Privacy Policy | Walnut Institute

This Privacy Policy explains how Walnut collects, uses, discloses, retains, and protects personal information through its website, accounts, learning platform, payments, communications, and AI-enabled features.

Privacy highlights

We collect account, profile, learning, communications, transaction, and technical data needed to run Walnut.
OpenAI receives AI tutor inputs and relevant course context, content used for retrieval, and answers submitted for AI-assisted grading.
Stripe handles full payment-card data; Walnut keeps transaction records and limited card details such as brand, last four digits, and expiry.
We do not sell personal information or use advertising or cross-site behavioural tracking in the current platform.
You can request access, correction, or deletion by contacting Walnut's Privacy Officer at privacy@walnutinstitute.com.

1. Scope and Accountability

This policy applies to personal information Walnut controls through the Services. It does not govern an independent third-party service or an organization that controls information for its own purposes.

Walnut's Privacy Officer is responsible for privacy compliance. Questions, requests, and complaints can be sent to:

Privacy Officer, Walnut Institute Inc.
privacy@walnutinstitute.com

2. Personal Information We Collect

2.1 Account and identity information

name, preferred name, username, email address, country, password hash, email-verification status, role, and account status;
the date and versions of the Terms accepted and Privacy and Cookie Policies acknowledged; and
optional profile information, such as a prefix, biography, phone number, avatar, industry and career interests, website or social links, and personal interests or preferences you choose to provide.

2.2 Learning and course information

enrollments, lesson and section progress, completion state, time spent, notes, ratings, comments, and course preferences;
quiz drafts, attempts, answers, scores, feedback, AI-grading results, and pass or completion status;
badges, certificates, certificate-verification status, and certificate-publication preference; and
course content, files, media, instructor details, and signatures uploaded by authorized instructors or administrators.

2.3 AI interactions

We collect AI tutor messages, selected lesson text you ask about, conversation history and titles, generated responses, cited course sources, model and retrieval metadata, and written quiz answers and grading results. Authorized administrators may also submit course briefs, source material, prompts, and generation settings.

2.4 Payments and transactions

Walnut collects order items, purchase amount and currency, status, dates, receipt or invoice references, Stripe customer and transaction identifiers, and limited saved-card details returned by Stripe, such as brand, last four digits, expiry, and default-card status. Stripe—not Walnut—collects and stores full card numbers and security codes.

2.5 Communications, applications, and inquiries

We collect the information in support messages, contact forms, instructor or reviewer applications, and school or organizational inquiries. This may include name, work email, phone number, organization, role or title, institution type and size, learning-management system, training priorities, timeline, message, and related correspondence.

2.6 Technical, security, and device information

We and our service providers receive IP address, user agent, browser and device characteristics, request and error information, authentication and session identifiers, timestamps, security-event and audit information, and browser-storage data described in our Cookie Policy.

2.7 Voice input

The AI tutor and written quiz inputs can use your browser's speech-recognition feature. Your browser or operating-system provider may process microphone audio under its own terms. Walnut receives the resulting transcript in the text field. Walnut does not intentionally receive or store the raw microphone recording through this feature; the transcript is sent to Walnut only when you submit it.

3. Where Information Comes From

We collect information directly from you; automatically from your browser, device, and use of the Services; from your instructors or an organization administering access; and from service providers such as Stripe when they confirm a payment or return limited payment-method details.

4. How We Use Personal Information

create, verify, secure, and administer accounts and permissions;
provide course access, learning activities, progress, grades, badges, certificates, and certificate verification;
process purchases, maintain transaction records, prevent payment fraud, and provide receipts;
provide AI tutor, retrieval, AI-assisted grading, and administrator course-drafting features;
respond to support, contact, application, school, and organizational inquiries;
send verification, password, purchase, security, course, and service communications;
protect users and the Services, detect abuse, enforce terms, debug errors, and maintain reliability;
understand and improve the Services using operational records and feedback; and
meet accounting, tax, legal, regulatory, dispute, and enforcement obligations.

Walnut does not currently use third-party analytics or advertising trackers to profile visitors, and does not sell personal information. We do not use course or AI interaction data to train Walnut's own general-purpose AI model.

