Walnut Institute Privacy Policy

1) Who We Are and How to Contact Us

Walnut Institute Inc. is based in Ontario, Canada.

If you have questions, concerns, or requests about privacy, contact us at: privacy@walnutinstitute.com

2) Definitions

To keep your experience consistent across our legal documents, we use the following key definitions:

Account: Your registered user account for the Services.

Services: Our websites, applications, learning platform, and related services.

Content: Learning materials and platform elements made available through the Services.

User Content: Content you submit, upload, post, transmit, or otherwise provide through the Services (for example, messages, assignments, files, uploads, feedback, and profile information).

AI Features: AI-powered functions offered through the Services (for example, AI tutor/chat, summarization, recommendations, or similar tools).

AI Output: Content generated by AI Features in response to your inputs.

3) Information We Collect

We collect information in three ways: (A) information you provide, (B) information collected automatically, and (C) information from third parties.

A) Information You Provide to Us

Account and identity information

• Name and email address
• Password (stored as a hash)
• Preferred language and time zone
• Account role information (for example, learner, instructor, administrator) where applicable

Profile information (optional)

• Avatar and profile image
• Biography and other profile fields you choose to provide
• Preferences and settings (for example, notification preferences)

Learning and education records

• Course enrollment and access records
• Lesson progress, completion events, and certificates or completion acknowledgements (if offered), including certificate IDs, public verification IDs, and public/private certificate status
• Quiz attempts and responses
• Assignment submissions and instructor feedback (if applicable)

User Content

• Messages, posts, comments, and discussion contributions (if enabled)
• Files and uploads you submit (including audio, video, documents, images), and related metadata (such as file name, size, type, upload timestamp)

Communications

• Support requests and correspondence
• Survey responses, feedback, and requests you submit

Purchases and billing (limited by design)

• Purchase history, refunds, disputes, and chargeback status
• Limited payment metadata we may receive (for example, transaction identifiers, status, and limited card metadata such as last four digits)
• We do not store full payment card numbers on our servers

AI Feature inputs

• Prompts, questions, or other inputs you provide to AI Features
• AI Output generated in response
• Any documents, snippets, or content you provide or reference in order to use AI Features

B) Information We Collect Automatically

Device and technical information

• IP address
• Browser type, device type, operating system version
• Referring URLs, pages visited, and request timestamps
• Diagnostic data and crash logs

Usage and activity information

• Pages viewed and features used
• Time spent on pages or lessons
• Interactions such as clicks, navigation patterns, and feature engagement

Security and fraud prevention logs

• Authentication events and login timestamps
• Failed login attempts and suspicious activity signals
• Rate limiting and abuse prevention metadata

Cookies and similar technologies

• Cookie identifiers and similar technologies used for essential functions, preferences, analytics, and marketing measurement (where enabled and subject to applicable choices)

C) Information We Receive from Third Parties

• Payment processors: Payment confirmation and transaction status and limited metadata
• Analytics providers: Aggregated or event-level analytics and reporting (depending on your cookie settings and configuration)
• Email delivery providers: Delivery events and engagement metrics (for example, delivery confirmation, opens, clicks), where applicable

4) Sensitive Information

We do not intentionally collect sensitive categories of information by default (such as government identification numbers, precise geolocation, health information, biometric identifiers, or detailed information about race or ethnicity, religion, or political opinions).

If you choose to include sensitive information in free-text fields, messages, uploads, or AI prompts, you are responsible for that choice. Please avoid including highly sensitive personal information unless it is strictly necessary.

