Privacy Policy
Operated by Yallo Management Consultancies L.L.C, registered office: Office G06-344, The Exchange Tower, Business Bay, PO Box 231525, Dubai, UAE · Last updated: 27 October 2026
1. Scope, controller and roles
This Privacy Policy explains how Yallo Management Consultancies L.L.C, registered office Office G06-344, The Exchange Tower, Business Bay, PO Box 231525, Dubai, UAE ("Yallo", "we"), processes personal data on academy.yallo.co and connected services. It applies to visitors, individual learners, organisation-seated learners, organisation administrators and walkthrough bookers.
- Yallo as controller: accounts, privately purchased learning, marketing, billing records, support and booking records, and the certificate verification register.
- Yallo as processor: assignment, progress, score and certification data for learning assigned under an Organisation Plan (your employer is the controller; see Data Processing & Sub-processors).
2. Personal data we collect
| Category | Data points | Source |
|---|---|---|
| Identity & account | Name, email, job title, company, country, bio, LinkedIn URL, why you are learning AI, weekly learning goal, profile photo (uploaded by you or from Google sign-in), organisation (if your seat comes from an Organisation Plan) | You / your organisation / Google sign-in |
| Ambassador Programme | For an ambassador: first name, link code and acceptance of the programme terms. For each sign-up from a link: which ambassador, the date, and when and to which wording the person agreed | You / the visitor who agreed on the link's page |
| Learning records | Enrolments, lesson and video progress, quiz attempts, answers given, scores, baselines, Skill Score per dimension, certificates | Platform activity |
| Integrity & audit | Grading events, timestamps, attempt counts, state-transition log entries | Platform (server-side) |
| Commercial | Plan, order history, invoices, transaction references (no full card data) | You / Paddle.com, our merchant of record |
| Technical | IP address, device/browser, coarse location from IP, server logs, crash logs | Automatic |
| Communications | Support emails, contact-form messages, walkthrough bookings (name, email, chosen slot), free-resource and skill-check requests (email, what you asked for, a one-time verification code), survey answers, newsletter status | You |
| Verification register | Certificate holder name, course, issue date, status (valid/revoked) | Platform |
3. Purposes and legal bases
| Purpose | What happens | Basis |
|---|---|---|
| Deliver the Service | Accounts, sign-in, course delivery, progress sync, grading, certificate issue | Contract |
| Assessment integrity | Server-side grading, attempt limits on final exams, immutable audit log | Legitimate interests (integrity of credentials) |
| Organisation reporting | Assigned-learning progress and scores to your organisation's portal | Processor on organisation's instructions |
| Public verification | Certificate verification page | Contract; de-listing available |
| Payments & accounting | Process transactions through Paddle.com, our merchant of record; keep invoices and tax records | Contract / legal obligation |
| Support & bookings | Reply to enquiries, run walkthrough bookings, send the free resources and skill-check results you ask for | Contract / legitimate interests |
| Security | Abuse detection, access logging, incident response | Legitimate interests / legal obligation |
| Product improvement | Review of server logs and aggregate usage to keep the Service reliable | Legitimate interests |
| Aggregate website analytics | We count page views, the referring website, the campaign a link came from (its UTM tags), country, and device and browser type through Vercel Web Analytics and Cloudflare Web Analytics, to understand how the site is used and improve it. Cloudflare also measures how quickly pages load. Neither sets cookies or builds a profile of you, and links carry no sign-in or invitation codes when counted. | Legitimate interests |
| Marketing | Newsletter and product updates | Consent: opt in, withdraw any time |
| Ambassador Programme | Show a visitor who recommended the academy and, if the visitor agrees, record that a new account came from that ambassador's link; tell the ambassador how many sign-ups their link brought and when, never who. Counting how often a link is opened records nothing about who opened it; to stop misuse, the opening address is held for up to a day by our rate limiting | Consent of the visitor, withdrawn any time by writing to us |
4. Employer visibility: the exact boundary
If your Seat belongs to an Organisation Plan, administrators of that organisation can see your completion, scores, Skill Score growth and certification status for learning assigned under that plan, and whether your Seat is active.
They can never see courses you purchase privately on your own account, or your session data. This boundary is enforced in the platform's role-based access control, so it is an architectural property and not only a policy promise.
5. AI features and automated processing
- AI features, such as a course tutor, are coming soon and are not live. Before they launch we will update this policy and name the AI provider in the sub-processor list.
- Skill Scores are computed automatically from assessment results using deterministic rules. They inform your learning path; they are not used to make legally significant automated decisions about you.
6. Sharing and recipients
- Payments: Paddle.com is our payment processor and Merchant of Record, and an independent controller of your payment data under Paddle's privacy notice. It receives your name, email, country, billing address and payment details to process orders, tax and refunds. Paddle is also listed on our sub-processor list.
- Sub-processors: hosting, database, file storage, video, email, sign-in, payment and network providers listed on the Data Processing & Sub-processors page, under contract or the provider's standard terms.
- Your organisation: within the section 4 boundary only.
- Anyone with a verification link: the certificate register data in section 2 (that is its purpose); de-listing disables this per certificate.
- Authorities and advisers: where legally required or to defend claims.
- Corporate transactions: a successor bound by equivalent protections.
- Ambassadors: how many sign-ups their link brought and the date of the latest, never names.
We do not sell personal data, and we do not let advertisers pay to reach you inside the Service.
7. International transfers
Our providers host and process data in Germany (Frankfurt), Ireland, the United Kingdom (London) and the United States, and some content and traffic is delivered through worldwide networks. Where the law requires it, we rely on appropriate safeguards for these transfers, such as contractual protections or recognised transfer mechanisms. Details of each provider's region are on the Data Processing & Sub-processors page.
8. Retention schedule
| Data | Kept for | Why |
|---|---|---|
| Account, learning, support and booking records | Life of account, plus 24 months after closure | Reactivation, disputes |
| Grading audit log | Life of the related certificate | Verification integrity |
| Certificates & verification pages | Indefinite unless de-listed | Credential permanence |
| Invoices & tax records | Statutory period under UAE law | Legal obligation |
| Server logs | 90 days | Security |
| Marketing consents | Until withdrawn, then a suppression record | Compliance |
| Sign-ups from an ambassador's link | 24 months from sign-up, then kept only as a count | Programme records |
9. Your rights
Subject to applicable law you may request: access and a copy; correction; deletion; restriction; portability; objection to legitimate-interest processing; withdrawal of consent (prospective only). For assigned-learning data, we will route or support requests with your organisation as controller. Exercise your rights by emailing support@yallo.co. We respond within the period required by law, and you may also complain to your data protection authority.
10. Security measures
- Encryption in transit (TLS); no passwords, because sign-in uses single-use links or Google; secrets held server-side only.
- Role-based access control; least-privilege production access.
- Server-side-only grading; immutable audit log; state transitions validated server-side.
- Backups, monitoring, and an incident-response process.
No system is perfectly secure. Report vulnerabilities to support@yallo.co. Good-faith research within the Acceptable Use Policy will not be penalised.
11. Cookies
See the Cookie Policy for what we use and how to manage it.
12. Children
The Service is for adults aged 18 and over. If you believe a minor holds an account, contact support@yallo.co and we will delete it.
13. Changes and contact
Material changes will be notified to account holders before taking effect. Controller: Yallo Management Consultancies L.L.C, Office G06-344, The Exchange Tower, Business Bay, PO Box 231525, Dubai, UAE. Privacy contact: Data Protection Lead, support@yallo.co.