5. AI Features

5.1 AI tutor and retrieval

When you use the AI tutor, Walnut sends OpenAI your message, relevant recent conversation history, the course title and description, any selected lesson text, and course excerpts retrieved as relevant. To locate those excerpts, course content and a tutor query may also be sent to OpenAI's embedding service. Walnut stores tutor inputs and outputs with conversation, model, and source metadata so you can resume conversations and Walnut can provide and troubleshoot the feature.

5.2 AI-assisted quiz grading

For open-ended answers and fill-in-the-blank answers that permit free text, Walnut may send OpenAI the learner's answer, the question, answer key or rubric, grading instructions, and relevant course excerpts. Walnut stores the resulting evaluation and explanation. That evaluation may affect points, quiz score, pass status, progress, and completion.

AI can make mistakes. Walnut identifies AI-assisted grading before a relevant quiz begins. To ask for human review of an AI-assisted grade, contact support@walnutinstitute.com.

5.3 Administrator course generation

Authorized administrators may use OpenAI to draft course structure and content from course briefs and source material. Generated material is stored in Walnut and is intended for administrator review before publication.

5.4 OpenAI data handling

OpenAI processes this information as Walnut's AI service provider under its applicable API terms and data controls. OpenAI states that API data is not used to train its models by default unless a customer opts in, and that standard abuse-monitoring logs may be retained for a limited period. Review OpenAI's Privacy Policy for its current practices. Do not include sensitive personal information in AI inputs unless necessary and authorized.

6. Payments and Stripe

Paid course checkout is hosted by Stripe, and Wallet card entry uses Stripe.js and Stripe's Payment Element. Stripe collects payment, billing, transactional, browser, and device information to process payments, authenticate transactions, prevent fraud and loss, and operate and improve Stripe's services, including analytics.

Stripe may act as Walnut's service provider for some processing and as an independent controller for other processing. Stripe's use is governed by its Privacy Policy. Walnut uses Stripe responses to confirm payment, fulfill enrollment, show receipts, and display limited saved-card details. Saving a card is optional and can be managed in your Wallet.

7. When We Disclose Personal Information

We disclose personal information only as reasonably necessary for the purposes above:

Hosting and database: Vercel and Neon host application and database infrastructure.
Storage and delivery: Amazon Web Services S3-compatible storage holds uploaded files and media.
AI: OpenAI processes the data described in Section 5.
Payments: Stripe processes checkout and saved payment methods as described in Section 6.
Email: Resend delivers account, purchase, support, and course communications.
Security: Cloudflare Turnstile receives browser and device signals to identify bots and abuse; Walnut sends the resulting token and IP address for verification.
Background processing and infrastructure: Inngest and infrastructure providers support queued generation jobs, reliability, delivery, and security where configured.
Instructors and administrators: authorized personnel can access learner, course, submission, progress, and account information needed for their role.
Legal and business events: we may disclose information when required by law, to protect rights and safety, investigate fraud or abuse, or as part of a financing, reorganization, merger, acquisition, or sale, subject to appropriate safeguards.

Service providers are expected to handle information under contractual and security obligations appropriate to their role. Links or embedded third-party services may also have their own privacy practices.

8. Cookies and Similar Technologies

Walnut uses first-party cookies and local browser storage for sign-in, security, preferences, cart state, and reliable progress synchronization. Stripe and Cloudflare may use their own necessary technologies during payment and security flows. The current Service does not use advertising cookies or third-party analytics trackers. See the Cookie Policy for the current inventory and controls.

9. Public and Organization-Visible Information

If public certificate verification is enabled, anyone with the verification page or certificate identifier may see the learner name, course name, completion date, certificate identifier, and validity status. You can turn public verification off in account settings.

Information shared with an instructor or organizational administrator may remain in records that the organization independently controls. Contact that organization about its separate privacy practices.

10. International Processing

Walnut is a Canadian organization. Service providers may process information in Canada, the United States, or other countries where they or their subprocessors operate. Information in another country can be subject to that country's laws and lawful access by courts, law-enforcement, or national-security authorities. Walnut remains accountable for personal information it transfers to service providers as required by applicable Canadian privacy law.

