Privacy Policy
Last updated: TODO — e.g. 1 January 2027
TODO Ltd. ("LinkedStudy", "we", "us") operates linkedstudy.com and the LinkedStudy mobile applications. This policy explains what personal data we collect, why, who we share it with, and the rights you have over it.
We are the data controller for the processing described here. Contact us at [email protected].
1. An important point about communities
LinkedStudy is a hosting platform. Independent Creators run the communities on it.
- We are the controller for your account, billing, platform security and the operation of the service.
- A Creator is a separate, independent controller for the member data they see and use inside their own community, for example when they email their members, review membership applications, or export a member list.
This means a Creator's own privacy practices apply to what they do with your data. We require Creators to handle it lawfully (see our Creator Agreement), but we do not control them. If you have a concern about how a specific Creator used your data, contact them first, and tell us at [email protected] if it is not resolved.
2. What we collect
2.1 Information you give us
| Data | Examples |
|---|---|
| Account | Name, email address, password (stored hashed, never in plain text), profile handle |
| Profile | Photo, bio, location, country, level of education, occupation (if you choose to share it), time zone, social links |
| Content | Posts, comments, chat messages, uploaded files and images, course progress, quiz and assignment submissions |
| Membership | Communities you join, answers to membership questions, your role and level |
| Payments | Billing name, transaction amounts, currency, payment method type, and the last four digits of a card. We never see or store full card numbers, CVVs or mobile money PINs. Those go directly to our payment processor. |
| Support | Messages you send us and their contents |
2.2 Information we collect automatically
- Usage: pages viewed, features used, posts read, lessons completed, session times.
- Device and connection: IP address, browser and operating system, device identifiers, app version, language.
- Cookies and similar technologies: see our Cookie Policy.
- Approximate location: derived from IP address, for security, fraud prevention and currency selection. We do not collect precise GPS location unless you explicitly opt in to appear on a community map.
2.3 Information from others
- Sign-in providers such as Google: your name, email and profile picture, when you choose to sign in that way.
- Payment providers: confirmation that a payment succeeded or failed, and limited fraud signals.
3. Why we use it, and our legal basis
Where the GDPR or UK GDPR applies, we rely on these legal bases:
| Purpose | Legal basis |
|---|---|
| Create and run your account; deliver the service | Performance of a contract |
| Process payments, subscriptions and creator payouts | Performance of a contract |
| Send service emails such as receipts, password resets and security alerts | Performance of a contract |
| Keep the Platform secure; prevent fraud, spam and abuse | Legitimate interests |
| Measure and improve the Platform; fix bugs | Legitimate interests |
| Moderate content and enforce our policies | Legitimate interests; legal obligation |
| Personalise your feed, recommendations and notifications | Legitimate interests |
| Marketing emails and digests | Consent, withdrawable at any time |
| Non-essential cookies and analytics | Consent |
| Keep accounting and tax records; respond to lawful requests | Legal obligation |
Where we rely on legitimate interests, we have assessed that our interest does not override your rights. You can object, as described in section 8.
4. Automated processing and AI features
Some features process your content automatically:
- Spam, abuse and fraud detection, including rate limiting, blocked-word filters and new-account link restrictions.
- AI features such as course assistants, quiz generation and thread summaries, which send the relevant content to our AI provider to produce output.
We do not use these systems to make decisions that produce legal effects or similarly significantly affect you without human involvement. Account suspensions for serious breaches are reviewed by a person, and you may request human review of any enforcement decision at [email protected].
We do not sell your personal data, and we do not use your private content to train foundation AI models.
5. Who we share it with
5.1 Inside the Platform. Your profile, posts, comments and level are visible to other members of the communities you join, according to that community's privacy setting. Public communities may be visible to anyone, including search engines. On your public profile this includes your bio, country, level of education and occupation (if you add one).
5.2 Creators. Creators of communities you join can see your profile, your activity in their community, your membership answers and your payment status for their community.
5.3 Service providers. We use vetted providers who process data only on our instructions and under contract, for payment processing, cloud hosting and storage, email delivery, push notifications, video conferencing, and error monitoring and analytics. A current list is available on request from [email protected].
