Privacy policy

Effective date: [effective date, owner to set]
Who we are: [company legal name, owner to set] ("Ledger & Agent", "we", "us"), [mailing address, owner to set], [state, owner to set], United States.
Programs covered: the four-week course AI You Can Sign Off On [working title, owner to set], AI for Accounting Professionals, AI for Finance Leaders and AI for CFOs.
Covered: ledgerandagent.com and ledgerandagents.com, our learner portal, and the waitlist and inquiry forms.
Privacy contact: [privacy contact email, owner to set]. [Postal address for requests, owner to set]

1. The short version

• We collect what we need to enroll you, teach you, mark your work and keep our records. We do not sell your personal information. We do not use it for advertising.
• Your coursework is read by your instructor and by an AI grading assistant that drafts feedback. A person reviews that feedback as described in section 6.
• For the four-week course, use only the course's fictional company, Northwind Supply Co. Do not upload any employer, client or personal data. We will say on the enrollment page when later cohorts may use their own anonymized material.
• Our public website sets no cookies of its own and has no analytics or advertising tools. Section 11 covers two things you should still know.
• You can ask to see, correct, download or delete your information. Write to [privacy contact email, owner to set].

2. What we collect, why, and on what basis

"Basis" means the reason the law lets us use the information, where a law asks for one. No single US privacy law applies to us as a whole (section 9), so for US learners this column is a statement of purpose. For Canada the basis is your consent, express or implied, as PIPEDA requires (section 10).

We do not ask for government identifiers, bank account numbers, health information, precise location or biometric data, and we ask you not to send them.

3. What we do not do

• We do not sell your personal information or share it for cross-context behavioral advertising.
• We do not rent or sell the waitlist.
• We do not use your coursework to train any AI model, and we do not allow our AI provider to.
• We do not use your coursework, name or words in marketing without your separate written permission.
• We do not share your coursework or marks with your employer or anyone else unless you ask us to (section 7).

4. Employer and third-party information in your coursework

Several programs ask you to write about decisions for your own team or organization, such as a team adoption dossier or a board paper. Write them so that they contain nothing you are not permitted to share.

First cohorts: Northwind only. In the four-week course, and in any cohort we name on the enrollment page, all exercises use Northwind Supply Co., a fictional company whose data is invented for teaching. You do not upload employer data, client data or personal data about anyone, even if you have anonymized it. [Northwind-only rule for the first cohorts, owner to set]

Later cohorts. When we tell you on the enrollment page that you may use your own anonymized material, this classification applies:

• Allowed: Northwind data, and your own work with names and identifying details removed.
• Allowed on your own judgment: a description of an employer process that has no personal data and no client data, if you are permitted to share it.
• Not allowed: personal information about other people, client records, bank or payment details, payroll data, tax return information (see IRC section 7216), or anything your employer forbids you to share.

Who can see your coursework. Your instructor and the grading assistant read your submissions. Our portal and storage providers hold the files for us under contract and can reach them only to run the service. Your discussion or peer group sees only what you post or present there.

If a submission contains material that is not allowed, we will delete it, tell you, and ask you to resubmit. A firm that wants to be sure that no client records enter an AI tool through the coursework can ask its staff to use Northwind data only.

5. Recordings of live sessions

Each live session is recorded and posted to the enrolled cohort within 24 hours. We tell you at the start of the session that it is being recorded. If you speak or turn your camera on, you appear in the recording. You can ask questions by typing them in the chat or on the session's page instead, and you can leave your camera off. Recordings are available to enrolled learners in that cohort and the instructor only, for [recording retention period, owner to set]. We will not use a recording that shows or names a learner for marketing without that learner's separate written permission.

