Privacy policy

Effective date: [date]
Who we are: [Company legal name] ("Ledger & Agent", "we", "us"), [mailing address], [state], United States.
Programs covered: the November 2026 course [working title, owner to confirm: AI You Can Sign Off On], AI for Accounting Professionals and AI for Finance Leaders.
Covered: ledgerandagent.com and ledgerandagents.com, the [Platform] learner portal, and the waitlist and inquiry forms.
Privacy contact: [privacy contact email]. [Postal address for requests.]

1. The short version

• We collect what we need to enroll you, teach you, mark your work and keep our records. We do not sell your personal information. We do not use it for advertising.
• Your coursework is read by your instructor and by an AI grading assistant that drafts feedback. A person reviews that feedback as described in section 6.
• For the November course, use only the course's fictional company, Northwind Supply Co. Do not upload any employer, client or personal data. We will say on the enrollment page when later cohorts may use their own anonymized material.
• Our public website sets no cookies of its own and has no analytics or advertising tools. Section 11 covers two things you should still know.
• You can ask to see, correct, download or delete your information. Write to [privacy contact email].

2. What we collect, why, and on what basis

"Basis" means the reason the law lets us use the information, where a law asks for one. No single US privacy law applies to us as a whole (section 9), so for US learners this column is a statement of purpose. For Canada the basis is your consent, express or implied, as PIPEDA requires (section 10).

We do not ask for government identifiers, bank account numbers, health information, precise location or biometric data, and we ask you not to send them.

3. What we do not do

• We do not sell your personal information or share it for cross-context behavioral advertising.
• We do not rent or sell the waitlist.
• We do not use your coursework to train any AI model, and we do not allow our AI provider to.
• We do not use your coursework, name or words in marketing without your separate written permission.
• We do not share your coursework or marks with your employer or anyone else unless you ask us to (section 7).

4. Employer and third-party information in your coursework

First cohorts: Northwind only. In the November course, and in any cohort we name on the enrollment page, all exercises use Northwind Supply Co., a fictional company whose data is invented for teaching. You do not upload employer data, client data or personal data about anyone, even if you have anonymized it. [Owner to confirm.]

Later cohorts. When we tell you on the enrollment page that you may use your own anonymized material, this classification applies:

• Allowed: Northwind data, and your own work with names and identifying details removed.
• Allowed on your own judgment: a description of an employer process that has no personal data and no client data, if you are permitted to share it.
• Not allowed: personal information about other people, client records, bank or payment details, payroll data, tax return information (see IRC section 7216), or anything your employer forbids you to share.

Who can see your coursework. Your instructor and the grading assistant read your submissions. Our platform and storage providers hold the files for us under contract and can reach them only to run the service, and your discussion group sees only what you post there.

If a submission contains material that is not allowed, we will delete it, tell you, and ask you to resubmit. A firm that wants to be sure that no client records enter an AI tool through the coursework can ask its staff to use Northwind data only.

5. Recordings of live sessions

Each live session is recorded and posted to the enrolled cohort within 24 hours. We tell you at the start of the session that it is being recorded. If you speak or turn your camera on, you appear in the recording. You can ask questions by typing them in the chat or on the week's page instead, and you can leave your camera off. Recordings are available to enrolled learners and the instructor only, for [period]. We will not use a recording that shows or names a learner for marketing without that learner's separate written permission.

6. AI grading assistant

An AI grading assistant reads each submission and drafts feedback using the week's grading guide. What you should know:

• The assistant reads one submission and the matching grading guide. It does not see other learners' work.
• [A person releases every piece of feedback before you see it. A person re-reads in full every piece of work returned for revision, a sample of work marked complete [sampling rate: owner to decide] and every capstone score, and every final-deliverable score in the November course. Each piece of feedback says whether it was re-read in full.] [Owner to confirm before November 17.]
• You can ask a person to review any result, at no cost, by writing to [review request email]. We will reply within [5] business days.
• Your submission is sent to our AI provider, [AI provider], which acts as our service provider under a written agreement. It is stored in [country]. Its terms say [no training on our data; retention of [period]].
• We keep a log of each draft and each human decision, for accountability and so we can answer a review request.
• The assistant can be wrong. A person reviews its output so that a mistake does not decide your result.

7. Who receives your information

We share information only with the following, and only for the purposes above.

We also disclose information when the law requires it, to protect rights or safety, or in a sale or reorganization of the business (the buyer must keep to this policy).

Your employer. We do not tell your employer that you enrolled, or anything about your coursework, feedback or scores, unless you ask us to. Team training for an organization is agreed in a separate written agreement, which sets out what the organization sees and how it is protected.

Other learners. Your name and anything you post appear to your discussion group and, for the Q&A pages, to your cohort.

8. How long we keep information, and deleting it

You can download your work and ask us to delete your information at any time. We will complete a deletion request within [30] days, except for records we must keep (payment records, the completion record, the suppression list). If you ask us to delete your coursework before the course ends, we may not be able to mark it.

9. Your rights; US state privacy laws

What you can ask us for, wherever you live: a copy of your information; correction of anything wrong; deletion; that we stop using your information for a purpose you object to; and a human review of any AI-drafted result. Write to [privacy contact email]. We may need to confirm your identity. We will not treat you worse for asking. If we refuse, we will tell you why and how to complain.

We give these rights to everyone, even where no law requires it, because one process is simpler to run and to explain.

Which state laws apply to a business our size. This is our reading at launch. It will change as we grow, so we will re-check it at least once a year.