5) How We Use Your Information

We use personal information for the following purposes:

Provide and operate the Services

• Create and manage Accounts
• Provide access to courses, lessons, quizzes, assignments, and platform functionality
• Track learning progress and completion (including certificates or completion acknowledgements where offered)

Personalize and improve learning

• Remember preferences and settings
• Display progress and learning history
• Offer recommendations or learning support features (where enabled)

Enable messaging and community features (if enabled)

• Deliver messages and posts and support course discussions
• Maintain healthy communities through moderation and enforcement where needed

AI Features

• Provide AI tutor/chat and other AI Features
• Retrieve relevant context from the Services to answer course-related questions (where applicable)
• Improve safety, prevent abuse, troubleshoot issues, and improve performance

Payments, billing, refunds, and disputes

• Process purchases via payment processors
• Handle refunds, disputes, and chargebacks
• Maintain records required for accounting and compliance

Communicate with you

• Send service-related communications (for example, confirmations, security notices, and important updates)
• Respond to your inquiries and requests
• Send marketing communications where permitted, and always with opt-out options

Security, fraud prevention, and enforcement

• Protect Accounts and the Services
• Detect and prevent fraud, abuse, and unauthorized access
• Enforce our Terms and policies

Analytics and product improvement

• Understand platform usage and performance
• Debug, test, and improve features and user experience
• Develop new services and functionality

Legal compliance

• Comply with applicable laws and lawful requests
• Protect the rights, safety, and security of Walnut and others

6) Legal Bases for Processing (GDPR and Similar Laws)

Where GDPR (EU/EEA), UK GDPR, or similar laws apply, we rely on one or more of the following legal bases depending on the activity:

• Contractual necessity: To provide the Services you request, including account management, course access, learning features, and purchases.
• Consent: For activities that require consent, such as certain cookies, and where required for certain marketing communications.
• Legitimate interests: To secure and improve the Services, prevent fraud and abuse, support customer service, and develop and improve our offerings, where those interests are not overridden by your rights.
• Legal obligation: To meet legal and regulatory requirements (for example, tax and accounting obligations).

7) How We Share Personal Information

We do not sell personal information for money.

We may share personal information in the following circumstances:

A) Service providers (processors)

We share information with vendors that help us operate the Services, under contracts requiring confidentiality, security, and limited processing on our instructions. These categories may include:

• Hosting and infrastructure providers
• Database and data storage providers
• File storage providers (for uploads and media)
• Payment processors (to complete transactions)
• Email delivery providers
• Analytics providers (depending on your cookie settings)
• AI providers used to deliver AI Features

B) Other users and roles within the Services

Depending on how the Services are configured:

• Instructors and administrators may access learner submissions and learning data as needed to deliver courses and operate the platform.
• Messaging participants can see the content you send them.
• If you enable public certificate verification or share a public certificate link, anyone with that link can view the name displayed on your certificate, the course title, completion date, and certificate ID. You can hide public verification from your certificate page, and administrators may hide or revoke certificates when needed for privacy, safety, or credential integrity.

C) Legal, safety, and enforcement

We may disclose information if we believe in good faith it is necessary to:

• Comply with law, regulation, or lawful requests
• Protect the rights, safety, and security of users, Walnut, and others
• Investigate fraud, abuse, or violations of our Terms and policies

D) Business transfers

If Walnut is involved in a merger, acquisition, restructuring, or sale of assets, personal information may be transferred as part of that transaction, subject to appropriate safeguards and notice where required by law.

8) Cookies and Similar Technologies

We use cookies and similar technologies for:

• Essential functions: login, session integrity, and security
• Preferences: remembering settings and choices
• Analytics: understanding traffic and usage trends
• Marketing measurement: where enabled and subject to applicable choices

You can manage cookies through your browser settings. Where available, you can also manage cookie categories through our cookie consent tools.

9) AI Features and AI Interaction Data

If you use AI Features, we may process:

• Your inputs/prompts and related context needed to respond
• AI Output generated in response
• Logs and suggestions used to improve safety, prevent abuse, troubleshoot, and improve performance

Important notes:

• Do not include highly sensitive personal information in prompts or messages.
• AI Output can be inaccurate and may not be appropriate for every situation. You remain responsible for how you use AI Output.

10) Data Retention

We keep personal information only as long as necessary for the purposes described in this Privacy Policy, unless a longer period is required by law.

