Summary: We collect your name, email, and payment data to run the platform. We do not sell your data. We store it on Supabase (EU-region) and Stripe. You can ask us to delete your data at any time.
The data controller for this platform is:
We process personal data in compliance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Cyprus Data Protection Law (Law 125(I)/2018), administered by the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus.
| Data | When Collected | Purpose |
|---|---|---|
| Full name, email address | Account registration | Account management, communications |
| Password (hashed — never stored in plain text) | Account registration | Authentication |
| Role selection (student / instructor / graduate) | Account registration | Content access control |
| Payment details (card info) | Checkout — processed by Stripe only | Billing — we never see or store card numbers |
| Stripe customer ID | First purchase | Subscription management |
| Course progress, sessions watched | While using the platform | Progress tracking, cohort unlock logic |
| Community posts and replies | When you post | Community feature |
| Points and leaderboard score | Platform activity | Gamification |
| IP address, browser type | Each page request (server logs) | Security, fraud prevention |
| Profile photo (if taken via the Android app's camera option) | When you tap "Take Photo" on your profile | Displayed as your avatar — stored the same way as a browser-uploaded photo |
| Push notification token | Android app, if you allow notifications | Sending you course/community notifications |
We do not collect sensitive personal data (e.g. racial or ethnic origin, health data, political opinions). We do not collect or store biometric data (fingerprint/face) — see Section 3 below.
The Townshub Academy Android app requests a few device permissions the website doesn't need:
| Permission | What It's For | What We Receive |
|---|---|---|
| Camera / Photo Library | Only used if you tap "Take Photo" when setting your profile picture | The photo you choose, uploaded to our Supabase Storage the same way a browser-uploaded photo is (see Section 6). We never access your camera or photo library at any other time, and no image is kept on your device by us. |
| Biometric (fingerprint / face unlock) | An optional local screen lock for the app — if you're already signed in, it re-confirms it's you before showing your account | Nothing. Your fingerprint or facial data is captured and verified entirely by your device's own operating system. It never leaves your device, is never seen by Townshub Limited, and is never transmitted to our servers — the app only receives a yes/no result from your device. |
| Push notifications | If you allow it, your device registers with Google's Firebase Cloud Messaging so we can send you course or community notifications | A device token (not personal content), stored against your account. You can revoke this at any time in your device's notification settings. |
| Processing Activity | Legal Basis (GDPR Art. 6) |
|---|---|
| Managing your account and delivering the course | Art. 6(1)(b) — performance of a contract |
| Processing payments | Art. 6(1)(b) — performance of a contract |
| Sending transactional emails (receipts, password reset) | Art. 6(1)(b) — performance of a contract |
| Sending course update or promotional emails | Art. 6(1)(a) — consent (opt-in) |
| Server logs and security monitoring | Art. 6(1)(f) — legitimate interests (security) |
| Legal compliance (VAT records, financial records) | Art. 6(1)(c) — legal obligation |
We use the following cookies on this platform:
| Cookie | Type | Purpose | Duration |
|---|---|---|---|
| PHP Session cookie (PHPSESSID) | Strictly necessary | Keeps you logged in during your session | Session (deleted when browser closes) |
| Google Fonts | Functional (third-party) | Loads the Inter typeface. Google may log the request with your IP. | None (CDN request, no stored cookie) |
| Stripe | Functional (third-party) | Fraud prevention during checkout | As per Stripe policy |
We do not use advertising, analytics, or tracking cookies. If this changes we will update this policy and ask for your consent.
You can disable non-essential cookies in your browser settings. Disabling the session cookie will prevent you from logging in.
We do not sell your personal data. We share data only with these processors:
| Processor | Purpose | Location |
|---|---|---|
| Supabase Inc. | Database and authentication hosting | EU (Ireland, eu-west-1) — within the EU/EEA |
| Stripe Inc. | Payment processing | USA (Standard Contractual Clauses apply) |
| Anthropic, PBC | AI-generated reply suggestions for direct messages and community posts. When you message the instructor or post in the community, your name and message content may be sent to Anthropic's Claude API to draft a reply. | USA (Standard Contractual Clauses apply) |
| Google LLC | Fonts CDN (font loading only); Firebase Cloud Messaging (Android app push notification delivery, if enabled) | USA (Standard Contractual Clauses apply) |
| Hostinger International Ltd | Web hosting | EU / Lithuania |
Where data is transferred outside the EU/EEA, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission.
| Data | Retention Period |
|---|---|
| Account data (name, email, role, progress) | Until you request deletion, or 3 years after your last login if account is inactive |
| Payment records (Stripe customer ID, transaction history) | 7 years (Cyprus tax/accounting law requirement) |
| Community posts and replies | Until deleted by you or us, or until account deletion |
| Server logs | 90 days |
| Push notification device token | Until you disable notifications, uninstall the app, or request deletion |
You have the following rights regarding your personal data. To exercise any of them, email nnamdi@townshub.com with subject line "GDPR Request".
We will respond to all requests within 30 days. We may ask you to verify your identity before acting on a request.
No system is 100% secure. In the event of a data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and you within a reasonable timeframe, as required by GDPR Art. 33 & 34.
This platform is intended for users aged 16 and over (the age set by Cyprus for digital consent under GDPR Article 8). If you are under 16, you must have verifiable parental or guardian consent. If we discover that we have collected data from a child under 16 without consent, we will delete it promptly.
We may update this Privacy Policy from time to time. Material changes will be notified by email to your registered address at least 14 days before taking effect. The “Last updated” date at the top of this page reflects the current version.
For privacy requests, questions, or complaints:
Townshub Limited
Nicosia, Cyprus
Email: nnamdi@townshub.com
© 2026 Townshub Limited. — Terms & Conditions