Privacy notice
Last updated: 18 October 2026
Who controls what
Learning Platform is built and operated by Michael Shreeves, acting as an individual rather than a company. Contact hello@mashreeves.com for anything on this page.
Once a client organisation's people use the platform, that organisation is the data controller for its own learners' data — it decides who is enrolled and what training is required. Learning Platform acts as its processor, under instruction. For accounts that exist outside any organisation (a platform administrator, for instance), Michael Shreeves is the controller personally.
What we collect, and why
| What | Why | Lawful basis | Kept for |
|---|---|---|---|
| Your name and email address | To create your account, sign you in, and address emails to you | Performance of a contract between your organisation and us | While the account exists. If you delete your account, or your organisation removes you, it is kept so an administrator there can restore the account, until one of them erases it: then your name and email address are replaced with placeholders for good. Nothing deletes this automatically — no retention job exists yet. |
| Your organisation and department | To scope what you can see and who your training is assigned by | Performance of a contract | While the account exists |
| Your password, held only as a hash | To sign you in. We cannot read it and cannot tell you what it is | Performance of a contract | While the account exists |
| How many wrong passwords you have entered, and the time your account was last locked after five wrong passwords or five wrong codes from your authenticator app | To lock an account for 30 minutes after five wrong attempts, so somebody guessing your password gets nowhere. We email you when it locks, and the lock and its end are recorded in the audit record | Legitimate interests in protecting your account | The count resets on your next good sign-in. The lock time stays on your account until the next sign-in attempt after the lock ends, or until you set a new password. The audit entries are kept, append-only |
| Your two-factor (TOTP) secret, if your role requires it or you choose to turn it on | To check the code from your authenticator app. Mandatory for organisation and platform administrators; optional for everyone else | Performance of a contract; legitimate interests in protecting an administrator account | Until two-factor is turned off. Encrypted in the database with a key held outside it — see the trust centre. |
| If you sign in with Microsoft: your Microsoft account's tenant ID and object ID | To recognise you on your next Microsoft sign-in, even if your email address changes. We never receive or store your Microsoft password | Performance of a contract | While the account exists |
| If your organisation connects its own Microsoft sign-in: when your account was added automatically or by a directory group, and when the group sync deactivated it | So your organisation's leavers lose access automatically, and so only accounts added that way are ever switched off by it. Your training record and certificates are kept when this happens | Performance of a contract; legitimate interests in ending a leaver's access promptly | While the account exists |
| An audit record of Microsoft sign-in changes (settings changes, and accounts created, linked, deactivated or reactivated) and of accounts deleted, removed, restored or erased, with who did it and the values before and after | So an organisation can show who changed its sign-in rules and why an account was added or removed | Legitimate interests in a reliable security record | Kept, append-only, including after an account is deleted or removed. When an account is erased, its name and email address in these entries are replaced with “Former user”; what was done stays. No retention period is applied yet — a gap, recorded here rather than hidden |
| Your theme and font preferences | So the interface renders in light, dark or high-contrast mode, and in the font you chose on the Appearance page, on any device | Performance of a contract | While the account exists |
| A set-password or password-reset token, if one was sent to you | To let you set a password without emailing it to you. Stored only as a hash and expires after a short window | Performance of a contract | Not automatically purged once expired or used yet — a real gap, recorded here rather than hidden |
| What courses you're enrolled on, your progress through each lesson, and when you completed one | To run the course itself, and so your organisation can see who has and hasn't completed required training | Performance of a contract; legal obligation, where the training is legally mandatory | For the life of the enrolment. Nothing deletes this automatically. |
| Your assessment attempts, the answers you gave (including anything you wrote in a free-text answer), and your score | To mark the assessment and show your organisation whether you passed required training | Performance of a contract; legal obligation, where the assessment is part of legally mandatory training | For the life of the enrolment. Nothing deletes this automatically. |
| A certificate issued when you complete a course, and its reference number | Proof of completion your organisation can rely on, and that you can be asked to show | Performance of a contract; legal obligation | For the life of the enrolment. Nothing deletes this automatically. |
| Usage statistics: the pages you view, the page you came from, your browser and device type, a rough location (country or region, worked out from your IP address) and when you visited | To understand how the platform is used, so it can be improved. Your IP address is shortened before it's stored — the last two parts are removed, so 81.2.69.160 is kept as 81.2.x.x. Michael Shreeves is the controller for this, not your organisation | Legitimate interests: understanding how the service is used, to improve it | Raw visit records are deleted after 13 months. Only aggregated reports that don't identify anyone are kept after that. |
The usage statistics above come from Matomo, which we host ourselves at analytics.mashreeves.com on the same Vultr server in Manchester, UK. It sets no cookie and none of it goes to another company. We don't use advertising or third-party tracking, and there is no profiling or automated decision-making — assessment marking is a fixed rule against a stored answer key, not a model making a judgement about you. Nothing you write is used to train anything. No content on any page is loaded from a third-party server. The one outside company that does see your visit is Cloudflare, which sits in front of the site itself — see below.
