Last updated: 5 November 2026
Draft for the owner and a lawyer to review. Not legal advice.
This policy explains what personal data The Institution collects when you use theinstitutiongh.com, why we collect it, where it's kept, how long we keep it, and the choices you have.
1. Who is responsible for your data
The InstitutionGH, Accra Newtown, Accra, Ghana, is responsible for your personal data ("we", "us"). Contact: [email protected]. We're a data controller under Ghana's Data Protection Act, 2012 (Act 843), which requires every data controller to register with the Data Protection Commission (section 27). Our registration number: [Owner to fill in once registered].
2. What we collect
| Data | When | Why |
|---|---|---|
| Name and email address | When you create a free account | To create your account, send your sign-in links, and send course emails |
| Course progress (lessons opened and finished, quiz answers, private notes you write on lessons, questions you ask about lessons, the live site links you choose to list, and your certificate if you finish) | As you study | To save your place, show your progress, and send reminders about where you stopped |
| Payment status (what you bought, when, the amount, the currency, and the payment reference) | When you pay | To unlock what you paid for, keep financial records, and fix payment mistakes |
| Phone number, if you give it | Optional, at sign-up or later | To send you WhatsApp messages and text messages (SMS) about assignments and the course, only if you agree to each one in My account |
| Messages you send us (email, WhatsApp, Stuck Reports, screenshots) | When you contact us | To help you and answer your questions |
| Questions you ask the AI tutor, its answers, the lesson, the date and the amount of AI used | When you use the AI tutor in a lesson | To answer your question, to let teachers help when you press "Send to a teacher", and to improve lessons |
| Projects, assignments and lesson hand-ins (the links, answers, notes and files you hand in, the checks you ticked), our comments and marks | When you hand in work | To review your work, help you improve and decide your certificate. Files are stored privately; only you, your teachers and the owner can open them |
| Stage exams (the questions you got, your answers and when you saved them, practical answers, scores and teachers' marks) | When you take an exam | To mark it, show you what to revise, and decide a certificate with distinction |
| Peer review (comments you write on classmates' hand-ins and that they write on yours) | When you review or are reviewed | To help each other learn. Classmates see only your first name and the hand-in itself (not your files); teachers can see everything and remove unkind comments |
| Notifications (what's new for you, and when you read it) | As things happen | To show the bell in your dashboard |
| Lesson ratings, discussion posts, flashcard progress, prompt-practice attempts and your chosen goal (freelancer, job or your own business) | As you use those parts of the course | To improve lessons, let classmates help each other (they see your first name only), schedule your flashcards, score your practice prompts, and suggest lessons |
| Mentor details (a short bio and topics), if you become a mentor, and requests between mentors and students | Only if you volunteer or ask for help | To match students with graduates who help. Contact details are never shared through the site |
| Proposals and invoices you make for your clients | When you create them | To let you save and print them. Only you can see them |
| Client leads (a business's name, contact details, town and what they need) | When a business asks us for a website | To pass the request to one graduate we choose. Other graduates see the request without the contact details |
| Waitlist and free email course sign-ups (name, email, optional phone and your yes to texts) | When you join | To tell you when a cohort opens, or to send the 5 emails. Every message lets you leave or unsubscribe |
| Messages you send through the Contact page or Help | When you write to us | To answer you. Visitors get a private link to read our replies |
| "Ask us" chat messages on the public site | When you use the chat | To answer your questions (the messages are sent to Anthropic to write the answers). We store the chat with a scrambled code of your internet address, used only to stop abuse; no name or email |
| Visitor numbers (which public pages are opened and which site sent the visitor) | When you open a public page | To see how people find us. No cookies; a visitor is a scrambled code made with a key that changes every day, so nobody can be followed between days, and no internet address is stored. Kept for 13 months |
| Where you came from (the ad or tagged link you last clicked in the 30 days before, for example "facebook, campaign X", and the page you landed on) | When you arrive from an ad or a tagged link, and then sign up, join the email course or start a payment | To see which ads and links bring students, so we spend less on the ones that don't. Kept with your account or order |
| Ad measurement with Meta (Facebook) | When you use the Site, unless you turn it off in Cookie settings | To measure our Facebook and Instagram ads. See section 8 |
| Devices you sign in on (a short description such as "Chrome on Android", and when) | When you sign in | Each student account works on one device at a time, to stop accounts being shared. Signing in on a new device signs out the old one |
| A parent's or guardian's name, email and phone, if you add them | Only if you add them in My account | To give them a private, read-only page with your progress, assignments and exam results (never your notes, questions, contact details or payments). We only message them if they say yes on their own page, and either of you can stop it at any time |
| Your public portfolio (your name, headline, city, short bio, the sites and approved projects you list, your certificate) | Only if you switch your page to public | To show your work to people who may hire you. Your email and phone number are never shown on it |
| Hire requests (the name, business, contact details and message a business sends you, and a scrambled code made from their internet address) | When a business uses the "Hire" form on a student's page | To pass the request to the student, and to stop spam (no more than 5 requests a day from one address) |
| Referral details (who invited whom, which payments came through your link, what you earned) and the mobile money number you give us | When you share your invite link or someone uses it | To pay your referral rewards. The mobile money number is used for nothing else |
| Two-step sign-in (a secret for your authenticator app, and scrambled backup codes) | Owners and teachers, only if they switch it on | To protect the admin |
| Cohort details (attendance, recordings of live sessions you appear in, and work you share with the cohort) | If you join a cohort | To run the cohort and let classmates catch up on sessions they missed |
| Basic technical data (device and browser type, pages visited, approximate location from your IP address) | When you use the Site | To keep the Site working and secure |
Payments: card and mobile money details are collected and processed by our payment providers, Moolre and Zoe Pay. We never see or store your full card number, CVV or mobile money PIN. The provider tells us whether the payment succeeded, the amount and a reference.
