Privacy policy

How we collect, use, and protect your personal data

Effective Date: June 2026 

1. Introduction

AI Governance Institute is operated by Skill Up LLC (“we,” “us,” “our”), a limited liability company incorporated in the State of New Jersey, USA (Company Number: 0450466060), with its registered address at:

971 US Highway 202 N, Suite N, Branchburg, NJ 08876, USA

This Privacy Policy explains how we collect, use, disclose, and protect personal data when you visit AI Governance Institute or use our services.

We are committed to protecting your privacy and handling your personal data in accordance with applicable laws, including:

  • The General Data Protection Regulation (GDPR) — for individuals in the European Economic Area (EEA)

  • The UK General Data Protection Regulation (UK GDPR) — for individuals in the United Kingdom

  • The California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA) — for California residents

  • The CAN-SPAM Act — for email communications in the United States

  • Other applicable data protection laws in relevant jurisdictions

2. Data We Collect

2.1 Information You Provide Directly

We may collect:

  • Full name and email address (account registration)

  • Billing name and address (purchase processing)

  • Payment information (processed securely by Shopify, PayPal, Apple Pay, Google Pay — we do not store full card details)

  • Course completion and assessment data

  • Communications you send to us

2.2 Information Collected Automatically

When you use our platform, we may automatically collect:

  • IP address and approximate location

  • Browser type, operating system, and device information

  • Pages visited, time spent on pages, and clickstream data

  • Referral source

  • Cookie identifiers (see our Cookies Policy)

2.3 Information from Third Parties

We may also receive information from:

  • Payment processors (Shopify, PayPal, Apple Pay, Google Pay)

  • Analytics providers such as Google Analytics

  • Email and marketing service providers

3. How We Use Your Data

We use your personal data for the following purposes:

  • To process enrolments and deliver course content (contract performance)

  • To issue Certificates of Completion (contract performance)

  • To process payments and manage your account (contract performance)

  • To send service communications such as receipts, confirmations, and access details (contract performance)

  • To send marketing communications where permitted by law or with your consent (consent / legitimate interests)

  • To improve our platform and learning experience through analytics (legitimate interests)

  • To comply with legal obligations (legal obligation)

  • To detect, prevent, and address fraud, abuse, and security incidents (legitimate interests)

4. Legal Bases for Processing (GDPR / UK GDPR)

For users in the EEA and United Kingdom, we process personal data under the following legal bases:

  • Contract: Where processing is necessary to deliver purchased services (courses, access, certificates)

  • Legal Obligation: Where processing is required by law

  • Legitimate Interests: Platform improvement, analytics, fraud prevention, and security

  • Consent: Marketing communications and non-essential cookies

5. Data Sharing and Disclosure

We do not sell your personal data.

We may share your personal data with trusted third parties, including:

  • Shopify Inc. (e-commerce and payment processing)

  • PayPal Holdings Inc. (payment processing)

  • Apple Inc. (Apple Pay)

  • Google LLC (Google Pay and analytics services)

  • Email and communication service providers

  • Legal, regulatory, or law enforcement authorities where required

  • Professional advisers (lawyers, accountants, auditors) under confidentiality obligations

All third-party processors are required to handle personal data in accordance with applicable data protection laws.

6. International Data Transfers

As a global platform, your personal data may be transferred to and processed in countries outside your country of residence, including the United States.

Where we transfer personal data from the EEA or UK to countries not considered adequate under applicable regulations, we implement appropriate safeguards such as:

  • Standard Contractual Clauses (SCCs), or

  • The UK International Data Transfer Agreement (IDTA), where applicable

7. Data Retention

We retain personal data only for as long as necessary for operational, legal, and compliance purposes:

  • Account data: duration of account + 3 years after closure

  • Transaction records: 7 years (tax and legal compliance)

  • Certificate records: 5 years

  • Marketing preferences: until you unsubscribe or withdraw consent

  • Analytics data: according to provider retention settings

8. Your Rights

Depending on your jurisdiction, you may have the following rights:

EEA and UK Users (GDPR / UK GDPR)

  • Right to access personal data

  • Right to rectification of inaccurate data

  • Right to erasure (“right to be forgotten”)

  • Right to restrict processing

  • Right to data portability

  • Right to object to processing based on legitimate interests

  • Right to withdraw consent at any time

  • Right to lodge a complaint with a supervisory authority (e.g., UK ICO at https://ico.org.uk)

California Residents (CCPA / CPRA)

You may have the right to:

  • Know what personal information is collected, used, shared, or disclosed

  • Request deletion of personal information

  • Correct inaccurate personal information

  • Opt out of sale or sharing of personal information (we do not sell personal data)

  • Limit use of sensitive personal information

  • Non-discrimination for exercising your rights

To exercise these rights, contact us at: [email protected] with the subject line “Privacy Request”.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

  • SSL/TLS encryption

  • Secure payment processing

  • Access controls and authentication safeguards

  • Internal security policies and monitoring systems

However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

10. Children’s Privacy

Our platform is not directed to individuals under 18 years of age.

We do not knowingly collect personal data from children. If we become aware that a child has provided personal data without appropriate consent, we will take steps to delete such data promptly.

Please contact us at [email protected] if you believe a child has submitted personal data.

11. Marketing Communications

We may send marketing communications where permitted by law or where you have provided consent.

You may opt out at any time by:

You will still receive essential service communications such as account notices, purchase confirmations, and course-related updates.

12. Changes to This Policy

We may update this Privacy Policy from time to time.

Material changes will be communicated via email or platform notice where appropriate.

The latest version will always be available at our website. 

13. Contact and Data Controller Details

Data Controller: Skill Up LLC
Trading as: AI Governance Institute
Address: 971 US Highway 202 N, Suite N, Branchburg, NJ 08876, USA

Email: [email protected]
Website: AI Governance Institute