Learning about money, without giving up your privacy.

The Eco Lens (“we”, “us”, “our”) runs a free online platform for learning about microfinance and sustainable finance. This Privacy Policy explains what personal data we process when you visit the site, create an account, take a course or use our financial tools, and the choices you have.

It applies to the website, learner dashboard and any related pages that link to this policy. It does not apply to third-party sites we link to, which run under their own policies.

The Eco Lens is the data controller for personal data processed through this platform. For data-protection questions, contact our privacy team using the details in the “Contact us” section below.

Where we use service providers to operate the platform (hosting, email delivery, error monitoring), those providers act as data processors and may only use your data on our instructions.

You give us directly

• Account details: name, email address and a hashed password when you register, or a Google account identifier if you sign in with Google.
• Profile information: any optional details you add, such as a display name, country or learning goals.
• Learning activity: courses you enrol in, lessons and quizzes you complete, scores, and the name you choose to appear on certificates.
• Communications: messages you send us for support, feedback or partnership enquiries.

Collected automatically

• Device and log data: IP address, browser type, operating system, referring page and timestamps, kept in server logs for security and troubleshooting.
• Usage analytics: aggregated, privacy-friendly statistics about which pages and lessons are used, so we can improve the curriculum.
• Cookies and local storage: small identifiers used to keep you signed in and remember preferences — see our Cookies Policy for the full list.

• Provide the service: create your account, deliver courses, track progress and issue certificates.
• Improve learning: understand which lessons work, fix confusing content and plan new courses using aggregated data.
• Keep the platform secure: detect abuse, prevent fraud, debug errors and protect learners.
• Communicate with you: send account and service messages, respond to support requests and — only if you opt in — occasional product updates.
• Meet legal obligations: keep records we are required to keep and respond to lawful requests.

If you are in the UK or European Economic Area, we rely on the following legal bases:

• Contract: processing needed to give you an account and deliver the courses you request.
• Legitimate interests: keeping the platform secure, preventing abuse and improving our content, balanced against your rights.
• Consent: optional analytics and preference cookies, and any marketing email — you can withdraw consent at any time.
• Legal obligation: retaining certain records and responding to valid legal requests.

We use strictly necessary cookies to run the site and, with your consent, preference and privacy-friendly analytics cookies. We do not use advertising cookies or third-party ad networks.

We do not sell your personal data and we do not share it for others’ marketing. We share limited data only in these cases:

• Service providers: hosting, email delivery, error monitoring and analytics vendors bound by contract to protect it.
• Embedded content: when a lesson embeds a video, the provider (for example YouTube) receives your request for that video under its own policy.
• Legal and safety: where required by law, or to protect the rights, safety and security of learners and the platform.
• Business transfers: if the project is transferred to a new operator, data would move with it under this same policy.

Our providers may process data in countries outside your own. Where that happens, we rely on recognised safeguards — such as an adequacy decision or Standard Contractual Clauses — to ensure your data keeps an equivalent level of protection.

• Account and learning data: kept while your account is active, then deleted or anonymised within 12 months of account closure.
• Server logs: typically retained for up to 90 days, longer only where needed to investigate an incident.
• Support messages: kept for up to 24 months to help with follow-up questions.

Depending on where you live, you have some or all of these rights over your personal data:

• Access a copy of the data we hold about you.
• Correct information that is inaccurate or incomplete.
• Delete your account and associated data.
• Export your data in a portable format.
• Object to or restrict certain processing, and withdraw consent.
• Opt out of the “sale” or “sharing” of personal information (we do neither) under US state laws such as the CCPA/CPRA.

Most actions are available directly in your dashboard settings. For anything else, contact us and we will respond within the timeframe the law requires (usually 30 days). You also have the right to complain to your local data-protection authority.

• Encryption in transit (HTTPS) across the whole platform.
• Passwords stored only as salted hashes, never in plain text.
• Access to production data limited to staff who need it, with logging.
• Regular dependency updates and monitoring for suspicious activity.

The platform is intended for users aged 16 and over. We do not knowingly collect data from children under 16. If you believe a child has given us personal data, contact us and we will delete it.

We may update this policy as the platform evolves or the law changes. We will post the new version here and update the date at the top. For material changes we will give prominent notice, such as an in-app message or email.

For privacy questions or to exercise your rights, reach the team through the contact channels listed on our About page. We aim to reply within a few working days.