Privacy Policy

Lexeprint Inc. operates Legal Cyber Academy and is the controller of the personal data described here. Postal address: 13413 Granger Ave, Orlando, FL 32827. For any privacy question or request, email info@lawandforensics.com. We have not appointed a data protection officer or an EU/UK representative.

Account data. When you register: your email address, the name you enter, and a password (stored only in hashed form by our authentication provider). We also keep your account role, whether you hold a membership, and your payment provider customer reference. If you register with a court, government, or academic email address, we record that domain and its classification to grant public-service access. Our authentication provider records sign-in metadata such as IP address and browser details for security. Purpose: to create and run your account and provide the courses you are entitled to.

Learning records. Courses you are enrolled in, lesson progress (playback position and completion), assessment sessions (start and deadline times), the answers you choose, your scores, the completion affirmation you give, and any certificates issued. A certificate records your name and the course title as they stand when it is issued, and keeps them even if either changes later. Purpose: to deliver the courses, grade assessments, and issue and verify certificates.

Public certificate pages. A certificate has a verification page that anyone with its link or code can open. It shows the name on your account and the course title as they were when the certificate was issued, your score, and the issue date. These pages are excluded from search-engine indexing, but they are public by design so that employers and licensing bodies can verify them. Only share the link if you are content for its holder to see those details.

Purchase data. For each order: the course, amount, currency, status, any promotion code, and the payment provider’s session and subscription references. Card details are entered on Stripe’s hosted checkout and never reach our servers. If you buy without an account, Stripe gives us the email you entered so we can create an account and grant access. Purpose: to take payment, fulfil the order, handle refunds and cancellations, and keep financial records.

Contact and team enquiries. What you submit through the contact or group-licensing form: name, email, organisation, number of seats, and your message. Purpose: to answer you and follow up on the enquiry.

Mailing lists. If you sign up for the newsletter or new-course alerts: your email address, any name you give, which list you joined, and whether you are subscribed. Purpose: to send the email you asked for. Every mailing contains an unsubscribe link.

Usage analytics. When you view a page we record the page path, the referring page, an event name (for example “course viewed”), the course or page identifier, any campaign (UTM) tags in the link you arrived by, your browser’s user-agent string, whether that string looks automated, the time, and a random session identifier held in your browser tab. Purchases, subscriptions, and certificate issues are also recorded as events linked to your account. These events are written to our database only by our server, never directly from your browser. We do not store your IP address with these events. If you accept analytics we also load Vercel Web Analytics and Speed Insights, which measure page views and page performance without cookies. Purpose: to understand which pages and courses are used and to keep the site fast.

None of the usage analytics above runs until you accept them. A banner asks on your first visit. Until you accept, no session identifier is created, no campaign tags are stored, no page view is sent, and the Vercel measurement scripts are not loaded at all. If you decline, the same stays true and nothing else about the site changes. Purchases, subscriptions, and certificate issues are recorded by our server regardless of this choice, because they are records of a transaction rather than analytics.

One exception, stated because it is a real one. If you arrive by a link carrying campaign (UTM) tags, those tags are held in the page’s memory for the length of your visit so that they are still known if you accept analytics on a later page. Nothing is written to your device and nothing is sent anywhere unless and until you accept; if you decline, or simply leave, they are discarded with the page.

You can change your answer at any time. Your choice is remembered in this browser (see Cookies and browser storage below), and the control below turns analytics on or off or forgets your answer entirely. Turning them off takes effect immediately — it does not wait for a reload.

Google Analytics 4. The site can also use Google Analytics, which does set cookies (named _ga and _ga_…) and sends data to Google. It is off unless configured, and when configured it starts in Google’s “denied” consent state and stays there until you accept the banner, so no Google analytics cookie is set before then. Accepting grants analytics storage only. Google’s three advertising signals (ad storage, ad user data, ad personalisation) are set to denied on every page load and are never granted, so no advertising or audience data is shared — we run no advertising. If you later turn analytics off, Google is told to return to denied straight away.

Security and abuse prevention. To limit automated abuse, sign-up, contact, newsletter, checkout, analytics, and certificate-badge requests are counted per IP address (or per account, when you are signed in) over short windows of one minute to one hour. These counters store a keyed hash (HMAC) of the IP address or account identifier, not the address itself, and are deleted about a day after their counting window starts. Cloudflare Turnstile runs on the sign-up, sign-in, password-reset, confirmation-email resend, and newsletter forms, where it examines your browser and connection to tell people from bots. Our hosting provider keeps request logs that include IP addresses. Purpose: to keep the service secure and available.

Video. Lesson videos are streamed from Bunny.net, and some lessons and video pages embed YouTube players in YouTube’s privacy-enhanced (youtube-nocookie.com) mode. Loading a player sends your IP address and browser details to that provider; YouTube may store information on your device once you start playback, under Google’s privacy policy.

AI services. We use Anthropic and OpenAI to help draft articles and course materials and to transcribe lesson recordings. We do not send learner account, payment, assessment, or enquiry data to them.

Where the GDPR or UK GDPR applies, we rely on:

• Contract (Art. 6(1)(b)) — account data, learning records, certificates, purchase data, and transactional email needed to provide what you signed up for or bought.
• Legal obligation (Art. 6(1)(c)) — keeping financial and tax records of purchases.
• Legitimate interests (Art. 6(1)(f)) — security and abuse prevention, usage analytics to improve the site, answering enquiries, and public certificate verification. You may object to processing based on legitimate interests at any time.
• Consent (Art. 6(1)(a)) — the newsletter and new-course alerts. You can withdraw consent at any time by unsubscribing, without affecting earlier processing.