6. AI grading assistant

An AI grading assistant reads each submission and drafts feedback using the grading guide for that week or session. What you should know:

• The assistant reads one submission and the matching grading guide. It does not see other learners' work.
• A person approves every piece of work returned for revision, a sample of work marked complete [sampling rate, owner to set], every capstone score in every program and every final-deliverable score in the four-week course.
• Other work marked complete is released on the assistant's draft, without a person reading it first.
• You can ask a person to review any result, at no cost, by writing to [review request email, owner to set]. We will reply within 5 business days.
• Your submission is sent to our AI provider, [AI provider, owner to set], which acts as our service provider under a written agreement. It is stored in [country of storage, owner to set]. Its terms say [AI provider's training and retention terms, owner to set].
• We keep a log of each draft and each human decision, for accountability and so we can answer a review request.
• The assistant can be wrong. A person approves every result that sends work back and every capstone and final score, and you can ask a person to review any other result.

7. Who receives your information

We share information only with the following, and only for the purposes above.

We also disclose information when the law requires it, to protect rights or safety, or in a sale or reorganization of the business (the buyer must keep to this policy).

Your employer. We do not tell your employer that you enrolled, or anything about your coursework, feedback or scores, unless you ask us to. This applies to every program, including when your capstone is written for your employer's CFO or board: you decide whether to share it. Team training for an organization is agreed in a separate written agreement, which sets out what the organization sees and how it is protected.

Other learners. Your name and anything you post or present appear to your discussion or peer group and, for the Q&A pages, to your cohort.

8. How long we keep information, and deleting it

You can download your work and ask us to delete your information at any time. We will complete a deletion request within [deletion response period, pending counsel], except for records we must keep (payment records, the completion record, the suppression list). If you ask us to delete your coursework before your program ends, we may not be able to mark it.

9. Your rights; US state privacy laws

What you can ask us for, wherever you live: a copy of your information; correction of anything wrong; deletion; that we stop using your information for a purpose you object to; and a human review of any AI-drafted result. Write to [privacy contact email, owner to set]. We may need to confirm your identity. We will not treat you worse for asking. If we refuse, we will tell you why and how to complain.

We give these rights to everyone, even where no law requires it, because one process is simpler to run and to explain.

Which state laws apply to a business our size. This is our reading at launch. It will change as we grow, so we will re-check it at least once a year.

• California (CCPA as amended by the CPRA). It applies to a for-profit business that does business in California and meets one of three tests: annual gross revenue over $26,625,000 (the figure adjusted for inflation from January 1, 2025), buying, selling or sharing the personal information of 100,000 or more California consumers or households, or earning 50% or more of annual revenue from selling or sharing personal information. We expect to meet none of them. Where the law applies it covers employee and business-to-business data too, because those exemptions ended on December 31, 2022. If we ever meet a test, we will publish the full California notice. California's online privacy policy law (CalOPPA) applies to any commercial website that collects personal information from Californians, whatever its size. This policy is written to meet it.
• Connecticut. Applies to a business that processes the data of at least 35,000 Connecticut consumers (not counting data processed only to complete payments), or that processes any sensitive data, or that sells personal data. We do not expect to meet these. Connecticut protects a person acting "in an individual or household context", not one acting in an employment context.
• Texas. Exempts a "small business" as defined by the US Small Business Administration, except that such a business must obtain consent before selling sensitive data. We do not sell data.
• Other states with comprehensive laws (for example Virginia, Colorado, Utah, Oregon, Montana, Indiana, Kentucky, Rhode Island, Minnesota and Maryland) set volume thresholds, commonly 100,000 consumers, or a lower figure combined with a share of revenue from selling data. Rhode Island's is 35,000. Most also exclude people acting in a work context. We do not expect to meet them.
• Breach laws. All US states have a breach-notification law. We follow them (section 13).
• AI rules. California's rules on automated decision-making technology for "significant decisions", which include education, apply to covered businesses from January 1, 2027. Colorado's artificial intelligence law has been delayed more than once and we have not confirmed its current status. Neither is expected to cover us at our size, and our human-review process is built to meet the spirit of both.

