about you and receive a copy
have inaccurate or incomplete information corrected
have information erased where it is no longer needed or where you withdraw consent and no other basis applies
restrict processing while an issue is being resolved
receive certain information in a portable, machine-readable format and ask us to transmit it where technically feasible
object to processing based on our legitimate interests
withdraw consent at any time where processing is based on consent
not be subject to a solely automated decision with legal or similarly significant effects
lodge a complaint with your supervisory authority: for DIFC-related processing, the DIFC Commissioner of Data Protection

16.1 Limits on erasure and correction

These rights are not absolute. We may keep information where we must comply with a legal obligation, maintain the integrity of an issued credential or examination record, protect academic integrity, secure the platform, or establish or defend legal claims. Corrections to a name on an issued certificate require supporting documentation.

16.2 Making a request

Contact us using the details in section 20. We may ask for information to verify your identity before we respond. This protects your information from unauthorised disclosure. We will respond within the period required by applicable law, and we encourage you to come to us first so we can put things right.

17. Children and young learners

Our general Services are intended for people who have reached the age of majority in their jurisdiction. We do not knowingly collect personal information from children outside a designated youth programme.

Where we run a youth programme, we apply additional safeguards: verified parental or guardian consent where the law requires it, or enrolment through an authorised school or institution; age-appropriate privacy practices; restricted features; and data collection limited to the educational purpose.

Parents and guardians may contact us about information processed in connection with an authorised youth programme, subject to verification. If you believe a child has given us information without the necessary consent, contact us and we will delete it.

18. Third-party sites and services

Our Services link to and embed third-party content and services. Those providers have their own privacy notices, which we do not control. We encourage you to read them before providing personal information.

We select providers with care and, where they process personal information on our behalf, require contractual commitments on security, confidentiality and lawful processing.

19. Changes to this policy

We may update this Privacy Policy to reflect changes in law or regulatory guidance, new services or AI capabilities, changes to our providers, security improvements or business developments.

The current version is always published on this page with its effective date. Where a change materially affects your rights, we will give reasonable notice, by email or an in-platform notice, before it takes effect, and we will obtain your consent where the law requires it.

20. Contact us

For any question or request about this policy or about how we handle your personal information, contact us. We may ask for information to verify your identity before discussing your account.

Privacy requests and general enquiries: support@capitalacademy.ai
Controller: Capital Academy Tech Ltd., Gate Avenue, Level 1, Dubai International Financial Centre, Dubai, United Arab Emirates
DIFC Licence No.: CL9551

If we appoint a Data Protection Officer or another designated privacy contact where the law requires one, their details will be published here.

Related policies

These documents form part of the Capital Academy legal framework and should be read together.