Privacy policy

1. Who we are

Kolom is a free learning website. It is run by [OPERATOR LEGAL NAME] (“we”), who decides how your personal data is used (the “controller”). This policy covers the website, its e-mails and its paid plans.

Operator

[OPERATOR LEGAL NAME]

Legal form

[LEGAL FORM, e.g. sole proprietorship or private limited company]

Address

[REGISTERED ADDRESS]

Trade licence

[TRADE LICENCE NUMBER AND ISSUING AUTHORITY]

Digital Business ID

[DIGITAL BUSINESS ID (DBID), IF ISSUED]

e-TIN / VAT BIN

[e-TIN] / [VAT BIN, IF REGISTERED]

Privacy and legal e-mail

privacy@kolom.io

Data protection and complaints officer

[DATA PROTECTION AND COMPLAINTS OFFICER NAME]

2. If you do not sign in

You can read, listen to and practise with the free lessons without an account. Your progress, XP, streak, notes, bookmarks, flashcard reviews, exercise and lab drafts, podcast position and theme are then kept only in your browser’s storage. We do not receive them. Clearing your browser data removes them. The cookies and storage notice lists every item.

Your browser still talks to our servers to load pages, so our hosting providers see technical data such as your IP address (see technical data), and we count page views without identifying you (see analytics).

3. What we collect when you use an account

• Account: your name, username, e-mail address and password (stored only as a hash by our sign-in provider). With Google sign-in we receive your name, e-mail address, Google account id and profile picture address from Google; we never see your Google password.
• Profile details you choose to add: country, role, goals, weekly goal, time zone and links.
• Learning data: lesson progress, XP history, streaks, flashcard reviews, notes, bookmarks, quiz answers, exam attempts and answers, capstone projects, lab projects and results, drills, skill tests, your roadmap, badges, league results and certificates.
• Things you post: comments, comment reports and lesson feedback.
• Reviews you choose to write: the lesson, course, lab or path, your star rating and text, the role you typed, whether you chose your Google photo or your initials (with the photo, we copy its address from your Google sign-in), your consent to show it and when you gave it, and our decision (approved, featured, rejected with a reason, or hidden).
• Choices: your settings (leaderboard, public profile, e-mail reminders, the weekly letter) and your analytics choice, with when you made it.
• Account status: if our team suspends your account, when, by whom and why (see the terms). Your data is kept, not deleted, while an account is suspended.
• Payments (only if you buy something): the plan, the bKash transaction id (TrxID), the bKash number you paid from, the amount, any coupon and coins applied, the plan details you entered for plans sold before (for example a team name, seat count or a mentoring topic), the verifier’s decision and your invoices. We never see your bKash PIN or account balance. Details are on Payments and refunds.
• Membership: your plan and its dates (Plus or Premium), whether and when you received the free month of Plus, your coin balance and a record of every coin earned, held, spent, returned or adjusted (with the reason), and the coupons you used. If you receive the free month, we also keep a keyed hash of your e-mail address (HMAC-SHA256 with a secret key, not the address itself) so that the same address cannot get it twice; this hash is kept after you delete your account. When rewarded ads run on the Earn coins page, we also keep an id for each confirmed ad view and the day, to pay coins once and keep to the daily limit; the ad network’s own data use will be described here before any ad runs.
• Plus and Premium features: the weekly tasks you mark done and the projects you hand in (the lab, project name and your note); whether you want the weekly e-mail; the mentoring department you chose and your mentor; your mentor sessions (time, agenda you write, the mentor’s session notes, whether it was held, missed or moved and why, your rating and feedback); your replies to seminars and gatherings (going, not going or waiting) and whether you checked in; the notifications we show you in the bell; and a record of each e-mail we queue for you (kind, time, and whether it was sent or skipped). Mentors see your username, name, department, agenda and session history with them; staff see the same to run sessions and events.
• Career profile (only if you fill it in, in Settings): your industry, current role, years of experience, target role and a short goal note. We use it to personalise the weekly letter and to suggest mentors. You can edit or remove it in Settings at any time; removing it stops the personalisation.
• Weekly letter and announcements: for each learner, a log of which version of the weekly letter and which announcements were delivered, by which channel (e-mail or the notifications bell), when, and whether it worked (sent, skipped, failed), plus your choice to receive the letter or not.
• Messages with our team: the conversations in your inbox (what you and our staff write, when, who on our team answered, and whether the conversation is open or closed). Staff can also add internal notes to a conversation, for example to hand it over to a colleague; these are not shown in your inbox.
• Forms: the newsletter and course notifications keep the e-mail address you give. If you joined the old waiting list for paid plans, we keep your answers (plans, country, role, what you would pay and the price version you saw).

When you sign in for the first time, the progress saved in your browser is copied into your account and then cleared from the browser.

