Legal

Privacy policy

Last updated 6 November 2026. This policy covers this website, TotaleLearning Hub and the TotaleLearning Course Builder.

1. Who is responsible

Total eLearning Ltd, trading as TotaleLearning (company number 10806009), 71-75 Shelton Street, London, England, WC2H 9JQ is the controller for personal data about visitors to this website, people who sign up for or administer our services, and people we deal with as customers or suppliers. Contact us about anything in this policy at hello@totalelearning.com. Our ICO registration number is ZA772892.

Where a school, trust or business uses our services and puts personal data about its own staff, learners or contacts into them, that organisation is the controller and we act as its processor under a data processing agreement. Section 8 explains what that means for you if you are one of those people.

2. What we collect

Account details: your name, work email address, organisation, role, password (stored hashed) and the plan you choose.
Content you give us: documents you upload, briefs and notes you type into the builder, the courses built from them, and anything you type into the intake assistant. These may contain personal data about other people, such as staff named in a policy.
Payment details: handled by Stripe. We receive your Stripe customer reference, card brand, last four digits, and a fingerprint Stripe derives from the card number that lets us tell whether the same card has been used before. We never receive or store the card number or security code.
Usage and technical data: pages and features used, courses built, credits spent, the IP address and browser used to reach the services, and server logs kept for security.
Messages: emails and contact form submissions you send us, and a record of service emails we send you.
Hub learning records: for people using TotaleLearning Hub, the courses assigned to them, completions, scores and knowledge check responses, held for their organisation.

3. Why we use it and our lawful basis

To provide the services you or your organisation have asked for, including building courses from your content, taking payment and giving support. Basis: performance of a contract.
To prevent fraud and abuse, including limiting free trials to one per card, blocking disposable email addresses, and rate-limiting and logging requests. Basis: our legitimate interest in running a fair, secure service.
To send service emails such as email confirmation, invoices, plan changes, build problems and security notices. Basis: performance of a contract and legal obligation.
To remind people who signed up but did not choose a plan, with at most three short emails in the first week, each with a one-click link to stop them. Basis: legitimate interest, as a follow-up to a sign-up you started; you can opt out at any time.
To improve the services, using aggregated usage figures and build diagnostics. We do not use your documents or courses to train AI models. Basis: legitimate interest.
To meet legal obligations, such as keeping accounting records. Basis: legal obligation.

4. Who we share it with

We use these providers to run the services. Each processes data only on our instructions under a written agreement.

IONOS (hosting, Germany and UK data centres) for our servers and databases.
Cloudflare (UK and EU) for the website, DNS, security and encrypted off-site backups.
Stripe (EU and US) for payments and subscription billing.
OpenAI (US) to plan, write and illustrate courses and to produce narration. Content sent to OpenAI through its API is not used to train its models and is retained by OpenAI for up to 30 days for abuse monitoring.
MotionVid (US) to produce animated explainer videos from the course text, when you choose that video look.
Microsoft 365 (UK and EU) for sending and receiving email, and Resend (US) for messages sent from this website’s contact form.
Microsoft Clarity (EU and US) to see how visitors use this website and the public pages of the Course Builder site, only if you accept cookies. See section 6.

Where a provider is outside the UK we rely on the UK International Data Transfer Addendum to the EU standard contractual clauses, or on an adequacy decision, so that your data has equivalent protection. We also share data where the law requires it, with professional advisers, and with a buyer if our business is sold, who would take on the obligations in this policy. We do not sell personal data.

5. How long we keep it

Account details and content: while the account is open, then deleted within 90 days of closure.
Trial and fraud-prevention records, including the card fingerprint: up to two years, so a trial cannot be repeated by closing and reopening an account.
Invoices and payment records: six years, as required for tax.
Server and security logs: rolling, typically a few weeks.
Encrypted backups: database backups for 90 days and file backups for 30 days after a file is deleted, after which they are overwritten.
Hub learning records: for as long as the organisation keeps the account, under its own retention policy.

6. Cookies

The services set only the cookies needed to keep you signed in and to protect forms from forgery. Cloudflare may set a security cookie to tell browsers apart from automated traffic. These are essential, so no consent is needed for them.

This website also uses Microsoft Clarity, an analytics service, to see how visitors use the site (which pages are read, how far people scroll, where they click) so we can improve it. Clarity sets its cookies only if you choose Accept on the cookie notice. If you choose Decline, or your browser sends a Do Not Track signal, Clarity is not loaded at all. We use no advertising cookies and we do not sell personal data. You can change your choice at any time using the Cookie settings link in the footer of every page. The public pages of our Course Builder site (coursebuilder.totalelearning.com) use Clarity in the same way, with the same choice offered; once you sign in to Course Builder, nothing is recorded. Microsoft’s own handling of this data is described in the Microsoft Privacy Statement.

7. Your rights

You can ask us for a copy of the personal data we hold about you, ask us to correct or delete it, object to or restrict how we use it, and ask for it in a portable form. You can withdraw consent where we rely on it, and you can stop reminder emails with the link in any of them. To exercise a right, email hello@totalelearning.com; we respond within one month. You can also complain to the Information Commissioner’s Office at ico.org.uk, though we would like the chance to help first.

8. If your organisation uses our services

If you are a member of staff, a learner, or someone named in a document that your school, trust or employer has put into our services, that organisation decides why and how your data is used and is the right first point of contact for questions and requests. We process the data on its behalf, keep it confidential and secure, pass requests on to it promptly, and delete the data when the organisation asks or closes its account. Our services are for adults at work; where a Hub is used to train parents or to keep records about pupils, the school remains the controller and its own privacy notice applies.

9. Security

Data is encrypted in transit, servers are hardened and monitored, access is limited to the staff who need it, and backups are encrypted before they leave our servers. If a breach affects your data we will tell you and, where required, the ICO without undue delay.

10. Changes

We will update this policy when our practices change and show the date at the top. For significant changes we will tell account holders by email.