Who else sees it
- People in your own organisation with the right role. An organisation administrator can see their organisation's people, enrolments and completion status — that's the point of the platform. Tenancy is enforced so nobody sees another organisation's data.
- Nobody else sees the usage statistics. Matomo is run by Michael Shreeves himself rather than by an analytics company, so it isn't a processor.
- Vultr, our hosting provider. The application, its database and any uploaded files sit on a Vultr server in Vultr's Manchester, UK data centre.
- Cloudflare, which sits in front of every request to the site and handles its DNS and HTTPS. It sees your IP address, your browser and the page you asked for. Cloudflare is a US company and processes this under its standard data processing terms.
- Microsoft, only if you choose to sign in with Microsoft. Your browser goes to Microsoft to sign in, and Microsoft tells us your name, email address and account identifiers. If your organisation has connected its own Microsoft sign-in and turned on group sync, we also ask Microsoft (from your organisation's own directory, with its administrator's consent) who is in a chosen group. Microsoft acts for your organisation here, under its own terms with them.
- Microsoft 365, which delivers the emails the platform sends (set-password links, password resets and notifications). The platform hands each email to a mail server on its own hosting, which passes it to Microsoft 365 to deliver, so Microsoft sees your email address and the content of those emails. Microsoft holds this email in the United Kingdom.
- Brevo, kept as a fallback email provider. It handles no email day to day, and would relay the same emails only if the Microsoft 365 route failed and we switched to it. Brevo is a French company and processes data in the EU, which the UK recognises as giving adequate protection.
We do not sell your data, and we do not share it for advertising.
Where it is held
In the UK, on a Vultr server in Manchester. Cloudflare handles requests on their way to that server and Microsoft 365 delivers email, holding it in the UK, as described above — Cloudflare's processing may take place in the US, under its standard data processing terms, and Microsoft is a US company whose data protection terms cover any processing it does elsewhere. There's more in the trust centre. Nothing on a page is loaded from a third party: the typefaces, stylesheets and scripts are all served from this application, so no one beyond the providers listed above learns that you used it.
Cookies
A session cookie keeps you signed in while you use the app and
carries the token that stops a form being submitted from another
site. It's strictly necessary for a function you asked for
(signing in), so it needs no consent and there is no cookie banner.
If you tick "Keep me signed in" at sign-in, a second cookie,
REMEMBERME, keeps you signed in on that device for 30
days - including not asking for your security code again there for
that time - and is only set once you've completed that code. Leave the
box unticked on a shared computer.
A third cookie, lp_shell, remembers on that device
whether you keep the side menu open or narrowed to icons, and copies
the font you chose so the sign-in page there matches. It holds
nothing else - no name, email or identifier - is not tied to your
session, and lasts a year unless you clear it. While you're signed
in, the font saved on your account always wins over the cookie. It's
strictly necessary for settings you asked for, so it needs no
consent either.
We set nothing else — no advertising and no third-party
cookies. Our Matomo analytics run with cookies turned off, so they
don't add a cookie and there's nothing to consent to.
Under-18 learners
Learning Platform is built for organisations to train their own people — a corporate, B2B product, not a service offered directly to children. Nothing in the schema records a date of birth or age, and no organisation type in the platform is aimed at under-18s. If that ever changes for a particular client organisation, this notice and the safeguards around it would need revisiting before any under-18 learner's data was processed — it isn't something this notice can honestly claim to have designed for today.
Your rights
Under UK GDPR you can ask what is held about you, ask for a copy, ask for it to be corrected, or ask for it to be deleted, restricted or sent elsewhere.
You can delete your own account from your account menu (Delete account). If you belong to an organisation, that removes you and stops every sign-in at once; an administrator there can restore the account, or erase your name and email address for good. Your training record (enrolments, results and certificates) stays with your organisation as its record of who was trained, and after an erasure it shows “Former user”. A platform administrator account, which belongs to no organisation, is erased straight away. Nothing else is self-service yet: for a copy of your data, a correction, or anything else, ask at hello@mashreeves.com and it will be handled by hand. We respond within one month. If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Do you have to give us this?
A name, an email address and a password are needed to have an account; without them we cannot sign you in. Two-factor authentication is required, not optional, if your role is an organisation or platform administrator — you cannot use the product in that role without it. Everything else is yours to decide, though your organisation may itself require you to complete certain training.
Changes
This notice lives with the source code and changes in the same change as whatever it describes. The date at the top is when it last changed.