Privacy Policy

Last updated: 4 November 2026

This policy explains how Prometheus Academy collects and uses your personal data when you visit our website, buy the course Digital Assets Evidence & Investigations or use it. We take your privacy seriously and collect only what we need to run the course.

1. Who is responsible for your data

The data controller is Themis Recovery AG, a company registered in Switzerland under number CHE-405.562.827, with its registered office at Alpenstrasse 15, 6300 Zug, Switzerland, which operates Prometheus Academy ("we", "us"). For any question about your data, or to use your rights, email info@token-academy.io.

2. What we collect

• When you buy: your name, email address and the payment reference. Stripe takes your payment; we do not see or store your card number.
• Your account: your email address and your login activity. We do not use passwords: you sign in with a one-time link sent to your email.
• Your learning record: which modules you have completed, your assessment answers, scores and number of attempts, how long you spend in the course, whether you have completed the case investigation, the name you enter for your certificate and your certificate number.
• Messages you send us: for example support emails and any feedback you give us.
• Technical data: your IP address and basic device and browser information, which our hosting and security systems record when you visit the site.
• Device and session data: when you sign in we record a device label (for example "Chrome on Windows"), a one-way scrambled form of your IP address and when the session was last active, so we can limit how many devices use one account at a time. Course pages show your email address and the time as a faint watermark to discourage sharing of the material. Your browser also keeps a few small settings (for example that you have seen the welcome message) in local storage, which is not used for advertising.

3. Why we use your data, and our legal basis

• To provide the course you bought (create your account, let you log in, save your progress, mark your assessment, issue your certificate, give you support). Legal basis: performing our contract with you.
• To take payment and keep financial records. Legal basis: performing our contract, and our legal obligations (accounting and tax).
• To keep the service secure, prevent cheating and sharing of accounts, and check certificates are genuine. Legal basis: our legitimate interests in protecting the course and its certificates.
• To improve the course (for example, seeing which questions are unclear). Legal basis: our legitimate interests. We use this on an aggregated basis wherever we can.
• To reply to you when you contact us. Legal basis: legitimate interests, or our contract with you.

We do not sell your data and we do not use it for advertising. We do not make decisions about you by automated means beyond marking your assessment, which is a fixed pass mark you can retake.

4. Certificate verification

If someone asks us to confirm that a certificate number is genuine, we may confirm the name on it, the course, the date issued and the score. We do not release your email address.

5. Who we share your data with

We use trusted companies to run the service. They act on our instructions and only receive what they need:

• Stripe: payment processing.
• Supabase: our database and login system, which stores your account and learning record.
• Namecheap: website hosting and our email service.
• Content delivery and font providers (such as Cloudflare/cdnjs, jsDelivr and Google Fonts): the website loads some standard code libraries and fonts from them, so they will receive your IP address when you load a page.

We may also share data where the law requires it, with our professional advisers, or if our business is sold or restructured (in which case the new owner will protect your data in line with this policy).

6. Where your data goes

We are based in Switzerland. Some of our suppliers, including Stripe, may process data in other countries, including the United States. Where data is transferred outside the UK, the EEA or Switzerland, we rely on adequacy decisions or on approved safeguards such as standard contractual clauses. You can ask us for details by emailing us.

7. How long we keep your data

• Your account and learning record: for as long as you have access to the course, and for a reasonable period afterwards so that we can verify your certificate and deal with queries.
• Payment and accounting records: for as long as the law requires, which can be up to 10 years.
• Support emails: normally up to 3 years after our last contact.

When we no longer need data, we delete it or make it anonymous.

8. Cookies and similar technologies

We do not use advertising or tracking cookies, and we do not use analytics tools. Your browser stores a small amount of data that the course needs in order to work: your login session and your saved progress. These are essential, so no consent banner is required for them. You can clear them at any time in your browser settings, but you will then need to log in again.

9. Your rights

Depending on where you live, you have the right to:

• ask for a copy of the data we hold about you;
• ask us to correct data that is wrong;
• ask us to delete your data (we may need to keep some records, such as payment records and the record of a certificate we have issued);
• ask us to restrict how we use it, or to object to uses based on our legitimate interests;
• ask for your data in a portable format.

To use any of these rights, email info@token-academy.io. We will reply within one month.

10. Complaints

Please contact us first so we can try to put things right. You also have the right to complain to the regulator where you live: in the UK, the Information Commissioner's Office (ico.org.uk); in Switzerland, the Federal Data Protection and Information Commissioner (edoeb.admin.ch); in the EU, your national data protection authority.

11. Security

We protect your data with measures including encrypted connections, restricted access to our systems, and a login system that does not store passwords. No online service is completely secure, but we work to keep your data safe and will tell you and the regulator where we are required to if there is a breach.

12. Children

The course is for professionals and is not intended for anyone under 18. We do not knowingly collect data from children.

13. Changes to this policy

We may update this policy from time to time. The latest version is always on this page, with the date it was last updated at the top.