Legal

Privacy policy

Last updated October 19, 2026

What EnrollClass collects, why, where it is kept, and the choices you have.

1. Controller

EnrollClass, operated by Agile Agilist is the controller for the platform itself (provider accounts, billing, security logs). For learner data submitted through a provider's registration page, the provider is an independent controller and EnrollClass processes that data on the provider's behalf to run the registration.

2. What we collect

• Learners: name, email, company and billing address when given, the cohort registered for, invoices, and the status of the registration (paid, transferred, cancelled, certificate issued).
• Payment details: card numbers are entered directly into Stripe and never reach EnrollClass servers. We keep Stripe's reference to the payment, the amount, and the last four digits where Stripe provides them.
• Providers: business name, contact email, Stripe account reference, course and cohort content, and dashboard activity.
• Technical: request logs with IP address and timing for security and troubleshooting, retained for 30 days. Logs do not contain query strings, credentials, or email addresses.

3. Why we use it

To confirm and manage registrations, send confirmation, reminder and certificate emails, hold and release funds, prevent fraud, meet tax and accounting obligations, and support users. Providers may use our AI drafting tools on their own course descriptions and messages; learner records are not used to train any model.

4. Who else sees it

Subprocessors, each bound by their own data protection terms: Stripe (payments and provider payouts), Resend (transactional email), Hostinger (hosting, Netherlands), Cloudflare (DNS and email routing), Anthropic (AI drafting for providers, prompt content only). Optional integrations a provider enables, such as Zoom, Microsoft Teams or HubSpot, receive the attendee details needed for that integration. We do not sell personal data.

5. Where it lives and how long

Production data is stored in the European Union (Netherlands) with encrypted backups. Registration and financial records are kept for seven years to satisfy tax and accounting rules, then deleted. A provider can request deletion of a learner's non-financial details at any time; we also honour requests from learners directly where the provider has closed its account.

6. Your rights

Depending on where you live (including under GDPR, UK GDPR, PIPEDA and provincial Canadian law) you may ask to access, correct, export or delete your personal data, or object to certain processing. Learners should contact their provider first, since the provider owns the registration; or write to us and we will route the request. We answer within 30 days.

7. Cookies

The dashboard and learner pages use only strictly necessary cookies for sign-in and form protection. The marketing site sets no cookies and uses no third-party analytics.

8. Security

Traffic is encrypted in transit, the database is reachable only from the application, credentials are stored hashed, and access to production is limited to named staff using key-based authentication. Report a vulnerability to security@enrollclass.com.

9. Contact

Privacy questions and requests: privacy@enrollclass.com. You may also complain to your local data protection authority.