We don't collect sensitive data such as health, religion or political views, and we ask you not to send it.
3. Why we use your data, and on what basis
- To provide what you signed up for or bought (your account, the course, the cohort, sign-in emails, receipts). This is needed to perform our agreement with you.
- To send course emails and WhatsApp messages (welcome, reminders, the course and cohort offers). We send these because you created an account and, for WhatsApp, because you gave your number and agreed. You can opt out at any time.
- To keep records we're required to keep, such as payment records for tax.
- To keep the Site secure and prevent misuse, such as account sharing or fraud.
- To improve the course, using progress data in summary (for example, which lesson most people stop at).
- The AI tutor's answers can be wrong. Check them against the lesson, or press "Send to a teacher". If you paste something that looks like a password or key, we don't send it to the AI or store it.
- Past students: we may add students from our earlier cohorts using our own records (name, email, WhatsApp number and cohort). We don't send them WhatsApp messages unless they agree, and the only email they get before they sign in themselves is one invitation to share their story, which they can ignore or unsubscribe from.
We don't sell your personal data. To measure our ads, we share a limited set of data with Meta (section 8); Meta may also use it under its own terms. You can turn this off at any time in Cookie settings at the bottom of every page, and then nothing more is shared with Meta.
4. Where your data is stored and who processes it
We use trusted service providers to run the Site. They process data only on our instructions.
| Provider | What it does | Where |
|---|---|---|
| Contabo (our own rented server) | Hosts the Site and its database (accounts, progress, purchases) | France (European Union) |
| Resend (Resend, Inc., USA) | Sends sign-in links and course emails | Its European Union region (Ireland) |
| Moolre Limited (licensed by the Bank of Ghana) | Takes payments by mobile money and card | A Ghanaian company based in Accra. Its privacy policy doesn't say where its servers are |
| Zoe Pay (Zoe, Accra), with its card and mobile money processor OmniBsic | Takes payments by mobile money and card | A Ghanaian company based in Accra. Its privacy policy doesn't say where its servers are |
| Cloudflare R2 (Cloudflare, Inc., USA) | Stores and delivers lesson videos, and stores files students attach to their work (privately, deleted with the account) | Stored in Cloudflare's eastern North America region (USA), delivered through Cloudflare's worldwide network |
| Meta Platforms (Facebook and Instagram) | Measures our ads, unless you turn ad cookies off in Cookie settings. The Meta Pixel in your browser, and our server, tell Meta when you view the course, sign up, join the email course, start a payment or pay (with the amount). Your email address, and your phone number if you gave it, are sent only as scrambled codes (SHA-256 hashes), with your browser details and internet address, so Meta can match them to its own accounts | Meta's servers, mainly in the USA and Ireland, under Meta's own privacy policy |
| WhatsApp (Meta) | Messages, if you give your number | Meta's servers, under WhatsApp's own privacy policy |
| YouTube (Google) | Free Module 0 videos and course previews, if you watch them there | Google's servers, under Google's own privacy policy |
| Cloudflare Turnstile (Cloudflare, Inc., USA) | Checks that public forms are filled in by a person, not a bot. It sees your internet address and browser details while you use a form | Cloudflare's worldwide network |
| Taysend (Ghana) | Sends text messages (SMS), only to students (and guardians) who said yes to texts. It receives the phone number and the message, and tells us whether it was delivered | A Ghanaian company. It doesn't say publicly where its servers are |
| Anthropic (Anthropic, PBC, USA) | Writes the AI tutor's answers, the "Ask us" chat answers and prompt-practice scores, and drafts a first comment on hand-ins for a teacher to check. It receives your question or the text of your hand-in (never your files, name or email) and the lesson's text. Anything that looks like a password or key is removed first | USA. Under its commercial terms it doesn't use what we send to train its AI models |
Some of these providers store data outside Ghana, mainly in the European Union and the USA. When we use a provider:
- we only choose ones that publish their security practices and agree in writing to process data only on our instructions and to keep it secure (their data processing terms);
- our own server, which holds your account, progress and purchases, is in France, under the EU's data protection law (the GDPR), which is stricter than most;
- we only send each provider the data it needs to do its job (for example, the email provider gets your email address, not your progress).
