This policy explains how Brighten Academy ("we", "us") collects, uses, shares and protects personal information. It covers this website, brightenacademy.lk, and the Brighten Academy management system and student portal at brightenacademy.edu.lk, which our students, lecturers and staff sign in to.
1. Information we collect
On this website
This website has no accounts or forms, and we do not use analytics or advertising cookies on it. Like any web server, our hosting provider (Google Firebase Hosting) keeps standard request logs, such as your IP address, browser type and the pages requested. The site loads its fonts from Google Fonts, so Google receives your IP address when the fonts are loaded.
In the management system and portal
When you study or work with us, we keep the information we need to run your classes and your account:
- Identity: your name, NIC number, date of birth, gender and photograph.
- Contact details: your phone numbers, email addresses and postal address.
- Studies: your programmes, batches and enrolments; attendance at live lectures; recordings you watch and how far you watch them; submissions, answers, marks, feedback and comments.
- Payments: fees, instalments, discounts and refunds recorded against your enrolment. We do not store card numbers.
- Documents you or our staff upload, such as certificates and identity documents.
- Account and security: your username, your password (stored only as a one-way hash), and sign-in records including the time, IP address and browser used.
- For lecturers and staff: the employment details, documents and contact details needed for your role.
2. How we use it
- To enrol you, run your classes, and give you access to lectures, recordings, papers and announcements.
- To record payments and send fee and instalment reminders.
- To contact you by phone, SMS, WhatsApp or email about your classes, schedules and payments.
- To keep the system secure, investigate misuse and keep records we are required to keep.
We do not sell your personal information, and we do not use it for advertising.
3. Google user data
Our management system connects to Brighten Academy's own Google account using the Google People API. It does this so that the academy's Google Contacts stay up to date with the names, phone numbers and email addresses of our students, lecturers and staff, which lets our staff recognise and reach them from the academy's phones.
With the permission granted to it, the system:
- creates a contact in the academy's Google Contacts when a student, lecturer or staff member is added;
- reads and searches those contacts only to find the matching contact to update, so it is not duplicated;
- updates that contact when their details change in our system; and
- deletes that contact when they are removed from our system.
Only the academy's own Google account is connected. Students, lecturers and staff do not sign in with Google, and we do not access anyone's personal Google account.
Information received from Google APIs is used only for the purpose above. It is not sold, not used for advertising, not used to train artificial intelligence or machine learning models, and not shared with anyone else except as needed to provide this feature, to comply with the law, or with the account owner's consent. Our staff do not read this data except where needed for security, to fix a problem, or to comply with the law.
Brighten Academy's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
The academy can stop this at any time by switching off Google Contacts sync in the system or by removing the system's access at myaccount.google.com/permissions. Contacts already created remain in the academy's Google Contacts until they are deleted there.
4. Who we share it with
We share personal information only with the service providers that help us run the academy:
- Google Cloud and Firebase host the management system, its database and uploaded files, and this website.
- Google People API keeps the academy's Google Contacts in sync, as described above.
- Zoom runs live lectures; we register your name and email address for each class.
- WhatsApp (Meta) and Text.lk deliver our WhatsApp and SMS messages.
These providers process the information on our behalf and under their own security and privacy terms. We may also disclose information when the law requires it.
5. Where it is stored and how we protect it
Your information is stored on Google Cloud servers, which may be outside Sri Lanka. All connections to this website and the portal are encrypted (HTTPS). Passwords are stored as one-way hashes, service credentials are encrypted, and staff can see and change only the information their role allows.
6. How long we keep it
We keep your information while you study or work with us, and afterwards for as long as we need it for academic records, finance and legal requirements. When it is no longer needed, we delete it or make it anonymous.
7. Cookies and browser storage
This website does not set cookies of its own. The portal stores sign-in information in your browser so you stay signed in; signing out removes it.
8. Your choices and rights
You can ask us for a copy of your personal information, to correct it, or to delete it where we are not required to keep it. You can also ask us to stop sending you messages that are not essential to your studies. These rights include those under Sri Lanka's Personal Data Protection Act, No. 9 of 2022. Contact us using the details below.
9. Children
If a student is under 18, we expect a parent or guardian to agree to their enrolment, and the parent or guardian may contact us about the student's information.
10. Changes to this policy
We may update this policy. The effective date at the top shows when it last changed, and significant changes will be announced in the portal.
11. Contact us
For questions or requests about your personal information, contact Brighten Academy:
- Phone: 070 125 1230
- WhatsApp: 070 125 1230