Privacy Policy

The Yorùbá Language Program (“we,” “our,” or “us”) is committed to protecting your personal information. This Privacy Policy explains what data we collect, why we collect it, how it is stored and protected, and your rights regarding that data. It applies to all visitors and enrolled students of https://yoruba-language-program.com.

1. Information We Collect

1.1 Information you provide directly

• Registration & enrollment: Name, email address, payment details, and any information submitted via our enrollment forms.
• Newsletter subscription: Email address submitted through our website subscription form.
• Account creation: Email address and password (securely hashed) when creating a member account on this site.
• Communication: Messages sent to us by email, WhatsApp, or other channels.
• Feedback: Responses to end-of-unit and end-of-course satisfaction surveys.
• Recording consent: Signed consent forms indicating your preferences for how your image and voice from class recordings may be used.

1.2 Information collected automatically

• Analytics: We use Google Analytics 4 to collect aggregated, anonymised data about site visits — including pages viewed, approximate geographic region, and device type. Google Analytics may set cookies (_ga, _gid) in your browser. You can opt out via Google's opt-out tool.
• Session tokens: When you sign in to the member area, NextAuth.js stores a session token in a secure, httpOnly cookie. This cookie is used solely to authenticate your account — it is not used for tracking.

2. How We Use Your Information

• To process enrollment, verify payment, and grant access to course materials.
• To send class schedules, Zoom links, curriculum updates, and program news.
• To deliver your newsletter subscription, including class updates and cultural events.
• To send administrative notifications (e.g., recording availability, feedback reminders).
• To compile anonymised feedback for curriculum review and quality improvement.
• To generate AI-assisted transcripts and study packs from class recordings, where you have given consent (see Section 5).
• To meet our legal and accounting obligations.
• To understand aggregate site usage and improve this website.

We do not sell, rent, or trade your personal information to any third party.

3. Legal Basis for Processing (GDPR)

Where the General Data Protection Regulation (GDPR) applies, we process your personal data under the following legal bases:

• Contract: Processing necessary to deliver the educational services you have enrolled in and paid for.
• Consent: Newsletter subscriptions, optional promotional use of recordings, and analytics cookies — each requires your explicit opt-in.
• Legitimate interests: Internal quality reviews, fraud prevention, and improving our curriculum where your interests do not override ours.
• Legal obligation: Retaining financial records as required by law.

4. Data Sharing

We share your data only with the following categories of service providers, and only to the extent necessary to deliver the program:

• Resend — email delivery service (used to send welcome emails, newsletters, and notifications).
• Google Workspace / Google Drive — secure storage of class recordings, study materials, and consent forms, with access restricted to enrolled students and authorised staff.
• Stripe — payment processing. Stripe handles all payment card data; we do not store card numbers on our systems.
• Zoom — live class delivery and recording.
• Google Analytics — anonymised site analytics.
• Netlify / Vercel — web hosting and deployment infrastructure.
• Ifá Scribe (OrunmilaNet) — AI-assisted transcription of class recordings for study pack generation, where student consent has been obtained.

All providers are required to protect your data in accordance with applicable privacy law. We do not share data with advertising networks.

5. Class Recordings

• All live sessions are recorded via Zoom. Students are notified verbally at the start of each session.
• Prior to recording, enrolled students are required to sign a Student Consent Form for Recordings which explains how recordings may be used.
• Recordings are stored securely on Google Drive with viewer-only access restricted to currently enrolled students and authorised program staff.
• Students may not download, copy, or share recordings outside the program.
• Retention: Recordings are retained for 1 year from the date of recording, then permanently deleted and logged.
• AI-generated transcripts and study packs derived from recordings are subject to the same access controls and deletion timeline.
• Use of your image or voice for promotional purposes (website, social media) is opt-in only, governed by a separate item on the consent form.

6. Data Retention

7. Cookies

This site uses a minimal number of cookies:

Unauthenticated visitors who have not opted in to analytics have no tracking cookies set. No advertising or third-party marketing cookies are used on this site.

8. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Ask us to correct inaccurate data.
• Erasure: Request deletion of your personal data (“right to be forgotten”), subject to legal retention requirements.
• Objection: Object to processing based on legitimate interests.
• Data portability: Receive your data in a structured, machine-readable format.
• Withdraw consent: Unsubscribe from newsletters at any time by replying “unsubscribe” to any email, or contact us directly.

To exercise any of these rights, email us at admin@yoruba-language-program.com. We will respond within 30 days.

9. Security

• All data is transmitted over HTTPS (TLS 1.3).
• Member passwords are hashed using bcrypt; plaintext passwords are never stored.
• Session tokens are stored in httpOnly cookies inaccessible to JavaScript.
• Google Drive access is restricted by role — students receive viewer-only access.
• Payment card data is handled exclusively by Stripe; we have no access to card numbers.

10. Children's Privacy

Students under 18 years of age require a parent or guardian signature on the Student Consent Form for Recordings. If you believe we have inadvertently collected personal data from a child without appropriate consent, please contact us immediately so we can delete it.

11. International Data Transfers

Our hosting infrastructure is operated from the United States. If you are located in the European Economic Area (EEA) or the United Kingdom, your data may be transferred to and processed in the United States. Where required, we rely on Standard Contractual Clauses (SCCs) or equivalent mechanisms to ensure adequate protection.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified via the program mailing list and reflected in the effective date above. Continued use of the site after changes constitutes acceptance.

13. Contact

For privacy-related questions, data requests, or to unsubscribe from communications: