Privacy notice

1. Who we are

Station X Limited is the controller of the personal data described here: we decide why and how it is used. StationX is a trading name of Station X Limited, a company registered in England and Wales (company number 03773082). Registered office: Emstrey House North, Shrewsbury Business Park, SY2 6LG, Shrewsbury, United Kingdom. This notice covers labs.stationx.net only; our other websites have their own notices.

Questions or requests about your data: contact@stationx.net, or write to us at Station X Limited, Emstrey House North, Shrewsbury Business Park, SY2 6LG, Shrewsbury, United Kingdom.

2. What we hold about you

• Account: your name, email address and account ID, when you created your account and last signed in, and whether you have agreed to tips and offers by email. When you sign in with a code, we email the code to you; when you sign in through our course platform (Teachable), it gives us your name and email address.
• Purchases: what you bought, when, the Stripe customer and subscription references, renewal dates, and any refund, dispute or failed payment. You type your card details on Stripe's page; we never see or store your card number. For tax, Stripe collects your billing address, and a tax ID if you give one.
• Learning: the roadmap or goal you choose, each lab you launch (which lab, when, attempts used), lab completions, scores, lab time and results the lab platform sends back, the lectures you finish on courses.stationx.net and your course progress and certificates, weekly progress snapshots, and your achievements, points and leaderboard name if you use them. When points are switched on, your browser reports its timezone when you open your home page or My progress; we keep it, and any earlier ones, so your daily streak runs from your own midnight.
• Activity log: sign-ins, the main pages you open while signed in, checkouts, lab launches and results, lectures finished, your goal, the emails we send you and the links in them you open. It is recorded by our own server — no tracking script and no extra cookie.
• Emails: the emails we have sent you and whether you have turned off tips.
• Technical: your IP address and browser details in our server logs, used for security and to stop abuse, and the cookies in section 9.
• What you send us: support emails and what is in them, and what our support team notes about a question you raised.

If your seat was bought by your employer, they give us your name and email address and receive a progress report on your courses, labs and certificates.

3. Why we use it, and our lawful basis

• To provide what you bought — your account, access, labs, progress and the emails about your access: contract (UK GDPR article 6(1)(b)).
• To take payments, give refunds and account for tax: contract, and legal obligation (article 6(1)(c)) for the tax and accounting records the law makes us keep.
• To keep the service secure — preventing fraud, account sharing and attacks, and enforcing lab attempt limits: our legitimate interests in protecting the service and our customers (article 6(1)(f)).
• The activity log, support and the help we give you to finish — seeing what happened when you ask for help, reminders, and understanding why members stay or leave: our legitimate interests in supporting you and improving the service. Only StationX staff can see it, and every staff view of your record is itself logged.
• To comply with export control and sanctions law, including checking that orders do not come from places or people we may not supply: legal obligation, and our legitimate interests in meeting our supplier's export conditions.
• Tips and offers by email: your consent where we asked for it, otherwise our legitimate interests in helping you use what you signed up for. Every one has an unsubscribe link, and you can object at any time.
• Team progress reports for an employer who bought your seat: our and their legitimate interests in showing what the seats are used for.

We do not sell your data and we do not use it for advertising. We use a simple score to decide which members our staff contact first; it has no legal or similarly significant effect on you, and we make no decisions about you by automated means that do.

4. Who we share it with

These companies process data for us, under contract, only to run the service:

• Stripe — payments, tax calculation, receipts and the billing portal. Stripe is also a separate controller for its own legal duties, such as fraud prevention and financial regulation (stripe.com/privacy).
• Teachable — the course platform at courses.stationx.net and its sign-in.
• The lab platform — our lab platform provider runs the labs. It receives your name and email address every time you launch a lab, so the lab opens in your name, and it sends us your lab results.
• Our lab supplier — the company we buy the labs from, which can see lab usage on the lab platform for billing and support.
• Hetzner — hosts our server, which is in Ashburn, Virginia, in the United States, and its backups.
• Cloudflare — our DNS, and storage for our encrypted backups.
• Twilio SendGrid — sends our emails, including sign-in codes. Open and click tracking are switched off.
• Google Analytics — counts visits and purchases across StationX sites, so we can see which pages work. It sets the _ga cookies and receives your IP address and browser details; we send it no name, email or account ID, and advertising features are switched off.

