1. Who we are and what this covers
Lernoa Business is a product of Corvidae Limited, Auckland, New Zealand ("Lernoa", "we", "us"). This policy applies to this website (business.lernoa.com) and to Lernoa Business workspaces: the staff training, records and reminders that an employer sets up for its people.
It does not apply to a person's own personal Lernoa account at lernoa.com. That account is separate, has its own privacy policy and terms, and its content is never visible to an employer.
We handle personal information under the New Zealand Privacy Act 2020. For people in the United Kingdom, the European Union and Switzerland we also respect the law that applies there: see section 12. For workspace content, our Data Processing Addendum is part of the Terms of Service and applies to every workspace. A business agreement signed by both of us applies too, and prevails if it differs from this page.
2. Your workspace and our role
For workspace content we act as the employer's service provider (its processor). The documents an employer uploads, the training drafted from them, who was assigned what, and each person's scores and sign-offs belong to the employer's workspace. The employer decides what goes in, who is a member and how long records are kept. We process that information on the employer's behalf, to provide the service and for nothing else, under our Data Processing Addendum.
For everything else we are responsible for the information ourselves: people who visit this website, send us an enquiry, start a trial or ask for a quote, and the contact and billing details of the people who administer a workspace.
If you are a learner in a workspace and want to see or correct your training record, ask your employer first. They hold it. You can also contact us and we will point you to the right person or help the employer respond.
3. What we collect
On this website. When you send us an enquiry or ask for a quote, you give us your name and work email and, depending on what you ask for, your company, its website, team size and any message. If you arrived through an advertisement or a tagged link, the campaign tags in that link (for example utm_source or an advertising click identifier) are sent with your request. We read them from the address bar when you send the form; we do not store them on your device. Our hosting and security provider also processes technical request data such as your IP address. Enquiries and any email you send us reach our support mailbox, which is hosted by Zoho Mail in Australia.
In a workspace. Names and work email addresses of members, their roles, the documents an employer uploads, pictures and videos added to lessons, the company details and website address an employer gives us, training drafted from them, assignments and due dates, answers and scores, the wording, time and network (IP) address of each acknowledgement and signature, certificates, questions a person sends through "I have a question", reminders sent, and a log of changes made by administrators. Where an employer has turned personal focus on, it also holds each person's strengths and focus areas.
Billing. Payments are handled by Stripe. We receive the invoice contact, the plan, the number of people and the payment status. We never see full card numbers.
4. How we use it
- to run the service: draft training from your documents, assign it, send reminders, record results, add practice sections where a person needs them (if the employer has turned personal focus on) and produce exports;
- to answer your enquiries and quote requests, run your trial, and contact you about your account;
- to bill, to keep the service secure and to prevent abuse;
- to understand how the service is used and to improve it, using statistics that do not identify a workspace or a person;
- to meet legal obligations.
We do not sell personal information. Your documents are used only to draft your training. They are not used to train AI models.
5. AI processing
Course drafts and answers to Ask are produced by AI models run through Amazon Bedrock, from the document you upload, with page references so a reviewer can check every line. The text is read out of your PDF or Word file by our own service. Amazon Bedrock does not use your content to train its models.
If an administrator turns narration on, the chapter text is sent to Amazon Polly to be read aloud. Polly receives nothing otherwise. We have opted out of AWS using content processed by its AI services, such as Amazon Polly, to improve those services. Where each provider runs is listed below.
When an employer gives us its website address, we read a few of that website's public pages and an AI model writes a short summary of the organisation for the course writer, leaving out names, email addresses and phone numbers. We also collect the logo, colours and tagline for the workspace's branding.
AI output can be wrong or incomplete. Nothing the AI writes reaches your staff until an administrator has reviewed and published it.
Personal focus is a workspace setting that an administrator can turn on or off. When it is on, a focus section is drafted by AI from the employer's course, once per topic. No person's name or results are sent to the AI. Who receives a section is decided by a fixed rule on their final assessment answers, not by AI.
6. What the employer can see
The employer sees training status and due dates, scores and when they were achieved, which questions were answered wrongly, the acknowledgement wording and time, certificates, and the questions a person sends through "I have a question". Where the employer has turned personal focus on, the employer also sees each person's strengths and focus areas, which Lernoa Business works out from their final assessment answers only, to add short practice sections to their next course. Each person sees their own.
