Privacy policy

Newsletter: your email address only, and only after you click the confirmation link (double opt-in). Basis: your consent; kept until you unsubscribe. Every email carries a one-click unsubscribe link.

Consultation and support forms: name, email, phone (optional) and your message. They are delivered to our mailbox by email and used only to answer that request. Basis: pre-contractual steps / legitimate interest; kept for up to 12 months after the conversation ends.

Student portal: name, email, password (stored only as a scrypt hash — we never see the real password), enrolled courses, homework answers, ticket messages, anything you write in the course chatroom (visible to your classmates and the tutor; a message you delete yourself is hidden from classmates but the tutor can still see it; only the newest 500 messages are kept) and last-login time. Basis: performance of the training contract; kept until the course ends and for at most 12 months afterwards, unless you ask for deletion sooner.

Technical data: your IP address for throttling suspicious attempts (anti brute-force) and in the internal security log (last 500 entries), the Cloudflare Turnstile bot check on forms, and anonymous, cookieless Vercel Analytics so we know which pages are read.

Instagram automation: if you comment under one of our Instagram posts and an automation replies, we store your Instagram username and user id, the text of that comment, and where you are in the message flow so the same link is not sent to you twice. If you message us there, the conversation text is kept so we can answer. Basis: legitimate interest in running the service; kept until you ask for deletion.

Clicks on links we DM you: when you open a link we sent in a direct message, we count the click and record only the approximate country and city of the request, as running totals. Your IP address is not stored and these counts are not tied to any individual — we can see “ten clicks from Tehran”, never who they were.

We use no advertising or tracking cookies, which is why there is no cookie banner. The cookies that exist are all essential: “locale” for your chosen language, the session cookie of the student portal and admin console (HttpOnly, only after signing in), and a browser-storage flag so the newsletter popup is not shown again.

Vercel (hosting and delivery), Upstash (Redis database), Cloudflare R2 (course files, lesson video and the encrypted backups — all private), Resend (email delivery), Cloudflare Turnstile (bot check), Vercel Analytics (anonymous statistics). Videos load from YouTube (the youtube-nocookie variant) only when you press play, at which point YouTube may collect its own data.

For message automation: Meta/Instagram (comments and direct messages reach us through Instagram’s official API and remain subject to Meta’s own privacy policy), Telegram (if you use our bot), and Anthropic (when the AI assistant answers you, your message text is sent to Anthropic to generate the reply; it is not used to train models).

Every typeface on the site — including in the printable version of course chapters — is served from our own server. Nothing is fetched from Google Fonts or any other outside service.

Some of these providers operate outside the UK (notably in the EU and the US); transfers rely on adequacy decisions and standard contractual clauses.

All traffic is encrypted (HTTPS/HSTS). Passwords are stored hashed only and passwords found in public breaches are rejected. Third-party credentials are encrypted at rest (AES-GCM), the admin login is protected by two-factor authentication, every administrative action is logged, and an encrypted backup is taken nightly and kept for 14 days.

You can access, correct or delete your data, restrict or object to its processing, or ask for a portable copy. Email info@ismail-cyberworld.com and we answer within one month. If you believe we handled your data wrongly you have the right to complain to the UK regulator, the ICO (ico.org.uk).

This site is not aimed at children under 16 and we do not knowingly collect their data.

If this policy changes, the date at the top is updated and, for significant changes, we let you know through the site or by email.