Privacy notice
What personal data this platform processes, who receives it, how long it is kept, and the rights you can exercise.
Who processes your data
Your organization decides why and how your data is processed on its WeLearn space: it is the data controller.
Lunatech builds and operates the WeLearn platform on behalf of your organization: it acts as a processor and only handles your data to provide the service.
What data is processed
WeLearn processes the following categories of data about you.
Account and profile
Your email address, display name, optional profile picture, interface language, and the identity your organization's sign-in provider passes at login.
Learning activity
Your enrollments, progress through trainings, quiz answers, scores and completion outcomes.
Gamification
Experience points, badges, streaks, quest completions and the activity events shown on leaderboards and in the activity feed. Gamification is on by default, and every switch lives in Settings > Gamification. Leaderboard and activity-feed visibility is symmetric: if you hide yourself, you no longer see others either.
Notifications
Your in-app notification inbox and your per-channel notification preferences.
Personal access tokens
The name, scopes and expiry of the API tokens you create. The token secret itself is stored only as a one-way hash.
Who receives your data
Your data is shared with the following service providers, and with no one else. It is never sold or used for advertising.
Clever Cloud (hosting)
The platform and its database are hosted by Clever Cloud in the European Union.
Slack
Only when your organization installs the Slack integration. Your email address is used once to resolve your Slack account so the platform can send you direct messages, and notification and digest content is then delivered through Slack.
Email provider
Invitation and notification emails are sent through an email delivery provider.
Your organization's identity provider
Sign-in happens against the identity provider your organization configured. WeLearn receives the identity it asserts and stores no password.
YouTube and Vimeo
Embedded training videos are played directly from YouTube (in privacy-enhanced nocookie mode) or Vimeo by your browser. Those services see your IP address and browser details at play time, but no WeLearn identifiers.
Cloudflare (public demo only)
Only on the public demo's entry page. A Cloudflare Turnstile check confirms a person rather than a bot is asking for a demo seat, and Cloudflare sees your IP address and browser details for that check. It is never loaded on a real organization's space, and no WeLearn identifier is sent with it.
How long data is kept
- Your account and profile data are deleted when your organization offboards you.
- Learning and gamification history is anonymized on a schedule after your departure, so organization-level statistics survive without pointing back at you.
- Notifications and audit trails are kept for limited, time-bounded periods.
- In the public demo nothing is kept at all. The session ends after a short period of inactivity, and everything done during it, including anything you created, is deleted at that point rather than anonymized. There is no account and no email address to keep.
- The exact periods are managed per organization. See your organization's administrator for the current retention schedule.
Your rights
Under the GDPR you have the right to:
- Access: get a copy of the data held about you.
- Rectification: have inaccurate data corrected, starting with your display name and picture in Settings.
- Erasure: have your account and personal data deleted.
- Portability: receive the data you provided in a machine-readable format.
To exercise any of these rights, contact your organization's administrator, who handles requests on behalf of the controller.
Cookies
The platform sets only the cookies it needs to sign you in and keep you in your organization's space. There are no tracking or analytics cookies.
| Cookie | Purpose | Duration |
|---|---|---|
| q_session_* | Your sign-in session, encrypted. No tokens are ever exposed to the browser. | Session |
| welearn_tenant | Remembers which organization space you are in. | Persistent |
| __Host-welearn_session | Sign-in session on organizations using the shared login. | 8 hours |
| __Host-welearn_social_state_* | Protects the shared login handoff against forgery. | A few minutes |
| __Secure-welearn_setup | Short-lived session while a new organization space is being set up. | 30 minutes |
| __Secure-welearn_slack_install_state | Protects the Slack install flow against forgery. Administrators only. | 10 minutes |
All of these cookies are strictly necessary to provide the service, which is why no consent banner is shown.