Privacy Policy
1. Who we are
ColabYard is a gamified learning platform operated by NextGenCyber, accessible at colabyard.co.uk. When this policy refers to "we", "us" or "our", it means NextGenCyber.
We are committed to protecting your personal data and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Data Controller: NextGenCyber
Contact: dpo@colabyard.co.uk
2. What data we collect
Trainers
- Account data: Full name, email address, password (stored as a secure hash — we never store your plain password)
- Content data: Quizzes, questions, discussion boards and prompts you create
- Usage data: Date of account creation, last activity, number of quizzes and discussions created
- AI usage data: Records of when AI prompt generation features were used (no content of prompts is stored beyond what you save)
Students
- Name: An optional display name you choose when joining a quiz or discussion (can be anonymous)
- Quiz responses: Your answers, score, and time taken
- Discussion posts: Text content you post, comments, and reactions
- We do not require students to create accounts or provide an email address
All visitors
- Cookies: We use essential session cookies to keep trainers signed in, and — only if you agree — Google Analytics cookies for anonymous usage statistics. No advertising cookies are used
- Log data: Standard server logs (IP address, browser type, pages visited) retained for up to 30 days for security purposes
3. Why we use your data
| Purpose | Legal basis |
|---|---|
| Providing the ColabYard service | Contract (Art. 6(1)(b) UK GDPR) |
| Trainer account management and authentication | Contract |
| Sending password reset emails | Contract |
| Generating AI discussion prompts using your content | Contract / Legitimate interest |
| Platform security and fraud prevention | Legitimate interest (Art. 6(1)(f)) |
| Displaying leaderboards (quiz scores) | Legitimate interest / Consent via participation |
| Admin analytics (platform usage statistics) | Legitimate interest |
4. Who we share your data with
We do not sell your data. We share data only with trusted service providers who help operate the platform:
- Supabase (database hosting) — EU/US data processing, SOC 2 compliant
- Vercel (hosting and deployment) — US-based, Privacy Shield certified
- Resend (email delivery) — used only for password reset emails
- Google (Gemini API) — used to generate AI discussion prompts when trainers enable this feature. Prompt content is sent to Google's API. See Google's AI Terms
All processors are required to handle your data in accordance with applicable data protection law.
5. How long we keep your data
- Trainer accounts: Until you request deletion or your account is removed by an administrator
- Quiz and discussion content: Retained while the trainer account is active
- Student quiz responses: Retained for the duration of the quiz's active period
- Student discussion posts: Retained while the discussion board is active
- Password reset tokens: Expire after 1 hour and are permanently deleted
- Server logs: Automatically deleted after 30 days
6. Your rights under UK GDPR
You have the following rights regarding your personal data:
- Right of access — you can request a copy of the data we hold about you
- Right to rectification — you can ask us to correct inaccurate data
- Right to erasure — you can ask us to delete your data ("right to be forgotten")
- Right to restrict processing — you can ask us to limit how we use your data
- Right to data portability — you can request your data in a machine-readable format
- Right to object — you can object to processing based on legitimate interest
- Rights related to automated decision-making — we do not make solely automated decisions that significantly affect you
To exercise any of these rights, contact us at dpo@colabyard.co.uk. We will respond within 30 days.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe your data has been mishandled.
7. Cookies
We use the following cookies:
| Cookie | Purpose | Duration |
|---|---|---|
| next-auth.session-token | Keeps trainers signed in securely | 24 hours (or until sign out) |
| lp_cookie_consent | Remembers your cookie preference | 1 year |
| _ga, _ga_* | Google Analytics — anonymous usage statistics, so we know which features are used. Only set if you allow analytics cookies below. | Up to 2 years |
We do not use advertising cookies, and we never sell or share your data with advertisers. Analytics cookies are set only with your consent — until you allow them, Google Analytics receives no cookie and cannot identify a returning visitor.
Cookie settings
You can change your choice at any time:
8. Data security
We take security seriously and implement the following measures:
- All passwords are hashed using bcrypt (industry standard, never stored in plain text)
- All data is transmitted over HTTPS/TLS
- Database access is protected by row-level security policies
- Trainer sessions automatically expire after 60 minutes of inactivity
- Password reset links expire after 1 hour and can only be used once
- Admin access is restricted to a single verified email address
9. Children's data
ColabYard is designed for use in professional training environments. We do not knowingly collect personal data from children under 13. If you believe a child has provided personal data through our platform, please contact us immediately at dpo@colabyard.co.uk.
When ColabYard is used in educational settings involving minors, it is the responsibility of the trainer and their organisation to ensure appropriate consent and data protection measures are in place.
10. International transfers
Some of our service providers (Vercel, Google) are based in the United States. Where data is transferred outside the UK, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) or equivalent protections recognised under UK GDPR.
11. Changes to this policy
We may update this privacy policy from time to time. When we do, we will update the "last updated" date at the top of this page. For significant changes, we will notify trainers by email. Continued use of ColabYard after changes constitutes acceptance of the updated policy.
12. Contact us
For any privacy-related questions, data subject requests, or concerns, please contact: