Privacy policy.

This policy explains what personal information Tokat Institute collects, why, who we share it with, how long we keep it and what rights you have. "Tokat Institute", "we" and "us" mean THE IAIS LLC, a New Jersey limited liability company doing business as Tokat Institute. We are the controller of your personal information. Contact us at admin@tokatinstitute.org or at PO Box 1200, Montclair, NJ 07042, USA.

1. What we collect

When you create an account: your name, email address, phone number, occupation and password. Your password is handled by our membership provider, and we never see it.

When you register or pay: the courses, lectures and memberships you hold, and your payment details. Card payments are processed by Stripe. We receive your name, email, country, the amount paid and the last four digits of your card, never the full card number.

When you apply for a scholarship: the information on the form. That includes your mailing address, date of birth, country of residence, nationality, education, languages, the courses you want to take, why you want to take them, your financial situation, what you can pay and who referred you.

When you apply to teach: the information on the form, including your CV, academic profile, links, references and course proposal. If you choose to sign in with ORCID, we also receive your ORCID iD and name from ORCID.

When you submit a capstone paper: your name, email, track, the paper itself and the details you give about it, and the faculty's assessment.

When you are awarded a certificate: the name to print, the credential, the date and a reference code.

When you watch recordings: which Tokat Studio and lecture videos you play, how much of each you have watched, how far you got, whether you finished and when. We use this to show your progress and to check certificate requirements.

When you join a live session: we give Zoom your email address so that registered students are admitted. Sessions are recorded. If you turn on your camera or microphone or write in the chat, the recording includes your image, voice, display name and contributions.

We make the recording available only to the people registered for that course or lecture. We do not use your recorded image, voice or contributions in promotional material, and we do not distribute them in any other way. If we ever want to, we will first ask for your permission in a separate written email.

When you write to us or subscribe: your name, email and message, or your email address and the newsletter you chose.

When you use the site: technical information such as your IP address, browser, device, pages visited and referring page. It is collected by our host and by the analytics and advertising tools described in section 4.

2. Why we use it, and on what legal basis

Under EU and UK data protection law, each use has a legal basis:

• Running your account, courses, recordings, memberships and certificates: performance of our contract with you.
• Taking payments, keeping accounting and tax records: contract; legal obligation.
• Assessing scholarship, teaching and capstone submissions: steps you ask us to take before or under a contract.
• Showing your progress and checking certificate requirements: contract.
• Course emails about classes you registered for: contract.
• Newsletter and announcements: your consent; unsubscribe at any time.
• Analytics and advertising cookies: your consent, where the law requires it.
• Security, preventing fraud and abuse, keeping the site working: our legitimate interests.
• Keeping a public register so others can verify a certificate: our legitimate interest, and yours, in certificates that can be trusted.

3. What is public

• The certificate register at /verify shows the name on a certificate, the credential, the date and whether it has been withdrawn, to anyone who enters its reference code.
• Lecture recordings may be published openly, for example on YouTube. Participants appear in them only if they have given written permission (section 1). Course recordings are shown only to students registered for that course.
• Course feedback you send may be quoted on our site with the name you gave, unless you ask us not to.

4. Cookies and similar technologies

• Necessary: our membership provider stores a login token in your browser to keep you signed in. Cloudflare Turnstile checks that form submissions come from a person.
• Analytics: Google Analytics measures how the site is used.
• Advertising: Google Ads and the X (Twitter) pixel measure whether our ads lead to visits and registrations.
• Tag management: Google Tag Manager is installed on our pages to manage these tools. It does not set cookies of its own.
• Embedded video: Vimeo and YouTube players may set their own cookies when you play a video.

Analytics and advertising cookies are set only after you accept them in our cookie banner. You can change your choice at any time from the "Cookie settings" link in the footer.

Google and X may collect information about your online activity over time and across different websites through the tools above. Our site does not respond to browser "Do Not Track" signals.

5. Who we share it with

We do not sell your personal information. We share it only with the service providers that run the Institute for us, and only as far as each one needs:

• Webflow: website and forms
• Memberstack: accounts and membership, including its email provider
• Stripe: payments
• Zoom: live sessions
• Vimeo and YouTube: video
• Mailchimp and Zapier: email
• Google Workspace: email, documents and the recording archive
• Cloudflare: website infrastructure and spam protection
• DigitalOcean: our staff administration server
• Google (Analytics, Ads and Tag Manager) and X: analytics and advertising
• ORCID: optional, if you use it to sign in

We may also disclose information where the law requires it, or to protect our rights or the safety of others.

6. International transfers

We are based in the United States, and most of our providers store data here as well. If you use the Services from the European Union, the United Kingdom or another country with rules on transfers abroad, your personal information comes to us in the United States. For transfers from the EU and UK we rely on the EU–US Data Privacy Framework where a provider is certified, or on standard contractual clauses.

7. How long we keep it

We keep personal information for as long as it serves the purposes in section 2. For most records, including your account, your applications, your capstone paper and your viewing progress, that has no fixed end date. The Institute may delete any of it at any time once it no longer needs it. In particular:

• Session recordings: available with no set end date. After a course has ended, the Institute may remove a recording at any time.
• Payment and accounting records: at least as long as tax law requires.
• Certificate records: kept permanently, so that the register can confirm a certificate.

You can ask us to delete your information at any time (section 9). We will do so unless the law requires us to keep it or we need it to confirm a certificate.

8. Security

Access to personal information is limited to the staff who need it. Our providers are chosen in part for their security. No system is perfectly secure. If a breach affects you, we will tell you and the authorities where the law requires.

9. Your rights

Depending on where you live, you may have the right to:

• know what we hold about you and get a copy of it
• correct it
• delete it
• restrict or object to how we use it
• take it with you in a portable form
• withdraw consent at any time
• complain to a data protection authority

To use any of these rights, write to admin@tokatinstitute.org. We will answer within 30 days. We may need to confirm your identity first.

You can also complain to your local authority: in the EU, your country's data protection authority; in the UK, the ICO.

10. Children

The Services are only for adults aged 18 or over. If we learn that we hold information about someone under 18, we will delete it.

11. Changes

We may update this policy. The new version will be posted here with a new date. If a change is significant, we will email registered members.

12. Contact

THE IAIS LLC, doing business as Tokat Institute
PO Box 1200, Montclair, NJ 07042, USA
admin@tokatinstitute.org