Act 843 applies to how we handle your data wherever it's stored. If you live outside Ghana, we also handle your data in line with the data protection law of your own country where it applies to us (Act 843, section 18(2)).
5. How long we keep it
- Account and progress data: while your account is open. If you don't sign in for 1 year, we'll email you, and delete the account if you don't sign in within 30 days of that email. Signing in once keeps your account, including anything you paid for.
- Payment records: for at least 6 years after the payment, even if you close your account, because Ghana's Revenue Administration Act, 2016 (Act 915, section 27) requires us to keep financial records for at least that long. If a payment is part of a tax review or dispute, we keep it until that's settled.
- WhatsApp number: until you ask us to stop messaging you, or close your account.
- Messages and Stuck Reports: up to 3 months after the conversation ends.
- Cohort work and progress: while your account is open. There's no fixed end date for the cohort room for now; if we set one, we'll email cohort students first.
- Backups: deleted data may stay in backups for up to 30 days before it's overwritten.
6. Your rights
Ghana's Data Protection Act, 2012 (Act 843) gives you rights over your personal data. In general terms, you can ask us to:
- tell you what personal data we hold about you and give you a copy;
- correct data that's wrong or incomplete;
- delete your data, where we don't need to keep it for a legal reason;
- stop using your data for marketing (emails or WhatsApp);
- object to how we use your data in some cases.
To make a request, email [email protected]. We may need to check it's really you. We'll reply within 1 week.
Stopping marketing: click "Unsubscribe" in any course email, or reply "stop" on WhatsApp. You'll still get sign-in links and receipts, because the account needs them.
If you're not happy with how we've handled your data, please tell us first. You can also complain to Ghana's Data Protection Commission. If you live outside Ghana, you may also have rights under your own country's law.
7. Security
We use encrypted connections (HTTPS), sign-in links that expire instead of passwords, limited staff access, and providers with strong security. No system is perfectly secure. If a breach affects your data, we'll tell you and the authorities as the law requires.
8. Cookies
Essential cookies (always on): to keep you signed in and to make checkout work. If you open someone's invite link or a partner's link, we keep one cookie for 30 days that holds their code, so they get credit if you buy. If you arrive from an ad or a tagged link, we keep one cookie for 30 days with the ad's tags (such as "facebook" and the campaign name) and the page you landed on, so we can see which ads bring students; it holds nothing about you. If you install the site as an app on your phone, lessons you open are saved on that phone so they work offline; they're cleared when you sign out or delete your account. Your chosen video speed is kept in your browser.
Ad cookies (on unless you turn them off): we use the Meta (Facebook) Pixel to see which of our Facebook and Instagram ads bring people to the site. It sets its own cookies (named _fbp and _fbc, kept for up to 90 days) and tells Meta which pages you view and when you sign up, join the email course, start a payment or pay. We also send those same events from our server, with your email address and phone number scrambled (hashed), so Meta can match them and measure our ads even if your browser blocks the Pixel.
You can turn ad cookies off at any time with Cookie settings at the bottom of every page. That stops the Pixel, deletes Meta's cookies on our site and stops our server sending your events to Meta; we remember your choice for 6 months. You can also control ads in your Facebook account (Settings → Ad preferences).
We don't use any other analytics or advertising cookies. Our visitor numbers use no cookies at all.
9. Children
You must be at least 10 years old to create an account. If you're under 18, a parent or guardian must agree before you sign up, and must make any payment. If you think a child under 10, or a child without a parent's agreement, has given us data, contact us and we'll delete it.
10. Changes to this policy
We'll post any changes here with a new "Last updated" date, and email account holders about important changes.
11. Contact
The InstitutionGH Accra Newtown, Accra, Ghana Email: [email protected] WhatsApp: +233 59 332 4653