Privacy Policy
California Academy of Management — operated by Replatform
P.O. Box 79118, Mong Kok Post Office, Hong Kong
Privacy contact: privacy@californiaacademy.net
Last Updated: July 16, 2026
1. Who We Are
California Academy of Management is a private online professional training provider operated by Replatform, a company registered in Hong Kong (Company Registration No: 41608786-000). In this Privacy Policy, "we," "us," and "our" refer to Replatform.
For the purposes of the General Data Protection Regulation (GDPR) and UK GDPR, Replatform is the data controller for personal data collected through californiaacademy.net.
For the purposes of the California Consumer Privacy Act (CCPA/CPRA), Replatform is the business responsible for personal information collected from California residents.
2. What Personal Data We Collect
We collect the following categories of personal data:
| Category | Examples | How Collected |
|---|---|---|
| Identity data | Full name, username | Account registration |
| Contact data | Email address | Account registration, support |
| Account credentials | Hashed password | Account registration |
| Profile data | Language preference, job title (if provided) | Account profile |
| Payment data | Transaction ID, last 4 digits of card, billing country | Payment processor (we do not store full card numbers) |
| Learning data | Course progress, quiz scores, time spent, assignment submissions | Platform activity |
| AI interaction data | Text submitted for AI feedback on assignments | Platform activity |
| Device and technical data | IP address, browser type, operating system, referral URL | Automatic collection |
| Cookie and usage data | Session identifiers required for login and security | Strictly necessary cookies only — see Section 7 |
| Communications | Emails and messages sent to our support team | Direct contact |
We do not knowingly collect data from children under 16 years of age. If we become aware that we have collected data from a person under 16 without verifiable parental consent, we will delete it promptly.
3. How We Use Your Personal Data
| Purpose | Legal Basis (GDPR) |
|---|---|
| Creating and managing your account | Performance of contract |
| Delivering course content and tracking progress | Performance of contract |
| Processing payments | Performance of contract |
| Sending enrollment confirmations and course-related communications | Performance of contract |
| Providing AI-powered learning feedback on submitted assignments | Performance of contract / Legitimate interests |
| Responding to support requests | Legitimate interests |
| Improving our platform and courses | Legitimate interests |
| Preventing fraud and ensuring security | Legitimate interests |
| Sending you account-related security notices (e.g. registration, password changes) | Legitimate interests / Legal obligation |
| Complying with legal obligations (e.g. financial record-keeping) | Legal obligation |
We do not currently send marketing or promotional email. If this changes in the future, we will only do so with your explicit, opt-in consent, and this policy will be updated accordingly.
AI Disclosure: When you submit assignments or interact with AI feedback tools on our platform, your text input may be processed by a third-party AI provider (see Section 5). This is necessary to deliver the AI-powered feedback service. We do not use your personal assignment text to train AI models without your explicit consent.
4. How Long We Keep Your Data
| Data Type | Retention Period |
|---|---|
| Account data (name, email, profile) | For the life of your account, plus 12 months after account closure |
| Learning records and certificates | 5 years after program completion (so you can request re-issuance) |
| Payment and transaction records | 7 years (required for tax and accounting compliance) |
| Support communications | 3 years after resolution |
| Audit / security logs (e.g. login history) | 2 years |
After the applicable retention period, your data is securely deleted or anonymised. See Section 8 for how to request earlier deletion.
5. Sharing Your Personal Data
We do not sell your personal data to third parties.
We share your data only in the following circumstances:
5.1 Service providers (data processors): We share data with trusted third-party companies that help us operate our platform:
- Payment processing: Stripe, Inc. — processes payments on our behalf
- Cloud hosting and email delivery: Amazon Web Services (AWS), including Amazon SES for transactional email
- AI feedback tools: one or more of DeepSeek, OpenAI, or Anthropic, depending on current configuration — processes assignment text to generate AI feedback
5.2 Legal requirements: We may disclose your data if required to do so by law, court order, or government authority, or where we believe disclosure is necessary to protect our legal rights or the safety of others.