Typical retention periods include:

• Account data (profile, enrollments, progress): retained while your Account is active. If you request deletion, we will delete or anonymize information where feasible, subject to the exceptions below.
• User Content (assignments, uploads, messages): retained while your Account is active and as needed to provide the Services. If you request deletion, we will delete or anonymize where feasible, subject to legal obligations, dispute resolution, enforcement needs, and backup cycles.
• Transaction records: typically retained for 6 to 7 years to meet tax and accounting obligations.
• Marketing subscription data: retained until you unsubscribe or withdraw consent. We may maintain a minimal suppression record to ensure we honor your opt-out.
• Security and access logs: typically retained for 90 days to 12 months depending on risk and sensitivity, then deleted or aggregated.
• Backups: retained on a rotating schedule and deleted/overwritten as part of routine backup cycling, unless a legal hold requires preservation.

Deletion note: Some data may not be immediately removed from backups. Where this occurs, we isolate it and remove it as backups rotate, unless we must keep it longer to comply with law.

11) Security Measures

We maintain administrative, technical, and organizational safeguards designed to protect personal information, including:

• Encryption in transit (TLS)
• Access controls and role-based permissions
• Logging and monitoring for suspicious activity
• Secure development and operational practices
• Incident response processes

No system can be guaranteed 100% secure. You are responsible for maintaining the confidentiality of your login credentials and using a strong password.

12) International Data Transfers

Walnut is based in Canada. Some service providers may process or store information in other countries depending on vendor configuration.

When personal information is transferred across borders, we use appropriate safeguards, such as contractual protections, and we require service providers to protect information in a manner consistent with this Privacy Policy and applicable law.

13) Your Choices and Controls

You may be able to:

• Update profile and account settings within the Services
• Opt out of marketing emails using the unsubscribe link included in those messages
• Control cookies through browser settings and, where available, cookie consent tools
• Hide or re-enable public certificate verification for certificates you have earned, where certificate features are available
• Request deletion of your Account, subject to retention requirements described above

To make a privacy request, contact: privacy@walnutinstitute.com

14) Your Privacy Rights (By Region)

A) Canada (PIPEDA)

Where PIPEDA and applicable Canadian privacy laws apply, you may have rights to:

• Request access to your personal information
• Request correction of inaccurate or incomplete information
• Withdraw consent (subject to legal or contractual restrictions and reasonable notice)
• Ask questions about our policies and practices, including how we use service providers

To exercise these rights, contact: privacy@walnutinstitute.com

B) EU/EEA, UK, and Switzerland (GDPR-style rights)

Where GDPR or similar laws apply, you may have the right to:

• Access your personal information
• Rectify inaccurate information
• Erase your information in certain circumstances
• Restrict processing in certain circumstances
• Data portability
• Object to processing based on legitimate interests
• Withdraw consent where processing is based on consent
• Lodge a complaint with your local supervisory authority

To submit a request, contact: privacy@walnutinstitute.com

C) California (CCPA/CPRA)

If you are a California resident and the law applies, you may have rights to:

• Know/access the personal information we collected, used, disclosed, and the categories of sources and purposes
• Delete personal information (with exceptions)
• Correct inaccurate personal information
• Obtain a portable copy of certain personal information
• Opt out of the "sale" or "sharing" of personal information as defined by California law
• Not be discriminated against for exercising your rights

Sale / Sharing We do not sell personal information for money. If we ever engage in "sharing" for cross-context behavioral advertising as defined by California law, we will provide an appropriate opt-out mechanism.

To submit a request, contact: privacy@walnutinstitute.com

We may need to verify your request, and we may request information to confirm you are the account holder.

15) Children and Age Restrictions

Our Services are generally intended for users who can form a legally binding contract. If a user is not eligible, a parent or guardian (or an authorized organization) must accept the Terms and is responsible for that user's use of the Services.

We do not knowingly collect personal information from children under the age of digital consent without appropriate authorization. If you believe a child provided personal information improperly, contact us at privacy@walnutinstitute.com and we will take appropriate steps.

16) Third-Party Links

The Services may include links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies.

17) Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices, technology, legal requirements, or the Services. If changes are material, we may provide additional notice as required by law.

18) Contact Us

For privacy questions or requests: privacy@walnutinstitute.com