Privacy Policy

1. Scope and controller

This Policy applies to the hosted CloudLeek Service at cloudleek.com, including public cohort applications, admissions, classroom operations, and learning services. ATHLeek Studios LLC is CloudLeek's fiscal sponsor and proposed legal operator and controller, subject to the final sponsor agreement. Its public mailing address and sponsor-specific privacy contacts must be published before the cohort pilot opens. Operational requests may be sent to privacy@cloudleek.com. Self-hosted deployments are controlled by their operators and require their own notice.

This is a counsel-review draft. The cohort pilot requires ATHLeek approval and broad availability requires qualified legal review.

2. Information we process

• Account and profile: email, password hash, name, username, profile fields, preferences, role, plan, and account status.
• Public information: content you choose to publish through profiles, portfolios, progress, badges, or certificates.
• Applications and recruiting: contact details, goals, availability, experience, referral source. Retention: Unverified: 30 days; otherwise 24 months after final disposition.
• Admissions and enrollment: screening status, offer, waitlist, scholarship, enrollment. Retention: Three years after cohort completion.
• Guardian and emergency information: guardian contact, consent, emergency contact, authorized pickup. Retention: Emergency details: 90 days after cohort; consent evidence: six years.
• Cohort billing: tuition status, deposit, waiver, refund, Stripe identifiers. Retention: Seven years.
• Attendance and participation: presence status, arrival, departure, excused absence. Retention: Three years after cohort completion.
• Learning evidence: progress, quiz scores, lab checks, projects, submissions, feedback. Retention: Three years after cohort completion.
• Accessibility and accommodations: requested support, approved classroom accommodation. Retention: 90 days after cohort completion.
• Communications: email, SMS, announcements, instructor feedback, delivery state. Retention: 24 months after application disposition or cohort completion.
• Schedules and calendars: sessions, meeting links, calendar subscription, room assignment. Retention: Three years after cohort completion.
• Facilities and logistics: sites, rooms, equipment, checklists, issue reports. Retention: Two years after the related session.
• AI mentor: prompt, lesson context, answer, usage metadata. Retention: Prompts and answers are not retained; quota metadata follows the account.
• Security and technical records: IP address, user agent, audit event, error report. Retention: Routine logs: 30 days; staff evidence-access audits: 24 months.

The initial cohort application does not request guardian, emergency, accommodation, or payment information. A submitted birth date is used to derive an age band and adulthood date, then discarded.

3. Purposes and legal bases

We process data to review applicants; manage offers, waitlists, guardians, tuition, cohorts, schedules, facilities, attendance, instruction, and credentials; authenticate users; provide support; prevent abuse; maintain reliability; meet legal obligations; and protect people and property. Depending on location, the basis may be a requested pre-contractual step, contract, legitimate interests, legal obligation, or consent. Withdrawing consent does not affect earlier lawful processing.

Support indicators may identify inactivity, overdue work, repeated assessment difficulty, or absences for human review. CloudLeek does not make solely automated admissions, disciplinary, scholarship, accommodation, safeguarding, or enrollment-termination decisions.

4. Cookies and browser storage

We use first-party authentication and security cookies, local display preferences, and limited campaign-attribution values needed to understand how applicants found a cohort. We do not use advertising cookies or cross-site behavioral advertising. Browser controls may affect functionality.

5. Providers and disclosures

We disclose only what is reasonably needed to providers for hosting and databases, Stripe billing, SMTP email, optional SMS, Google or Microsoft calendars, the Anthropic AI mentor, sandboxed labs, and optional server-side Sentry monitoring. Providers process information under their contracts and may operate in other countries.

Recruiters, organization administrators, and assigned instructors receive only the information their role needs. An instructor does not receive a teen's detailed evidence until the separate guardian permission is recorded. Private lesson notes and AI mentor conversations are not instructor records. Public features disclose only information you or an authorized guardian elect to publish.

We may also disclose information to comply with law, protect safety and rights, investigate abuse, or complete a merger, financing, reorganization, or asset transfer with appropriate safeguards. CloudLeek does not sell personal data or share it for cross-context behavioral advertising.

6. Retention

• unverified applications: ordinarily 30 days;
• other applicant and recruiting records: ordinarily 24 months after final disposition;
• attendance and learning evidence: ordinarily 3 years after cohort completion;
• instructor feedback and cohort communications: ordinarily 24 months after completion;
• accommodation and emergency information: ordinarily 90 days after completion;
• staff evidence-access audits: ordinarily 24 months;
• application, security, and Sentry logs: ordinarily 30 days;
• support correspondence: ordinarily 24 months;
• consent and withdrawal evidence: ordinarily 6 years;
• billing and tax records: ordinarily 7 years; and
• deleted-account data in backups: scheduled to expire within 35 days.

We may retain information longer where law, litigation holds, fraud prevention, security, or dispute resolution requires it. Account deletion may anonymize audit records, while processors and backups complete their own deletion cycles.

7. Your rights and appeals

Depending on your location, you may request access, correction, deletion, portability, a list of relevant third parties, restriction, objection, or withdrawal of consent. You may also opt out of sale, targeted advertising, or qualifying profiling; CloudLeek does not conduct those activities at launch. We do not discriminate for exercising privacy rights.

Submit our privacy request form or email privacy@cloudleek.com. We may verify your identity and authorized-agent authority. We target a response within 30 days, subject to lawful extensions. If we deny a Connecticut request, reply with “Privacy Appeal”; we will explain the result and how to contact the Connecticut Attorney General. We honor legally required universal opt-out signals, including Global Privacy Control, for applicable processing.

8. Export and deletion

Account settings provide requests for access, correction, deletion, portability, opt-out, and appeal. Applicants without accounts may contact privacy support. Exports exclude passwords, security controls, protected staff notes, other people's data, and information we cannot lawfully disclose. Deletion remains subject to billing, tax, security, backup, dispute, and legal-retention requirements.

9. Children and teens

CloudLeek is not directed to children under 13 and does not knowingly enroll them. Users aged 13 through 17 require the applicable parent or guardian involvement. Enrollment, detailed instructor evidence, AI mentor access, public features, and communications use separate permission records. CloudLeek does not sell or target advertising to minors, collect precise geolocation for attendance, use addictive-design features to extend sessions, or provide learner direct messaging. Contact us if you believe a minor's information was collected improperly.

10. Security and international transfers

We use administrative, technical, and organizational safeguards designed for the nature of the data, but no system is perfectly secure. Report concerns to security@cloudleek.com. Data may be processed in the United States and provider locations; we use legally required contractual or other transfer safeguards where applicable.

11. Changes and contact

We keep policy versions and acceptance records. We will provide additional notice or seek renewed consent for material changes where required. Privacy questions and requests: privacy@cloudleek.com. Other channels appear on our contact page. ATHLeek Studios LLC's sponsor-specific contacts and public mailing address will appear here before the cohort pilot opens.