Personal focus is off by default for workspaces in the United Kingdom, the EU/EEA and Switzerland, and on by default elsewhere. An administrator can turn it on or off at any time. Turning it off deletes the strengths and focus areas already recorded. The employer is responsible for telling its people when it is on. Our UK and EU page has a notice template and the points to consider first.
The employer does not see a person's reader notes, highlights and bookmarks, their Ask chat history, their study time and reading position, their practice-quiz answers, or anything in their personal Lernoa. Work content and personal content never mix.
9. How long we keep it
Training records belong to the workspace and stay when a person leaves. If a licence ends, the workspace's records stay read-only and exportable for 12 months, and we email the administrators 30, 7 and 1 days before anything is deleted. A closed workspace is then deleted automatically, uploaded files included. An employer can export records as a CSV or a per-person PDF at any time.
An employer can also erase one person's personal data from a workspace at any time: the person's name is replaced with a placeholder, and their contact details, notes, highlights, focus areas, questions, the text, images and IP addresses of their signatures, and their certificates are deleted. Anonymous completion figures stay, so the workspace's counts still add up.
Enquiries are kept while we are in contact with you and are deleted when you ask. Lernoa staff can delete an enquiry or a Business account on request. A trial workspace's content is deleted 30 days after the trial ends, unless a licence is bought or you ask us for an export first. Billing records are kept as long as the law requires. The database is backed up once a day and each backup is kept for 14 days, so what we delete is gone from the backups within about 15 days.
10. Security
Data is encrypted in transit. Workspace roles (Owner, Admin, Manager, Learner) decide who can see and change what, and every change by an administrator is written to an audit log with the IP address and browser it came from. Every account can turn on two-step sign-in with an authenticator app or text-message codes. Single sign-on is not available yet. The Security page has the detail, Annex II of the Data Processing Addendum lists the measures, and we answer security questionnaires on request.
11. Your rights and complaints
You can ask us for the personal information we hold about you and ask us to correct it. Email [email protected]. For workspace records, the employer decides, and we will help them respond: it can export your records, correct your details and erase your personal data from the workspace itself. For what we hold ourselves, such as an enquiry or a Business account, we delete it when you ask unless we must keep it. If you think we have handled your information wrongly, tell us first so we can put it right. You can also complain to the New Zealand Office of the Privacy Commissioner. If the law where you live gives you further rights, we will respect them: section 12 sets them out for the United Kingdom, the European Union and Switzerland.
This website and Lernoa Business workspaces are for working adults and are not directed at children.
12. People in the UK, the EU/EEA and Switzerland
This section applies where the UK GDPR, the EU GDPR or the Swiss Federal Act on Data Protection applies to our handling of your personal information. It adds to the rest of this policy and does not replace it.
Workspace content. As section 2 says, for what an employer puts into a workspace the employer is the controller and decides why and how it is used, and we are its processor. The employer is responsible for its legal basis and for telling you about it. To use your rights over workspace records, ask your employer first; we will help them respond.
Where we are responsible ourselves, we rely on these legal bases:
- Enquiries, quote requests and trial sign-ups. Our legitimate interests in answering people who contact us and running the trial they asked for, and, where you ask us to do something before a contract, taking those steps.
- Administrator and billing details. The contract with the organisation you administer for, and our legal obligations to keep financial records.
- Security and preventing abuse. Our legitimate interests in keeping this website and the service secure.
- Understanding and improving the service. Our legitimate interests, using statistics that do not identify a person.
Your rights. You have the right to ask us for access to your personal information, for it to be corrected or erased, and for us to restrict how we use it. You can ask us to give it to you in a portable form, and you can object to our using it on the basis of legitimate interests. Email [email protected].
Complaints. You can complain to a supervisory authority. In the United Kingdom that is the Information Commissioner's Office. In the EU or the EEA it is the data protection authority in the country where you live or work, or where you think the problem happened, and the European Data Protection Board lists them. In Switzerland it is the Federal Data Protection and Information Commissioner. We would like the chance to put things right first, but you do not have to wait.
Where we process it. Our own records are kept in New Zealand, which has an adequacy decision from the European Commission and is recognised by the United Kingdom and Switzerland. Section 7 and the Sub-processors page say where else information goes and the safeguards we rely on.
Our representatives in the EU and the UK.
We are appointing representatives in the European Union and the United Kingdom. Until their details are listed here, contact us at [email protected].
13. Changes and contact
If we change this policy in a way that matters, we will update the date at the top and tell workspace administrators by email. Questions: [email protected], Corvidae Limited, Auckland, New Zealand.