Privacy Policy

Last updated October 25, 2026. This is a first general version. It will be updated as the company details below are confirmed.

Who we are

This site, aifirstlms.com, is run by Artificial Intelligence First Inc. ("AI First", "we", "us"), a subsidiary of Kotler Impact Inc. We decide how the personal data described here is used, so for the purposes of the EU and UK General Data Protection Regulation (GDPR) we are its controller. When an organization enrolls its people, that organization also decides how its own people's data is used, and our agreement with it sets out each side's role.

Questions, requests and complaints about privacy: write to contact@aifirstlms.com, or use the contact form. Our postal address will be added here once confirmed.

The short version

• We collect what we need to run your courses, issue your certificates and keep the site safe. Nothing more.
• We do not sell your personal data, and we do not share it for advertising. The site has no advertising, no analytics and no tracking pixels.
• The only cookies are the ones the site needs to work: keeping you signed in and remembering your language.
• You can ask to see, correct, download or delete your data at any time.

What we collect

• Your account: your name, email address and, if you add it, your job title. Your password is never stored; we keep only a one way scrambled form of it (a hash).
• Your learning: the courses you are enrolled in, which lessons you opened and how much of each video you watched, your quiz and test answers and scores, and the dates you started and finished.
• Your certificates: the course, the date and a verify code.
• Your organization: if an organization gave you a seat, which organization it is.
• Messages to us: what you send through the contact form: your name, email, organization, the number of seats you ask about, and your message.
• Security records: when you sign in, sign out or change your password, we record the time, your internet (IP) address, and the region and country that address points to. We look that up on our own server; it is not sent to anyone. To slow down password guessing and spam, we briefly count attempts by IP address and email address.
• Email records: which emails we sent you (for example the welcome email and password reset links) and whether they were delivered.

We do not ask for payment card details, government identifiers, health information or any other sensitive personal data.

Why we use it, and the legal basis

• To give you the courses and certificates you or your organization signed up for. Legal basis: performing our contract with you or your organization.
• To show your organization your progress, if it enrolled you. Your organization's administrators can see your name, email, courses, progress, completions and when you last signed in. Legal basis: our contract with your organization, and its legitimate interest in training its people.
• To keep accounts and the site safe: security records, limits on repeated attempts, and alerts to our team about unusual sign ins. Legal basis: our legitimate interest in protecting you and the site.
• To answer your messages. Legal basis: our legitimate interest in replying, or steps you ask for before a contract.
• To meet legal duties, such as keeping records the law requires. Legal basis: legal obligation.

We send service emails only: your welcome email, password links and notices about your courses. We do not send marketing email.

Your public certificate page

Each certificate has a page anyone with its link or verify code can open, so an employer can check it is real. That page shows your name, the course, its level, the issue date, the verify code and who issued and signed it. It never shows your email address, and we ask search engines not to list it.

Who helps us run the site

We use a small number of service providers. Each one handles personal data only to provide its service to us.

• Hetzner Online hosts our server and its database in Helsinki, Finland (European Union).
• Bunny.net stores and streams the course videos. When you play a video, your browser connects to Bunny's video player.
• Resend delivers the emails we send you.
• An AI translation service translates the text of a page when you choose a language other than English, and the translation is kept on our server so it is not sent again. Names of people and email addresses shown on a page are left out and never sent. The service is used only to translate.
• A second hosting provider keeps an encrypted copy of our nightly backup, in case our main server fails. The copy is encrypted on our server before it leaves, and the provider cannot read it.

Some of these providers may process data outside the European Economic Area or the UK. When that happens, the transfer is protected by the safeguards the law requires, such as the European Commission's standard contractual clauses. The fonts on this site are kept on our own server, so your browser does not contact a font company to show a page.

We may also disclose data when the law requires it, or to protect the rights and safety of our learners and the site.

Cookies and storage in your browser

We use only what the site needs to work, so there is nothing to accept or turn off.

How long we keep it

• Your account, learning records and certificates are kept while your account is open, or while your organization's agreement with us lasts.
• The activity log is our record of what happened on the site, such as sign ins, seat claims and changes our team made. It is kept for audits. The internet address, region, country and browser in each line are removed after 12 months; the line itself stays.
• Records of the emails we sent are kept for 18 months.
• Sign in sessions and password links are deleted 30 days after they end or expire. Counts of attempts are deleted within 2 days.
• Background task records, which can hold your email address, are deleted 30 days after the task finishes.
• Server logs, which hold the internet address of each visit, are deleted after five weeks.
• Contact form messages are kept while we need them to answer you and follow up.
• Backups: every copy of the database on our server is deleted after 14 days, the encrypted off site copy after 30 days, and our host's daily images of the server after 7 days.

When you ask us to delete your account

1. We first email you every certificate you hold, so you keep a copy. Once your data is deleted, our website no longer holds your certificates: you cannot open them here, and their verify links stop working.
2. We remove your certificates, close your sign in for good, and free your seat. Your contact form messages and any copy of your name in our translation store are deleted at once.
3. We keep your account record and your learning records (courses, lesson progress and quiz answers) for 18 months for audits, closed and unused, and then delete them.
4. The activity log is kept for audits, as described above.

Deleted data then leaves our backups as they expire, within 30 days.

Your rights

Wherever you live, you can ask us to:

• tell you what personal data we hold about you and give you a copy;
• correct it if it is wrong (you can change your name, job title and password yourself on your Profile page);
• delete it;
• give it to you in a format you can take elsewhere.

You can download a copy of your data yourself at any time: sign in, open your Profile page, and press Download my data. You get one file, in a common format (JSON), with your account, courses, lessons, quiz answers, certificates, sign ins and the emails we sent you.

In the EU, the European Economic Area and the UK, you can also object to our use of your data based on legitimate interests, ask us to restrict its use, and complain to your local data protection authority. Where we rely on your consent, you can withdraw it at any time.

In California, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you the right to know what personal information we collect, use and disclose; to delete it; to correct it; and not to be treated differently for using these rights. We do not sell or share personal information as those laws define it, and we do not use sensitive personal information, so there is nothing to opt out of. You can use an authorized agent to make a request for you.

To make a request, write to contact@aifirstlms.com or use the contact form. We will confirm it is you, usually by writing to the email address on your account, and answer within one month (within 45 days for California requests). If your organization enrolled you, we may also tell your organization, because it manages your seat.

Keeping it safe

The site is served only over an encrypted connection. Passwords are stored as hashes. Sign in links expire and work once. Our server allows administrator access only with security keys from known addresses, applies security updates every day, and checks itself every night. No method is perfect; if a breach ever affects your data, we will tell you and the authorities as the law requires.

Children

This site is made for adults and for organizations training their people. It is not meant for children under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, write to us and we will delete it.

Changes

When we change this policy, we update the date at the top. If a change matters to how we use your data, we will tell you by email or on the site before it takes effect.