11. Retention and Deletion

Walnut keeps personal information only as long as reasonably necessary for the purposes described here, considering account status, the nature and sensitivity of the information, course-access and learning-record needs, security and dispute periods, backup cycles, and legal, tax, or accounting obligations.

Account, course, progress, quiz, certificate, and AI conversation records are generally retained while the account is active and as needed to provide continuing access and maintain legitimate learning records.
Contact, application, and inquiry records are retained as needed to respond and manage the relationship.
Purchase and transaction records may be retained after account closure where needed for tax, accounting, fraud prevention, or legal obligations.
Security logs, audit records, verification tokens, and backups are retained for operationally appropriate periods and then deleted, overwritten, or de-identified unless a legal hold applies.

When deletion is requested, Walnut will delete or de-identify information where feasible and legally appropriate. Some information may remain temporarily in restricted backups or longer where necessary for legal obligations, fraud prevention, disputes, security, or records of a transaction. Deleting an account can end access to purchased courses, progress, AI conversations, and certificates.

12. Safeguards and Breaches

Walnut uses administrative, technical, and organizational safeguards appropriate to the sensitivity of information, including password hashing, access controls, email verification, rate limiting, bot protection, secure session controls, role-based permissions, encrypted network transport, provider security controls, and audit or security logging. No system is completely secure.

Walnut will investigate suspected breaches and will notify affected individuals and regulators when required by applicable law. If you believe your account or information is at risk, contact privacy@walnutinstitute.com.

13. Your Choices and Privacy Rights

Depending on applicable law, you may:

access personal information Walnut holds about you and ask how it has been used or disclosed;
correct incomplete or inaccurate information;
withdraw consent for optional processing, subject to legal or contractual limits;
request deletion or de-identification where applicable;
change profile, notification, saved-card, and public-certificate settings available in your account; and
complain about Walnut's privacy practices without retaliation.

Email requests to privacy@walnutinstitute.com. Walnut may need to verify your identity and may ask for enough detail to locate the information. Under PIPEDA, access requests are generally answered within 30 days, subject to permitted extensions and exceptions. If Walnut cannot fulfill a request, it will explain why where required.

If you are not satisfied with Walnut's response, you may contact the Office of the Privacy Commissioner of Canada or another regulator with jurisdiction.

Additional regional rights

Residents of provinces or countries with additional privacy rights may exercise those rights through the same address. Where European, UK, California, or similar privacy law applies, rights may include objection, restriction, portability, appeal, or information about categories and recipients. Walnut will not discriminate against you for exercising a legally protected right.

14. Consent and Legal Bases

Walnut seeks meaningful consent where consent is required and collects, uses, or discloses information only for identified purposes that a reasonable person would consider appropriate. Some processing is necessary to provide a requested service, perform a contract, protect the Services, or meet a legal obligation and may continue after consent is withdrawn where law permits or requires it.

Where GDPR-style laws apply, Walnut relies as appropriate on performance of a contract, consent, legitimate interests in security and service improvement balanced against individual rights, and legal obligations.

15. Children and Learners Using Organizational Access

People who cannot legally consent on their own may use Walnut only with authorization from a parent, guardian, or responsible organization. Walnut does not knowingly seek unnecessary personal information from children. Organizations enrolling learners are responsible for having authority to provide learner information and for giving any notices or obtaining any permissions their laws and policies require.

If you believe a child's information was provided without appropriate authorization, contact the Privacy Officer so Walnut can investigate and take appropriate action.

16. Electronic Communications

Walnut sends transactional and service communications needed for account verification, security, password recovery, purchases, course delivery, and responding to requests. If Walnut sends commercial electronic messages, it will do so with the consent or other authority required by applicable law and will provide sender identification and an unsubscribe mechanism. Walnut may retain a limited suppression record after an unsubscribe.

17. Changes to This Policy

We may update this policy as the Services, providers, or laws change. We will update the date above and provide additional notice when a change is material or when required by law. If a new use requires consent, Walnut will seek it before that use.

18. Contact