4. Analytics

To see which lessons help and where people get stuck, we count page views and a few actions (for example opening a lesson, starting an exam, or the first answer to a quiz question). Until you allow analytics, each record holds only what was viewed, the page path, your device type (phone, tablet or computer) and your country. It does not hold your account, a browser id, the referring site or campaign tags. Your browser keeps only your choice and, until the tab is closed, your country code, so it is looked up once.

If you click Allow, we also keep a random browser id, a visit id, and where you came from (the referring website and campaign tags in the link). When you sign in, that browser id and your first visit are linked to your account. If you later say no, we remove the browser id, the visit id, the referrer and the campaign tags from what was already sent, and unlink your account.

With your yes we also record which buttons and links you click (by a fixed name such as “pricing-upgrade” or the link’s page, never what you type), the pages you view in a visit, how far down you scroll and how long a page stays open, to see where people drop off. We never record the admin pages.

Google Analytics. Only after you click Allow, your browser loads Google Analytics 4 from Google. It sets the cookies listed in the cookies notice and sends Google the pages you view (without the query part of the address, except campaign tags), the key steps you take (signing up, opening and completing lessons, opening, running and exporting labs, viewing prices, starting a checkout and paying, with the plan and amount but no payment details), your device and browser type, and your IP address, from which Google works out an approximate location and which Google Analytics 4 does not store. We send no name, e-mail address, username or account id. Advertising features, Google signals and ad personalisation are off (Google Consent Mode: advertising storage stays denied). Google processes this data for us as a processor. If you say no, Google Analytics is switched off at once and its cookies are deleted from this browser; you can also use Google’s opt-out browser add-on (tools.google.com/dlpage/gaoptout).

Our host Vercel also counts page views and measures page speed (Vercel Web Analytics and Speed Insights). These use no cookies and no stored id: a visit is recognised for at most a day by a hash that cannot be turned back into your address. They are switched off in your browser if you say no.

We also count visits ourselves without cookies: for each page view our server works out a daily anonymous code from your IP address and browser, and stores only that code, the page, the referring site, a campaign tag, your device type and your country (never your IP address or browser details). The codes are deleted within two days, so visits cannot be linked from one day to the next or to you. This count is also switched off if you say no.

You can change your choice at any time here, in the cookies and storage notice or in your settings. If your browser sends a Global Privacy Control signal, we treat it as no. Apart from Google Analytics after a yes, we use no third-party analytics, and no advertising or tracking services.

5. AI feedback on your work (only when switched on)

Some features can use an AI model from Anthropic to give feedback: scoring written exam answers and capstone projects against a rubric, and the “Hint” and “Explain my error” buttons in the labs. These run only when we have switched them on. When they run, the text of your work (and, for a capstone, the text of pages at the links you submit), the task and the rubric are sent to Anthropic. We do not send your name or e-mail address.

The model gives scores and comments; whether you pass is decided by our own rules from those scores, and a person on our team can review the result. When AI review is off or its daily limit is reached, staff review the work instead. Under Anthropic’s commercial terms, it does not use this data to train its models, and it deletes it after a limited period (30 days by default under its current terms, longer if a request is flagged for misuse).

The AI Lab never uses a paid AI service and never sends what you type there to Anthropic or any other AI provider. If you choose to use its optional model, your browser downloads the model files (a few hundred megabytes) from Hugging Face, and the model runs on your own device. Hugging Face, like any website, receives your IP address and browser details for that download; it receives nothing you type. The files stay in your browser’s storage until you press “Delete the model” in the lab or clear your site data.

6. Technical data and security records

Like any website, our hosting providers receive your IP address, browser type and the pages you request when you visit, and keep short-term logs to run and protect the service. To stop spam and abuse we count form submissions, sign-ups, payment submissions and similar actions per IP address. We store only a keyed hash of the address (HMAC-SHA256 with a secret that changes every month and is deleted a few days later), so the stored value cannot be turned back into your address. These counts are deleted after 2 days. We also use your country, which our host works out from your IP address, for analytics and to show prices in a sensible currency.

Changes made by our staff (for example approving a payment or hiding a comment) are written to an audit log that cannot be edited.

7. Why we use it, and our legal basis

We use your data only for the purposes below. Where the law asks for a “legal basis” (for example the EU and UK GDPR), this is ours.

Where we rely on consent you can withdraw it at any time; this does not affect what we did before. Where we rely on legitimate interest you can object (see your rights).

8. What other people can see

• Leaderboards and weekly leagues: your username, name and XP, only if you switch this on in settings. It is off by default.
• Public profile: a page at /u/your-username with your certificates, badges, streak and project links, only if you switch it on. It never shows your e-mail address.
• Comments are public with your username.
• Reviews you write appear on the reviews page and may appear on the home page, only after you tick “Show my review, name, photo and learning stats on the site” and after our team approves them. They show your name, the role you typed, your Google photo or your initials, the stars and text, what you reviewed and your current learning stats (XP, streak, rank, league, lessons, certificates and badges; the stats only while your profile is public). Never your e-mail address. You can edit or delete a review at any time in Settings; deleting it takes it off the site at once, and so does deleting your account.
• Certificates have a verification code. Anyone with the code can check the certificate on the verify page, which shows the name on it, the course and the date. If you delete your account, your certificates stop verifying.
• Team plans (sold before): the person who runs a team sees who has joined it.
• Our staff see what they need for their role (for example, payment verifiers see payments, and the team members who answer the inbox see your messages and the internal notes). Staff roles and their permissions are enforced in the database.