5.3 Business transfers: If Replatform is acquired, merged, or transfers its assets, your data may be transferred to the successor entity. We will notify you by email before such a transfer occurs.
We will never share your data with third-party advertisers for their own marketing purposes without your explicit consent.
6. International Data Transfers
Replatform is based in Hong Kong. Your data is processed in the United States (AWS us-west-2 region) and may be transferred to and processed in other countries where our service providers operate.
For transfers of EU/UK personal data outside the European Economic Area or United Kingdom, we rely on one or more of the following safeguards:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- UK International Data Transfer Agreements (IDTAs) approved by the UK ICO
- Transfers to countries with an adequacy decision from the European Commission
By using our services, you acknowledge that your data will be transferred internationally as described above.
7. Cookies
We use only strictly necessary cookies on our Site — for login sessions, CSRF/security protection, and remembering your language preference. These cannot be disabled without breaking core site functionality, and under GDPR/UK GDPR do not require consent.
We do not currently use analytics, advertising, or tracking cookies. If this changes, we will implement a compliant cookie consent mechanism and update this policy before doing so.
8. Your Rights
8.1 Rights under GDPR (EU and UK residents)
If you are located in the European Union, European Economic Area, or United Kingdom, you have the following rights:
- Right of access: Request a copy of the personal data we hold about you
- Right to rectification: Request correction of inaccurate or incomplete data
- Right to erasure ("right to be forgotten"): Request deletion of your personal data, subject to our legal retention obligations
- Right to restriction: Request that we limit how we process your data in certain circumstances
- Right to data portability: Receive your personal data in a structured, machine-readable format
- Right to object: Object to processing based on legitimate interests at any time
You can exercise your right to access and export your data ("Download My Data") or request account deletion ("Delete My Account") directly from the account menu once logged in. For any other request, email privacy@californiaacademy.net. We will respond within 30 days and may ask you to verify your identity first.
You also have the right to lodge a complaint with your local supervisory authority (your national Data Protection Authority in the EU, or the UK Information Commissioner's Office at ico.org.uk).
8.2 Rights under CCPA (California residents)
If you are a California resident, you have the following rights under the CCPA/CPRA:
- Right to know: Request disclosure of the categories and specific pieces of personal information we have collected about you
- Right to delete: Request deletion of personal information we have collected from you, subject to certain exceptions
- Right to correct: Request correction of inaccurate personal information
- Right to opt-out of sale or sharing: We do not sell your personal information
- Right to non-discrimination: We will not discriminate against you for exercising any of your CCPA rights
To submit a CCPA request, email privacy@californiaacademy.net with the subject line "CCPA Rights Request." We will respond within 45 days (with a possible 45-day extension if needed, with notice).
9. Data Security
We implement appropriate technical and organisational security measures to protect your personal data, including:
- Encrypted data transmission (HTTPS/TLS)
- Encrypted storage of passwords (bcrypt hashing with per-password salt)
- Encryption of sensitive configuration secrets at rest
- Access controls limiting data access to authorised personnel only
- An audit log of security-relevant account events (logins, password changes)
No method of internet transmission or electronic storage is 100% secure. We cannot guarantee absolute security but are committed to protecting your data to industry-standard levels.
In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and relevant supervisory authorities as required by applicable law.
10. Links to Other Websites
Our Site may contain links to third-party websites. We have no control over and are not responsible for the privacy practices of those websites. We encourage you to read their privacy policies before providing any personal data.
11. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify you of material changes by posting the updated policy on this page with a new "Last Updated" date, and where required, by email notification.
12. Contact Us
If you have any questions, concerns, or requests about this Privacy Policy or how we handle your personal data, please contact us:
Replatform (trading as California Academy of Management)
P.O. Box 79118, Mong Kok Post Office, Hong Kong
Email: privacy@californiaacademy.net
We aim to respond to all privacy inquiries within 14 business days.