10. Canada, including Quebec

We may market to Canada, and some learners will live there.

PIPEDA. Canada's federal law applies to organizations that handle personal information in the course of commercial activity, including a foreign business with a real and substantial connection to Canada. We follow its ten principles: accountability, identifying purposes, consent, limiting collection, limiting use and retention, accuracy, safeguards, openness, individual access, and challenging compliance. Canadians may complain to the Office of the Privacy Commissioner of Canada.

Where your information goes. Your information is processed and stored in the United States [other countries where information is stored, owner to set]. It is subject to the laws of those places, including lawful access by their authorities. Our service providers are bound by contract to protect it to a comparable standard.

Consent. We ask for consent at the point of collection. You can withdraw it, subject to legal and contractual limits, by writing to [privacy contact email, owner to set]. If you withdraw consent to something we need to deliver a program, we may not be able to continue.

Quebec (Law 25, the Act respecting the protection of personal information in the private sector). If we offer the programs to people in Quebec, we must in addition:

• designate a person responsible for the protection of personal information and publish their title and contact details: [Quebec privacy officer title and email, owner to set];
• publish this policy in clear and simple terms, and in French [French version, pending counsel];
• tell you when we collect information that it may be communicated outside Quebec, and carry out a privacy impact assessment before we do so;
• give you the right to access, correct and delete information, and to withdraw consent;
• tell you if a decision is made using only automated processing, and let you ask for a human review (section 6);
• notify the Commission d'accès à l'information and the person affected of a confidentiality incident that presents a risk of serious injury, and keep a register of incidents.

Quebec's penalties are high: administrative penalties up to $10 million or 2% of worldwide turnover, and penal fines up to $25 million or 4%.

11. Cookies and similar technology

Plainly: our public website sets no cookies of its own. It has no analytics, advertising pixels, social-media widgets, chat widgets or tracking scripts.

Two things to know:

1. Fonts. Our pages load a typeface from Google Fonts. Your browser therefore contacts Google's servers, which receive your IP address and browser details. [Plan to host the font ourselves so this stops, owner to set]
2. Sign-in and payment. When you sign in to the portal, it sets cookies (or uses browser storage) that keep you signed in and keep the session secure. They are essential and cannot be switched off. When you pay, Stripe's page sets its own cookies under Stripe's policy. We do not control them.

If we add analytics or any other non-essential technology we will change this section first, and ask for consent where the law requires it. We do not respond to "Do Not Track" signals because we do not track you across sites.

12. Children

Our programs are for working professionals and are not directed to anyone under 18. We do not knowingly collect information from anyone under 18. If you think we have, write to [privacy contact email, owner to set] and we will delete it.

13. Security and breaches

Learner data is held by established providers that publish independent security reports (list on request) [provider security reports, owner to set]. Those providers encrypt it in transit and at rest [provider encryption, owner to set]. Staff accounts use two-factor sign-in and least-privilege access [staff account controls, owner to set]. Staff devices are encrypted [staff device encryption, owner to set]. No system is perfectly secure.

If a breach affects your information, we will tell you, and the regulators where the law requires, without undue delay:

• US: under the breach-notification law of your state of residence.
• Canada (PIPEDA): we report to the Privacy Commissioner and notify you if the breach creates a real risk of significant harm, and we keep a record of every breach for 24 months.
• Quebec: as described in section 10.
• Organizations with a team training agreement: as that agreement says.

14. Changes to this policy

We will post changes here with a new effective date. For a material change we will email enrolled learners and waitlist members [notice period for changes, pending counsel] before it takes effect. Earlier versions are available on request.

15. Contact and complaints

[Company legal name, owner to set], [mailing address, owner to set]. Privacy contact: [privacy contact email, owner to set]. [Quebec privacy officer title and email, owner to set] You may also contact the Office of the Privacy Commissioner of Canada, your state attorney general, or, in Quebec, the Commission d'accès à l'information.