Privacy Policy

Complora is a training, certification and compliance platform operated by Training Services International (“TSI”, “we”, “us”). This policy explains what personal data the platform handles, why, and what you can do about it.

Organisations (“customers”) use Complora to manage their own training records. Where we process data on a customer’s behalf, that customer decides why and how it is used, and their own privacy notice applies alongside this one.

Account information. Name, email address, password (stored hashed), and the organisation and role you belong to.

Training records. Class enrollments, attendance, form responses, quiz submissions and results, certificates, and any documents or photos uploaded as part of a course or compliance record.

Operational data. Sign-in timestamps, audit records of changes, and email send and delivery events (for example whether an invitation was delivered or bounced).

Connected service data. Where you choose to connect a third-party account, the data described in the section below.

Connecting a Google account is entirely optional and is only used to send email from your own mailbox instead of ours. If you never connect one, Complora never touches your Google data.

When you do connect one, we request only these permissions:

• openid and email — to record which mailbox was connected, so the app can show you the address you are sending from.
• gmail.send — to send messages you initiate in the app (such as a class invitation) from your address, so replies come back to you. This permission cannot read any message in your mailbox.
• gmail.labels — optional, and only if you tick it. Lets the app file the mail it sends under a label. It cannot read message contents.

We do not request permission to read, modify or delete your email, and we do not store the contents of your mailbox. We store the OAuth access and refresh tokens, encrypted at rest with AES-256-GCM, and the address of the connected mailbox.

Complora’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, data obtained through Google APIs is used only to provide the sending feature you asked for. It is not sold, not transferred to others except as needed to provide that feature or where required by law, not used for advertising, and not read by humans except with your explicit consent, to resolve a support issue you raised, for security purposes, or where required by law.

You can disconnect at any time from the Connectors page in the app, which deletes the stored tokens and revokes our access at Google. You can also revoke access directly at your Google Account permissions page.

To operate the platform: authenticating you, showing your classes and records, generating certificates and regulatory exports, and sending email you or your administrator initiates.

To keep the service secure and working: diagnosing faults, preventing abuse, and maintaining audit records that compliance obligations require.

We do not sell personal data, and we do not use it for advertising or to train machine-learning models.

We share data with service providers who run parts of the platform on our behalf — hosting, database storage, file storage, email delivery and payment processing — under contracts that limit them to providing those services.

We share training records with the organisation whose training you are taking, since those records exist for their compliance obligations. We may disclose data where the law requires it.

Training and certification records are kept for as long as the customer organisation requires them, which for regulated training is often several years after a course ends.

Connected-account tokens are deleted as soon as you disconnect. To request deletion of your personal data, contact us at support@tsitraining.com, or ask the organisation that enrolled you. Where we act on a customer’s behalf we will pass the request to them.

Data is transmitted over TLS and stored on managed infrastructure with access limited to staff who need it. Sensitive values — passwords, connected-account tokens, and Social Security numbers where a regulator requires us to hold them — are hashed or encrypted at rest. No system is perfectly secure, and we cannot guarantee absolute security.

The platform is intended for workplace training and is not directed at children under 13. We do not knowingly collect their data.

We will update this page when our practices change and revise the date above. Material changes will be notified in the app or by email.

Questions about this policy or a request about your data: support@tsitraining.com, or through our contact page.