• California (CCPA as amended by the CPRA). It applies to a for-profit business that does business in California and meets one of three tests: annual gross revenue over $26,625,000 (the figure adjusted for inflation from January 1, 2025), buying, selling or sharing the personal information of 100,000 or more California consumers or households, or earning 50% or more of annual revenue from selling or sharing personal information. We expect to meet none of them. Where the law applies it covers employee and business-to-business data too, because those exemptions ended on December 31, 2022. If we ever meet a test, we will publish the full California notice. California's online privacy policy law (CalOPPA) applies to any commercial website that collects personal information from Californians, whatever its size. This policy is written to meet it.
• Connecticut. Applies to a business that processes the data of at least 35,000 Connecticut consumers (not counting data processed only to complete payments), or that processes any sensitive data, or that sells personal data. We do not expect to meet these. Connecticut protects a person acting "in an individual or household context", not one acting in an employment context.
• Texas. Exempts a "small business" as defined by the US Small Business Administration, except that such a business must obtain consent before selling sensitive data. We do not sell data.
• Other states with comprehensive laws (for example Virginia, Colorado, Utah, Oregon, Montana, Indiana, Kentucky, Rhode Island, Minnesota and Maryland) set volume thresholds, commonly 100,000 consumers, or a lower figure combined with a share of revenue from selling data. Rhode Island's is 35,000. Most also exclude people acting in a work context. We do not expect to meet them.
• Breach laws. All US states have a breach-notification law. We follow them (section 13).
• AI rules. California's rules on automated decision-making technology for "significant decisions", which include education, apply to covered businesses from January 1, 2027. Colorado's artificial intelligence law has been delayed more than once and we have not confirmed its current status. Neither is expected to cover us at our size, and our human-review process is built to meet the spirit of both.

10. Canada, including Quebec

We market to Canada and some learners will live there.

PIPEDA. Canada's federal law applies to organizations that handle personal information in the course of commercial activity, including a foreign business with a real and substantial connection to Canada. We follow its ten principles: accountability, identifying purposes, consent, limiting collection, limiting use and retention, accuracy, safeguards, openness, individual access, and challenging compliance. Canadians may complain to the Office of the Privacy Commissioner of Canada.

Where your information goes. Your information is processed and stored in the United States [and other countries listed in section 7]. It is subject to the laws of those places, including lawful access by their authorities. Our service providers are bound by contract to protect it to a comparable standard.

Consent. We ask for consent at the point of collection. You can withdraw it, subject to legal and contractual limits, by writing to [privacy contact email]. If you withdraw consent to something we need to deliver the course, we may not be able to continue.

Quebec (Law 25, the Act respecting the protection of personal information in the private sector). If we offer the programs to people in Quebec, we must in addition:

• designate a person responsible for the protection of personal information and publish their title and contact details: [name or title, email];
• publish this policy in clear and simple terms, and in French [French version to be prepared];
• tell you when we collect information that it may be communicated outside Quebec, and carry out a privacy impact assessment before we do so;
• give you the right to access, correct and delete information, and to withdraw consent;
• tell you if a decision is made using only automated processing, and let you ask for a human review (section 6);
• notify the Commission d'accès à l'information and the person affected of a confidentiality incident that presents a risk of serious injury, and keep a register of incidents.

Quebec's penalties are high: administrative penalties up to $10 million or 2% of worldwide turnover, and penal fines up to $25 million or 4%.

11. Cookies and similar technology

Plainly: our public website sets no cookies of its own. It has no analytics, advertising pixels, social-media widgets, chat widgets or tracking scripts.

Two things to know:

1. Fonts. Our pages load a typeface from Google Fonts. Your browser therefore contacts Google's servers, which receive your IP address and browser details. [We plan to host the font ourselves so this stops.]
2. Sign-in and payment. When you sign in to the portal, [Platform] sets cookies (or uses browser storage) that keep you signed in and keep the session secure. They are essential and cannot be switched off. When you pay, Stripe's page sets its own cookies under Stripe's policy. We do not control them.

If we add analytics or any other non-essential technology we will change this section first, and ask for consent where the law requires it. We do not respond to "Do Not Track" signals because we do not track you across sites.

12. Children

Our programs are for working professionals and are not directed to anyone under 18. We do not knowingly collect information from anyone under 18. If you think we have, write to [privacy contact email] and we will delete it.

13. Security and breaches

Learner data is held by established providers that publish independent security reports (list on request) [to be confirmed once providers are chosen]. Those providers encrypt it in transit and at rest [to be confirmed]. Staff accounts use two-factor sign-in and least-privilege access [to be confirmed]. Staff devices are encrypted [to be confirmed]. No system is perfectly secure.

If a breach affects your information, we will tell you, and the regulators where the law requires, without undue delay:

• US: under the breach-notification law of your state of residence.
• Canada (PIPEDA): we report to the Privacy Commissioner and notify you if the breach creates a real risk of significant harm, and we keep a record of every breach for 24 months.
• Quebec: as described in section 10.
• Organizations with a team training agreement: as that agreement says.

14. Changes to this policy

We will post changes here with a new effective date. For a material change we will email enrolled learners and waitlist members [30] days before it takes effect. Earlier versions are available on request.

15. Contact and complaints

[Company legal name], [mailing address]. Privacy contact: [email]. [Quebec privacy officer: name or title, email.] You may also contact the Office of the Privacy Commissioner of Canada, your state attorney general, or, in Quebec, the Commission d'accès à l'information.