5.4 Legal and safety. We may disclose data where we reasonably believe it is required by law or necessary to protect the rights, safety or property of LinkedStudy, our users or the public. This includes reports of child sexual abuse material to the appropriate authorities, which we make without notice to the account holder.
5.5 Business transfers. If we are involved in a merger, acquisition or sale of assets, data may transfer to the acquirer, who will remain bound by this policy or give you notice of any change.
We do not sell personal data, and we do not share it for cross-context behavioural advertising.
6. International transfers
We operate from Ghana and use providers located in other countries, so your data may be transferred internationally. Where we transfer personal data out of the EEA, the UK or another jurisdiction with transfer restrictions, we rely on an adequacy decision where one exists, or otherwise on Standard Contractual Clauses together with supplementary measures. You may request a copy of the relevant safeguards from [email protected].
7. How long we keep it
| Data | Retention |
|---|---|
| Account and profile | While your account is open |
| Content you posted | While your account is open, unless you delete it sooner |
| Deleted content | Removed from the live service immediately; purged from backups within 30 days |
| Closed accounts | Personal data deleted or irreversibly anonymised within 30 days of closure |
| Payment and tax records | As required by tax and accounting law, typically 6 years |
| Security, abuse and moderation logs | Up to 12 months, to detect repeat abuse |
| Records needed for a legal claim | Until the matter is resolved and limitation periods expire |
When you close your account, posts and comments you made in a community may remain visible in an anonymised form so that conversations other members took part in stay readable. You can ask us to remove specific content instead, as described in section 8.
8. Your rights
Depending on where you live, you have some or all of these rights:
- Access — get a copy of the personal data we hold about you.
- Rectification — correct inaccurate or incomplete data.
- Erasure — have your data deleted.
- Restriction — limit how we use your data while a dispute is resolved.
- Portability — receive your data in a structured, machine-readable format, or have it sent to another provider.
- Object — object to processing based on legitimate interests, including profiling, and to direct marketing at any time.
- Withdraw consent — where we rely on consent, withdraw it at any time, without affecting earlier processing.
- Complain — lodge a complaint with your supervisory authority. In Ghana this is the Data Protection Commission; in the EU and UK it is your national data protection authority.
How to use them. Most rights are available directly in the product: Settings, Account offers data export and account deletion, and Settings, Notifications controls marketing. For anything else, email [email protected]. We respond within 30 days and will not charge you or treat you differently for exercising a right. We may need to verify your identity first.
9. If you are in California
We do not sell or share personal information as those terms are defined under the CCPA and CPRA. In the past 12 months we collected the categories described in section 2 for the purposes in section 3. You have the right to know, delete, correct, and to opt out of sale or sharing, which we do not do, and to be free from discrimination for exercising those rights. You may use an authorised agent. Submit requests to [email protected].
10. If you are in Ghana
We process personal data in accordance with the Data Protection Act, 2012 (Act 843) and are registered with the Data Protection Commission as a data controller under registration number TODO. You may contact the Commission directly if you believe your data has been mishandled.
11. Children
The Platform is not intended for anyone under 16 and we do not knowingly collect their personal data. If you believe a child under 16 has given us personal data, contact [email protected] and we will delete it and close the account.
12. Security
We protect your data with encryption in transit and at rest, password hashing with a modern algorithm, rate limiting, input validation on every endpoint, upload type checking and sandboxing, an audit log of administrative actions, least-privilege access controls, and regular backups with tested restores.
No system is completely secure. If we become aware of a breach affecting your personal data, we will notify the relevant supervisory authority within 72 hours where required, and notify you without undue delay where the breach is likely to result in a high risk to your rights.
Report a vulnerability responsibly to [email protected]. We will not pursue legal action against good-faith security research that follows our disclosure guidelines.
13. Changes
We will post any changes here and update the date above. For material changes we will give you at least 30 days' notice by email or in-product notice.
Contact
TODO Ltd. TODO — street, city, country
- Privacy and data rights: [email protected]
- Data Protection Officer: TODO — name or role, and email
- Security: [email protected]