9. Who processes your data for us

We do not sell your personal data or share it with advertisers. We use these service providers, who process data for us under their data processing terms:

Sign-up and sign-in e-mails are sent by Supabase’s e-mail service or by Resend, depending on our setup. We may also disclose data when the law requires it (for example a valid order from a court or authority), or to protect people from harm or fraud.

10. International transfers

We are based in Bangladesh and our providers run servers in several countries, so your data may be stored or processed outside the country you live in, including in the USA, Singapore and the European Union. Where data from the EU, UK or Switzerland goes to a country without an adequacy decision, our providers use the safeguards the law provides, mainly the European Commission’s Standard Contractual Clauses (with the UK addendum) and, for some US providers, the EU-US Data Privacy Framework. Bangladesh’s Personal Data Protection Act 2026 allows transfers abroad that are needed to provide a service you asked for or for education; we use only providers with strong security. Google Analytics data goes to Google LLC in the USA under Google’s data processing terms, which rely on the EU-US Data Privacy Framework and the Standard Contractual Clauses. You can ask us for more detail about these safeguards.

11. How long we keep it

12. How we protect it

• Everything travels over HTTPS.
• Database rules (row-level security) on every table mean you can read and change only your own data; points, exams, certificates, payments and leagues change only through checked server functions.
• Exam answer keys stay on the server and are never sent to your browser.
• Passwords are stored only as hashes by our sign-in provider. IP addresses are stored only as keyed hashes that rotate.
• Staff accounts have separate roles with only the permissions they need, and staff actions are logged.
• A content security policy limits where the site can load scripts from. It currently reports problems and is being tightened.
• Code and queries you run in the labs run in a sandbox in your own browser; graded challenges and exam tasks are re-run in an isolated sandbox on our server that has no access to our secrets.

No system is perfectly secure. If a breach is likely to harm you, we will tell you and report it to the authorities the law names (such as Bangladesh’s National Data Management Authority), without undue delay.

13. Your rights and how to use them

Depending on where you live (for example under Bangladesh’s Personal Data Protection Act 2026, the EU or UK GDPR, or Californian law), you have the right to:

• see the data we hold about you and get a copy in a portable format;
• correct it;
• delete it;
• withdraw consent and object to uses based on legitimate interest;
• restrict how we use it while a question is sorted out;
• complain to us, and to a data protection authority.

Do it yourself: signed in, open Settings. Download my data gives you everything we store about you as a JSON file. Delete my account deletes your account and learning data at once (payment records are kept as described above). You can correct your name and profile, and switch leaderboards, the public profile, e-mails and analytics on or off there too.

Ask us: write to privacy@kolom.io from the e-mail address on your account. We may ask you to confirm it is you. We correct data within 30 days and answer other requests within one month (we will tell you if a complex request needs longer), and we do not charge for it. If you are not happy with our answer you can complain to the data protection authority where you live or work (in Bangladesh, the National Data Management Authority; in the UK, the Information Commission (ICO); in the EU, your national data protection authority).

We do not use your data for decisions that are made only by a machine and have legal or similarly significant effects on you. AI feedback is checked against fixed rules and can be reviewed by a person; ask us if you think a result is wrong.

14. Cookies and browser storage

We use a sign-in cookie and browser storage to keep you signed in, remember your settings and save your work. We use no advertising or tracking cookies; Google Analytics cookies are set only after you allow analytics. Analytics ids are stored only after you allow them. The full list is in the cookies and storage notice.

15. Children

Anyone can read the free lessons without an account. To create an account you must be at least 13. If you are under 18, or under the age at which you can agree to online services yourself where you live (for example 14 to 16 in some EU countries), you need a parent’s or guardian’s permission, and a parent or guardian must make any payment. We ask you to confirm this when you sign up; we do not check identity documents.

For every learner, leaderboards, public profiles, e-mail reminders and analytics are off until switched on. The site is not directed to children under 13 and we do not knowingly collect their data. If we learn that a child under 13 has an account, we delete it. Parents or guardians can write to privacy@kolom.io to ask what we hold about their child or to have it deleted.

16. Notice for California and other US residents

We do not sell or “share” personal information as those words are defined in the California Consumer Privacy Act, and we do not use it for cross-context behavioural advertising. We honour Global Privacy Control signals. The categories of data we collect, why, and who receives it are described above. You can use the rights in your rights and we will not treat you differently for doing so.

17. Changes to this policy

When we change this policy we update the date at the top. If a change matters (for example a new kind of data or a new provider), we will say so on the changelog and e-mail account holders before it applies. If we ever want to use your data for something new that needs your consent, we will ask first.