Skip to content
The AI Stairway™ withOpen Study College logo

Privacy notice

The AI Stairway™ is run by Scorchsoft Ltd, the data controller for this site.

What we keep

  • Your account: your name, email, password (stored only as a one-way hash), and the organisation and job title if you give them.
  • Your learning: which modules you’ve opened, where you are in each, your check scores, the time spent, and the choices you make in the course’s graded questions and scenes. Private notes, reflections and feelings check-ins stay inside the course’s saved state so you can resume; we don’t read or report them.
  • Enquiries: what you send us when you ask to buy or ask a question.
  • Recommendations: if you share your recommendation code, which orders used it and whether they were paid; if you use someone’s code, that you did. The person whose code you used sees only that an order was made and when, never your name or email. If you claim the signed book or the session with Andrew, we keep what you send (your postal address, or your times and phone number) only until it’s done, and Andrew keeps the email it came in for his records.
  • Access codes: if you redeem an access code from one of our partners, which code you used, when, and the modules it unlocked. The partner sees that the code has been used and when, and any note they wrote when they gave it out, but never your name, email or progress.
  • A place from a partner: if a partner you bought the course from set up your account, which partner, when, the price it told us it sold at, and its order reference. The partner gave us your name and email (and your organisation, if it bought your place) so we could set up your account. The partner sees your name and email, whether you’ve set your password and started, and how many of your modules you’ve finished, so that it can help you. It never sees your scores, answers or notes, or anything you have from elsewhere. We use the record to invoice the partner, and to see which purchases on our site came from people a partner introduced. The partner is responsible for what it does with your details, under its own privacy notice. This is only for a purchase through a partner: someone who gives you a gift, invites you to a team or recommends the course doesn’t see your progress this way.
  • Your learning plan: if you set one, your pace, your learning days and time, your time zone, why you’re doing it (if you say), and whether you’d like reminders. We use it to show your plan back to you and, if you ask, to email a reminder on your learning days. Every reminder has a link to stop them. Only you see your plan.
  • Your place in the series: the continuation codes the modules give you, and the parts of your final plan you write in Modules 8 to 10 (up to 600 characters each), so the next module picks up where you left off on any device you sign in on. Only you see them, and they’re deleted with your account.
  • Feedback: what you send from the Feedback page, with your name and email so we can reply if you’d like us to.
  • Accepting our terms: which version of the terms you accepted, when, and where (signing up, or when the site asked you), as the record that you agreed to them.
  • Security records: the IP address and browser of each sign-in, to keep your account safe.

Why

To run your account and the course you’ve asked for (contract), to keep the service secure (legitimate interests), and to email you occasional updates about Scorchsoft’s own AI training and services, which are like the course you’ve signed up for (the “soft opt-in” in the Privacy and Electronic Communications Regulations, and legitimate interests). The box for these emails is ticked when you sign up: untick it if you’d rather not have them. You can also stop them at any time, with the unsubscribe link in every email or in your account.

Who sees it

The Scorchsoft team who run the course. If your organisation bought your place, we may share your progress and completions with the person who arranged it. Our suppliers are Cloudflare (hosting, storage and security), PlanetScale and Amazon Web Services (database and cloud infrastructure), MailerSend (account and course emails), Google (business email and collaboration), Atlassian and Slack (support and project communications), OpenAI and Anthropic (AI-assisted support and administration) and, if you haven’t opted out of our emails, Mailchimp, which sends them. So those emails suit where you are, Mailchimp also hears a few milestones: finishing the introductory module or a series, becoming a customer, and recommending the course. It never hears your answers or scores. We give each supplier only what it needs for its job, and none of them may use your details to train AI models. Some of them process data outside the UK, protected by the UK’s adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework) or by the UK’s international data transfer agreement or addendum. When you open one of Scorchsoft’s assessments or book a call from your learning pages, we note that you opened it and when, so our team knows it interested you; what you enter on Scorchsoft’s website is covered by its own privacy notice. We never sell your details. If you earn a series certificate, anyone you give its code to can check it at /certificates/<code>: the check shows the name on the certificate, the award and the date, and nothing else.

How long

For as long as you have an account, and for up to two years after you last sign in, unless you ask us to delete it sooner. Invoicing records are kept as the law requires.

Your rights

You can ask for a copy of your data, ask us to correct or delete it, or object to how we use it. Email info@scorchsoft.com, or see our contact page. You can also complain to the Information Commissioner’s Office (ico.org.uk).

Cookies

One cookie keeps you signed in, and it’s needed for the site to work. A second, readable one (holding only “1”) tells the public pages that you’re signed in. Scorchsoft staff get one more, which remembers whether they folded the admin menu.

Analytics and marketing, only if you agree. When you first visit, we ask. You can accept all, reject all, or choose:

  • Analytics: how the site is used (which pages are visited, how people arrive), so we can improve it, through Google Analytics.
  • Marketing: measuring our adverts, and showing them to people who might find the course useful, through Google Ads, Meta (Facebook and Instagram), Microsoft Advertising (Bing) and OpenAI (ChatGPT).

What the marketing tools receive. If you accept marketing, each one learns that a page was viewed, and when you sign up, ask a question or buy (with the order’s value), along with your browser, your IP address and its own cookie identifier. That lets it tell whether one of its adverts brought you here, and show our adverts to people like you. Meta also receives these events through its Conversions API Gateway, a server Meta runs for us that passes the same events on to Meta. Each company uses this data as its own privacy policy describes, and may process it outside the UK: Google (opens in a new tab), Meta (opens in a new tab), Microsoft (opens in a new tab) and OpenAI (opens in a new tab). If you don’t accept marketing, Meta’s, Microsoft’s and OpenAI’s tools don’t run at all.

Every page loads Google Tag Manager, which runs these tools and tells them your choice. Until you agree, they set no cookies: Google’s tools send only basic signals without cookies (such as that a page was viewed, with your browser type), which Google uses to estimate visits and conversions it can’t measure. If you agree, they set their own cookies for what you agreed to. Your choice is kept in your browser for 12 months, and you can change it at any time with “Cookie settings” at the foot of every page. We never pass your name, email or learning progress to these tools.

Films from YouTube. On a partner’s own address, its film may play from YouTube, in its privacy-enhanced mode (youtube-nocookie.com): YouTube sets no cookies until you press play. Once you do, YouTube’s own privacy policy applies to what it collects.

Campaign tags. If the link that brought you here had campaign tags (the “utm_” parts of the address, such as utm_source=linkedin), your browser keeps them in its local storage for up to 90 days. They say which campaign or post you came from, not who you are. They stay in your browser unless you send us a form, such as Get started or registration, when they’re sent with it so we can see which campaigns work. Nobody else sees them. To remove them, clear this site’s data in your browser.