Who is responsible
The data controller is Qodoxo AB, organisation number 556948-0493, registered office Stockholm, Sweden. PlatformEngr® is a registered trademark of Qodoxo AB.
For anything about your data, write to [email protected].
The short version
- You can read every course without an account. We collect nothing about you then, apart from ordinary server logs.
- When you sign in with GitHub, we keep your GitHub profile basics, your course progress, and what you choose to tell us.
- We use one session cookie to keep you signed in. No advertising or tracking cookies, and no third-party analytics.
- If you take an exam, your written answer is sent to an AI provider for grading.
- You can export your data or delete your account from your dashboard at any time.
What we collect and why
| What | Examples | Why | Legal basis |
|---|---|---|---|
| GitHub sign-in data | GitHub user ID, username, name, email, avatar URL, and the date your GitHub account was created | To create your account and sign you in. The account date decides when you get gift codes to give (accounts under 90 days old get them after a first passing lab check), to limit throwaway accounts | Contract |
| Learner code | A short code like pe-7k2m9q |
So lab checks and exams know a repository is yours | Contract |
| Course progress | Modules done, quiz answers, badges and the name you enter for your completion record, as saved by the course pages, and the path you choose per track (course only or certificate) | To save your progress across devices and show the steps for the path you chose | Contract |
| Repositories and lab checks | The repository you register, the commit checked and the results. We read the repository’s files from GitHub to check them, read-only, and don’t keep the files. | To check your labs and grade your exam | Contract |
| Exam attempts | Your scenario, multiple-choice answers, written answer, grades, timestamps | To grade the exam, issue certificates and prevent cheating | Contract |
| Certificates | Certificate, date, your name and GitHub username | To publish the verify page you share | Contract |
| Gift vouchers | The gift codes you can give and whether each was redeemed (not who redeemed it). If you redeem a gift, which account gave it to you. Your display name is shown on the redeem page to anyone who has a gift link you shared | To run gift vouchers, stop a code being used twice or by its giver, and count how many gifts are shared and used | Contract |
| Email choices | Whether you want emails about new courses, and when you chose | To email you only if you asked | Consent |
| Talent network (only if we open it; not offered today) | A short headline, whether you are open to work, location, time zone, a LinkedIn profile link and a website link, all optional | To contact you about work with our clients | Consent |
| Product events | Events such as “signed in”, “module done”, “exam submitted”, with the course and, if you arrived from a campaign link, its campaign name | To understand which courses and campaigns work, in aggregate | Legitimate interest |
| Team enquiries | Company, team size, interest, message, email, name if given | To answer your enquiry | Legitimate interest |
| Server logs | IP address, time, page requested | Security and fixing errors | Legitimate interest |
We don’t sell your data, and we don’t share your profile with employers or clients unless the talent network is open, you opted in, and you agree to that specific introduction.
Who else handles your data
| Who | What they receive | Where |
|---|---|---|
| GitHub (Microsoft) | Sign-in. Lab checks read your course repositories through GitHub’s API, read-only; if you install our GitHub App on your account, only the repositories you choose. Our exam workflow also runs in GitHub Actions and reads your repository there. | United States (EU–US Data Privacy Framework) |
| OpenAI (our AI grading provider by default) | Your written exam answer, the question and the rubric. Not your name or email. | United States |
| Cloudflare | All traffic to the site passes through Cloudflare’s network. | Global |
| Our email provider | Emails we send you, and enquiry notifications to us. | EU/US |
| Hosting | The portal and its database run on infrastructure we operate. | Sweden |
If we switch the AI grading provider (the alternative is Anthropic), we’ll update this table first.
Cookies and local storage
| Name | Type | Purpose | Lasts |
|---|---|---|---|
pe_session |
Cookie, strictly necessary | Keeps you signed in. We store only a hash of it. | 30 days, renewed while you use the site |
gh_oauth_state, gh_oauth_next |
Cookies, strictly necessary | Protect the GitHub sign-in and return you to the page you came from | A few minutes |
pe-theme |
Local storage | Remembers light or dark mode | Until you clear it |
| Course progress | Local storage | The course pages keep your progress in your browser, signed in or not | Until you clear it |
Because these are strictly necessary or kept only in your browser, we don’t show a cookie banner.
How long we keep it
- Your account, progress and exam attempts: until you delete your account.
- Certificates: until you delete your account. We then keep the certificate’s ID, type and issue date, remove your name and every link to you, and mark it revoked, so a verify link someone holds shows that it is no longer valid instead of a broken page.
- Talent profile: until you leave the talent network (the profile is cleared at once) or delete your account.
- Product events: 24 months.
- Team enquiries: 24 months after our last contact.
- Server logs: 30 days.
Your rights
Under the GDPR you can ask for a copy of your data, have it corrected or deleted, object to processing based on legitimate interest, withdraw consent at any time, and take your data elsewhere.
- Export: download your data as JSON from your dashboard (“Your data”). It holds your account details, consents and talent profile, course progress and the path you chose (course only or certificate), registered repositories, lab checks, voucher redemptions, your gift codes, exam attempts with your own answers, grades and results, certificates and events. It leaves out the exam answer key and internal values such as the random seed.
- Delete: delete your account from your dashboard. This removes your sign-in, profile, consents, progress, registered repositories, lab checks, exam attempts, voucher redemptions, gift codes nobody has redeemed and events, and signs you out at once. A gift you gave that was already redeemed keeps working for that person. Certificates are handled as described above. We record that an account was deleted, without any link to you.
- Email choices: untick them on your dashboard. If you leave the talent network, your talent profile is cleared.
- Enquiries: a team enquiry is not tied to an account. To have one removed, write to the email above.
- Newsletter: we do not send bulk email from the portal. When a new course comes out, we may send one email through our own mail tool to the people who ticked “Email me when new courses come out”, using the email on their GitHub account. Unticking removes you from the next send.
You can also complain to the Swedish Authority for Privacy Protection (IMY), imy.se.
Changes
When we change this notice, we update the date at the top. If a change affects what you agreed to, we’ll ask you again.