We also share data where the law requires it (for example with HMRC or the police), with our professional advisers, and with a buyer if the business is ever sold.

5. Data sent outside the UK

Our server is in the United States, and Stripe, Teachable, the lab platform and our lab supplier, Cloudflare and SendGrid and Google are US-based or process data there. Where the recipient is certified under the UK Extension to the EU–US Data Privacy Framework (the UK–US "data bridge"), we rely on that. Otherwise we use the ICO's International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses. For buyers in the EU, the EU–US Data Privacy Framework or the EU Standard Contractual Clauses apply in the same way. Ask us for a copy of the safeguard that covers a particular transfer.

6. How long we keep it

• Account and learning records: while you have an account, and up to six years after your last subscription ends — the period in which a claim about the contract can be made — unless you ask us to delete your account sooner.
• Activity log, and our record of staff access to it: 24 months, then deleted automatically.
• Purchase, refund and tax records: six years after the end of the financial year they belong to, as tax law requires — also after you delete your account.
• Server logs: rotated automatically and kept for up to three months.
• Backups: encrypted, and replaced on a rolling schedule; the oldest is a year old, so deleted data leaves them within a year.
• Hourly snapshots of our database are kept for up to 48 hours, so information you ask us to erase can stay in those snapshots for up to 48 hours before it is overwritten.
• Support emails: as long as needed to deal with the question, and no more than six years.

7. Your rights

You have the right to: access the data we hold about you; have it corrected; have it deleted (erasure); restrict how we use it; object to our using it on the basis of legitimate interests (including the tips emails and the activity log); and data portability — a copy of what you gave us in a usable format.

If you are unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113), or, if you live in the EU, to the data protection authority where you live.

8. Security

Data travels over encrypted connections, card details stay with Stripe, backups are encrypted, access to the server is restricted to the people who run it, and every time our staff open, export or change a member's record it is logged. Staff access is logged per learner whenever a staff member opens an individual learner's record, downloads their data or a CSV that includes them, finds them in a search, or views the site as them; the staff dashboard's overview is not logged per learner.

9. Cookies

The cookies the site needs to work: __Host-session and session_present keep you signed in; signin_flow, signin_hint, oauth_state, oauth_pkce and oauth_return_to protect the sign-in itself and last only for it; ludus_guest is a first-party cookie (httpOnly, Secure, SameSite=Lax) kept for 30 days: set when you view our prices or start a checkout without signing in, it stops a guest being charged twice for the same plan and connects that purchase to the account you then create on the same device, so it is strictly necessary; ludus_flash shows a one-time message such as "You've signed out"; ludus_cancel_scope is a first-party cookie (httpOnly, Secure, SameSite=Lax, sent only to our billing pages) kept for 30 minutes: set when you cancel using a link we emailed you without signing in, it lets that one cancellation's confirmation page and its follow-up steps work, and it does not sign you in; hero_v remembers which header picture you saw; __Host-view_as is used by our staff only. Analytics cookies: Google Analytics sets the _ga cookies to count visits (section 4). They are not needed for the site to work. There are no advertising cookies on this site. Stripe sets its own cookies on its checkout and billing pages, under Stripe's policy.

10. Children

Subscriptions are sold to adults (18 and over). We do not knowingly hold data about children.

11. Changes to this notice

We update this notice when what we do changes, and change the date at the top. If a change matters to you, we will email you before it takes effect.

Also: Refund policy · Terms of service · Certificates · Account