We share personal data only with service providers that process it for us, under their terms, to run the site:

• Supabase — database, authentication, and file storage.
• Vercel — hosting, request logs, Web Analytics, and Speed Insights.
• Stripe — payments, subscriptions, invoices, and the billing portal. Stripe is also an independent controller of the payment data it collects.
• Resend — delivery of account, purchase, and mailing-list email, and storage of mailing-list contacts.
• Cloudflare — Turnstile bot checks on the sign-up, sign-in, password-reset, confirmation-resend, and newsletter forms.
• Bunny.net — video streaming.
• Google — embedded YouTube video players, and Google Analytics where it is configured and you have accepted analytics.

We may also disclose data where required by law or legal process, to protect our rights or the safety of others, or to a successor if the business is sold or reorganised. We do not sell personal data, and we do not share it for cross-context behavioural advertising: the site runs no advertising or cross-site tracking pixels.

Legal Cyber Academy is operated from the United States, and our service providers process data in the United States and other countries where they operate. If you are in the European Economic Area, the United Kingdom, or Switzerland, your data is transferred to countries that may not offer the same level of protection. For those transfers we rely on the safeguards our providers offer in their data processing terms, which generally include the European Commission’s Standard Contractual Clauses (and the UK addendum) and, where a provider participates, the EU-U.S. Data Privacy Framework. You can ask us for more information about these safeguards.

Apart from rate-limit counters, we do not currently run automatic deletion on a fixed schedule. What we keep, and for how long, is as follows:

• Account data and learning records — while your account exists. When an account is deleted, its enrollments, progress, assessment records, certificates, and subscription records are deleted with it, and its certificate pages stop working.
• Purchase records — kept after account deletion, with the link to the account removed, for as long as we need them for accounting, tax, and dispute purposes. Stripe keeps its own records under its policies.
• Usage analytics events — kept until we delete them. Events linked to an account lose that link when the account is deleted.
• Rate-limit counters — one small record per protected action and hashed IP address or account identifier, deleted automatically about a day after its counting window starts.
• Enquiries — kept until we delete them, or sooner on request.
• Mailing lists — until you unsubscribe. We keep a record that you unsubscribed so that we do not email you again.
• Provider logs — hosting, email-delivery, and security logs are kept by those providers for the periods their own policies set.

You can ask us to delete your account and data at any time (see below). We may keep what the law requires us to keep.

We do not use advertising cookies. The site stores:

• Sign-in cookies (named sb-…-auth-token) — set when you log in, to keep you signed in. Strictly necessary.
• Session storage (lca_sid, lca_utm) — a random session identifier and the campaign tags of the link you arrived by, used for the usage analytics above. Written only after you accept analytics. First-party, not strictly necessary, and erased when you close the browser tab. You can block it with your browser’s site-data settings without losing any functionality.
• Your analytics choice (lca-analytics-consent) — local storage holding “granted” or “denied” so the consent banner stops asking. It records only your answer, contains no identifier, and persists until you change it with the control in what we collect and why or clear your browser’s site data. Strictly necessary to honour your choice.
• Google Analytics (_ga, _ga_…) — set only if Google Analytics is configured AND you accepted analytics. Not strictly necessary. Declining, or clearing your analytics choice, prevents them.
• Cloudflare Turnstile — may read or set data on the sign-up, sign-in, password-reset, confirmation-resend, and newsletter forms for bot protection. Strictly necessary for security.
• Third-party players and checkout — YouTube (after you press play), Bunny.net, and Stripe’s hosted checkout may set their own cookies under their own policies.

Do Not Track and Global Privacy Control: we do not track you across other websites, and we do not sell or share personal data, so there is nothing for those signals to opt you out of. We do not change our practices in response to a Do Not Track signal. Google Analytics, where it is configured, measures use of this site only; no advertising feature, no Google Signals and no advertising cookie is enabled.

Depending on where you live, you may have the right to access the personal data we hold about you, to correct it, to delete it, to receive a copy in a portable format, to restrict or object to our processing, and to withdraw consent. To make a request, email info@lawandforensics.com from the address on your account, or tell us which address the request concerns. We may need to confirm that the request comes from you before acting on it, and we respond within the period the applicable law sets (one month under the GDPR, 45 days under California law, each extendable where the law allows).

You can unsubscribe from any mailing list with the link in each email, and cancel a subscription from your account page. If you are in the EEA or UK and are unhappy with how we have handled your data, you can complain to your local data protection authority; we would be grateful for the chance to resolve it first.

In the past 12 months we have collected these categories of personal information, from you, your browser, and our payment provider, for the purposes described above:

• Identifiers — name, email address, account identifier, IP address.
• Commercial information — courses purchased, subscriptions, and order history.
• Internet or network activity — pages viewed, referrer, user-agent, and campaign tags.
• Professional information — organisation and team size, if you submit an enquiry.
• Education-related records — course progress, assessment answers and scores, and certificates.
• Sensitive personal information — account log-in credentials, used only to provide and secure your account.

We disclose these categories for business purposes to the service providers listed above. We do not sell personal information or share it for cross-context behavioural advertising, and have not done so in the past 12 months. We do not use sensitive personal information to infer characteristics about you. You have the right to know, delete, and correct your personal information, and you will not be discriminated against for exercising these rights. An authorised agent may make a request on your behalf with your written permission; we may ask you to confirm your identity directly.

Legal Cyber Academy is professional training for adults and is not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, email info@lawandforensics.com and we will delete it.

Data is encrypted in transit, database access is restricted by row-level security so that learners can read only their own records, passwords are stored only in hashed form, and payment card details are handled entirely by Stripe. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We will update this page when our practices change and revise the date at the top. If a change materially affects how we use data we already hold, we will tell account holders by email before it takes effect.

Lexeprint Inc., 13413 Granger Ave, Orlando, FL 32827 — info@lawandforensics.com