Privacy Policy

Haven Courses (“Haven”, “we”, “us”) operates havencourses.com, a marketplace where independent teachers and students find each other and learn together. This policy explains what Haven collects, why, and what you can ask us to do about it.

Haven is for people aged 13 and over. Linking a parent or guardian to a student's account is optional: someone under 18 can use Haven — including buying a course and attending its live classes — without one. Where a guardian is linked, they accept our Terms and this policy on the student's behalf.

Haven is not directed to children under 13. We do not knowingly collect personal information from anyone under 13, and if we learn that we have, we delete it.

We ask for a date of birth at signup and use it to set an age band that drives age-appropriate protections across the product.

Some of this you give us. Some is collected automatically to keep the service running and secure.

Teachers must verify their identity before publishing a course or messaging students. We use Persona (Persona Identifiers, Inc.) for this.

When you verify, Persona — not Haven — collects a government-issued identity document, a photograph of your face which may be compared against the document, and information derived from these to confirm the document is genuine. The document is uploaded directly to Persona and never passes through Haven.

Persona processes that data as an independent controller under its own policy: withpersona.com/legal/privacy-policy.

Haven Chat exists so students and their teachers can talk about coursework. You should understand exactly how it works before you use it.

We automatically scan every message for phone numbers, email addresses, links to external sites, and references to off-platform messaging and payment services. Matches are flagged for review by a human moderator. We do this because most harm on learning platforms happens after a conversation moves somewhere nobody can see.

We share only what a provider needs to do its job. Every provider listed here is one Haven actually uses.

Haven's database and hosting are in the United States, and Haven's audience is in the United States.

Haven does not currently offer the service to users in the UK or EU. If that changes, this section will be updated before those users can sign up.

Both students and teachers on Haven may be under 18. That shapes how we handle data.

We would rather tell you what we actually do than publish a retention schedule we do not enforce.

You can ask us to do all of the following, whoever you are and wherever you live. Email support@havencourses.com and we will respond within 3 to 5 days. These are commitments Haven makes as a matter of policy, and we have limited them to things Haven can actually carry out.

U.S. privacy law is not one law. Most state privacy statutes only apply to businesses above a size threshold, and Haven is well below every one of them. We think it is more useful to tell you that than to publish a list of rights we are not actually obliged to provide.

So: the rights in the section above are offered to everyone as a matter of Haven's own policy, not because a particular state statute compels them. Where a law does apply to Haven, its requirements take precedence over this policy.

We protect your data with encryption in transit, database-level access controls that stop one user's data being reachable by another, restricted staff access, and audit logging of administrative actions.

Uploaded images are held in a private store and served through short-lived signed links, so a leaked URL goes stale quickly.

No system is perfectly secure. If a breach affects you, we will notify you as required by law.

We use cookies that are strictly necessary — keeping you signed in and securing your session. These are always on, because without them you cannot sign in.

We also use Google Analytics to understand which courses people find and where they get stuck. It is off until you allow it, and off means Google's code is never loaded: the first time you visit, Haven asks, and until you say yes nothing analytics-related is downloaded from Google, stored, or sent to it. Say yes and Google Analytics loads and sets its own cookie. Declining keeps every part of the site working.

What Google receives is limited on purpose: the page path you viewed, the site that referred you, an approximate region, and whether a purchase or signup completed. It never receives your name, email address, phone number, payment details or password, and Haven does not send Google any identifier that links analytics back to your account. Search terms are sent only as typed into the course search box, and are dropped if they look like an email address or a long number.

Google keeps event-level and user-level analytics data for 14 months from when it is collected, and that period does not restart when you come back. Its aggregate reports may be kept beyond that. Withdrawing consent stops any further analytics collection; it does not automatically erase what Google already holds, which expires on the schedule above.

Your theme preference, and your answer about analytics, are kept in your browser's local storage. Neither ever reaches us.

We will post any change here and update the date at the top of this page. For a significant change we will email you before it takes effect.

Where a change affects users under 18, or changes what we collect or who we share it with, we will say so plainly rather than relying on you noticing a new date.