Information we use and why
Account details: your email address, account identifier and display name help us sign you in, identify your course access and provide support. Supabase handles passwords and sign-in sessions. Providing the account information needed to sign in is necessary to link a purchase to you.
Learning records: we store completed lessons, course progress, practice activity and answers so you can continue learning. A random visitor identifier lets us keep the progress of someone using an available preview before signing in.
Order records: we keep your account email, order and payment references, purchase amount and currency, payment status, agreed terms and access records. These let us confirm your purchase, supply the course, deal with refunds and investigate payment disputes. FirstStep does not store your full card number.
Support messages: we use the contact details and information you send us to respond to your question or resolve a problem. Please avoid sending passwords, full payment-card details or unnecessary information about anyone else.
Technical records: our hosting and sign-in providers process connection and security information, such as IP addresses, browser information, request times and errors, to deliver, protect and troubleshoot the service.
If you use the course tutor
Where the question tutor is available, choosing to send a question sends its text, relevant lesson material and up to six previous question-and-answer pairs from that lesson to OpenAI to generate a reply. We do not add your account email or payment details to that request. Anything you put in your question will be included.
We save tutor conversations so you can revisit them. Clearing a lesson’s conversation removes its saved questions and replies from the course database. Usage counters remain to enforce the daily and monthly allowance. We request that OpenAI does not store response history. OpenAI’s default API abuse-monitoring logs may contain questions and replies and are normally kept for up to 30 days, with longer retention possible for legal or safety reasons.
Tutor replies can be inaccurate. The tutor explains course material; it does not make investment decisions for you.
Our reasons for using information
We use the information needed to deliver your account, course, requested tutor replies and support to perform our contract with you, or take steps you request before entering that contract.
We rely on our legitimate interests in protecting accounts, preventing fraud and misuse, enforcing reasonable usage limits and resolving faults for the security processing needed to run the service. We consider those interests alongside your rights.
We keep information required to meet applicable accounting, tax and other legal obligations. Where a particular use needs consent, we will ask for it before that use.
Providers and international processing
We use Cloudflare for website delivery, security and the course database; Supabase for accounts and authentication; Stripe and Link for payments; and OpenAI for tutor replies when that feature is connected. Microsoft Exchange Online handles messages sent to our support email address. These providers receive the information needed for their respective services.
These services operate internationally. Information may be processed outside the United Kingdom, including in the United States and, for Supabase’s operations, Singapore. We do not promise that all information stays in the UK.
Cloudflare and Supabase’s published data-processing agreements describe their handling of customer information and include standard contractual clauses and UK provisions for applicable restricted transfers. Their current agreements are linked below. You can contact us for information about the safeguards applicable to your information. Stripe and Link explain their separate payment-related processing in their privacy notices.
How long information is kept
We keep account, entitlement and learning records for the time needed to supply your account and lifetime course access. You can ask us to delete personal information; we will explain if information must be retained for a legal obligation or an unresolved claim, and how account deletion would affect your ability to sign in.
Tutor conversations remain until you clear them or make a deletion request that applies to them. Usage records are separate from conversation text. Support and incident records are kept for as long as needed to resolve the matter and deal with related complaints or claims. Order and refund records are kept for the period needed for accounting, legal obligations and payment disputes.
Provider security logs and backups have their own retention arrangements. A deletion from the working course database does not mean every provider backup disappears immediately. We assess retention using the purpose of each record, the continuing need to provide the service, applicable legal requirements and any outstanding dispute.
Cookies and browser storage
The beginner_trading_visitor cookie contains a random identifier for preview progress and has a one-year browser expiry. Account sign-in uses Supabase browser storage to keep you signed in and refresh your session. You can sign out or remove site storage in your browser; removing it may clear preview identity or sign you out.
The trading course application does not install advertising pixels or optional marketing analytics. Hosting, authentication and payment services still use the operational and security information needed to provide their services.
Your rights
Depending on the circumstances, you can request access to, correction or deletion of information, restriction of its use or a portable copy. Contact support@firststepacademy.co.uk to make a request. We may need to confirm your identity.
You have the right to object to processing based on legitimate interests. Tell us which use you object to and your circumstances so we can consider the request. Where we rely on consent, you can withdraw it without affecting processing already carried out lawfully.
You can complain to the UK Information Commissioner’s Office or an applicable data-protection authority where you live. We would also welcome the opportunity to address your concern directly.
The course does not make solely automated decisions with legal or similarly significant effects about you. Course checks and practice feedback support learning. Stripe and Link may make separate payment-security decisions under their own policies.
Provider information and privacy help
Who is responsible
Cameron Ashley Coxhead, trading as FirstStep Academy is responsible for the course and account information described in this notice. Contact support@firststepacademy.co.uk, or write to 9 Marlis Close, Bagshot, Surrey, GU19 5FD, United Kingdom, about your information or privacy rights.
This notice describes the trading course and its account, practice and support services. Link and Stripe also process payment information under their own privacy notices, which are available from checkout.