Data and security
How CodePLC Labs handles the people who learn in it, written for the IT, HR and administration teams who ask.
Last updated October 2026. Questions: support@codeplc.com.
Principles
- We collect what we need to run the training, and use it for that.
- We never sell data and never show ads. There are no advertising trackers inside Labs.
- When a school or employer pays for someone's training, the results earned under it belong to that organization. A person's own practice outside it stays theirs.
- We share only de-identified, aggregate data, for example the share of learners who pass a checkpoint.
What we collect
- Account: email address, and a name if one is given.
- Training records: lessons, work orders and checkpoints completed, with scores, times and the steps reached, so progress can be saved and shown.
- First-login answers: an individual member's goal and weekly plan, used to suggest what to do next.
- Errors: when something breaks in the browser, a technical error report so we can fix it.
We don't collect keystrokes, screen recordings, location, or payment card details. Payments are handled by our payment provider and never touch our servers.
What schools and employers see
Instructors, managers and owners see the training their people complete under the organization: lessons, work orders and checkpoint results, with dates. They don't see:
- anyone's practice outside the organization (for example on a personal membership),
- first-login goals for business learners, or which hints a person opened.
Where we show how a whole class or team did on a step, it's shown only for groups of five or more, so it can't point at one person.
How it's protected
- Separation in the database. Each organization's records are kept apart by row-level security rules in the database itself, so a request can only return rows the signed-in person is allowed to see.
- No passwords. People sign in with a one-time link sent to their email, so there are no passwords for us to store or for anyone to reuse.
- Encryption. All traffic uses HTTPS. The database is encrypted at rest by our database provider.
- Least access. Our support access to an organization's records is off unless the organization turns it on, and every change and support access is written to an activity log.
- Monitoring. Uptime and browser errors are monitored, and problems are fixed and tested before release.
Keeping and deleting data
- An organization's records are deleted on request, and after its contract ends.
- Anyone can ask for their own account and records to be deleted by emailing support@codeplc.com.
- An organization can ask for an export of its records at any time.
Services we use
| Service | What for |
|---|---|
| Supabase | The database and sign-in for CodePLC Labs |
| Cloudflare | Serving the website and Labs |
| Resend | Sending sign-in codes and service emails |
| Stripe | Payments |
| LearnWorlds | The video courses |
| Kit | Email newsletters, for people who sign up for them |
Agreements and reviews
- Schools: we'll review and sign your student data privacy agreement. Student records are used only to provide the service to your school.
- Businesses: a data processing agreement is available.
- Security reviews: we don't have a SOC 2 report yet. We're glad to answer your security questionnaire.
For the full legal terms, see our privacy policy and terms.