Privacy Policy

Last updated: 2 October 2026.

Who we are

Cognition Blueprint is the brand this site trades under. This website, cognitionblueprint.com, is operated by Academic Method Limited, 37A Gynn Lane, Honley, HD9 6LF, United Kingdom.

Academic Method Limited is the data controller for the personal information described here. For anything in this policy, including a request to see, correct or delete your data, write to legal@academicmethod.com.

The short version

We hold what running a course and a shop requires and nothing more. We run no analytics tool of our own; the only viewing statistics are the ones our video provider records when you play a course video. We do not advertise, and we do not sell, rent or share your data with anyone for marketing. Card details never reach our server. Five companies process data on our behalf: Stripe takes the payments, Anthropic and OpenAI power the AI features, Gumlet streams the course videos, and our web host, HostArmada, runs the servers. The home page also loads its typeface from Google Fonts. Everything below is the detail.

What we collect, and why

Your account

You get an account in one of two ways: you buy something, or we create one for you as part of enrolling you. Registration is closed to the public — there is no open sign-up form.

An account holds your email address, a username derived from your email, a display name (your name if you gave us one, otherwise your email address), your role on the site, and a password. WordPress stores passwords as a one-way hash; nobody at Academic Method can read your password.

When an account is created for you after a purchase, WordPress sends you an email inviting you to set your own password.

Buying

Payments are taken by Stripe. When you press the buy button you leave this site and land on a checkout page hosted by Stripe. Your card number is typed on Stripe’s page, not ours, and never touches our server or our database.

To set that checkout up we send Stripe the item you are buying, its price and currency, the addresses to return you to afterwards, an internal reference for the course or product, and — if you are logged in — your account number on this site and your email address so your purchase can be matched to your account.

When the payment completes Stripe notifies our server. We record an order containing:

your email address
your account number on this site, if you had one
which product or course you bought
the amount and currency
Stripe’s own references for the checkout session and the payment
whether the order completed
the date and time

We also keep Stripe’s notification message itself, in full, in a log. That message contains the details Stripe collected at checkout, which can include your name, your email address and a billing address. It never contains your full card number.

Stripe is an independent controller of the payment data it collects. Its own privacy policy governs that, and it is published at stripe.com/privacy.

Downloadable products

If you buy a product that comes as a file, the purchase creates a private download link tied to your order. We record the link’s reference code, the email address it belongs to, when it expires, how many downloads it allows, and how many you have used. The link stops working once it expires or the count runs out.

Subscriptions

If you take out a subscription we record your email address and account number, the product, Stripe’s subscription and price references, the status, the amount and currency, the linked licence, and the date the current period ends.

Your work on a course

The LMS records your progress so the course works: which courses you are enrolled on and when, which lessons you have completed, and quiz attempts. A quiz attempt stores the questions you were asked, the answers you gave, your score, whether you passed, and any AI feedback on that attempt.

It also stores what you type into the lessons themselves — notes you make on a lesson, and the answers and working you enter in a lesson’s interactive workbook. That material is yours. It is saved against your account so it is still there when you come back, and it is shown to the AI when you ask for feedback (see below).

Course videos

The videos in each lesson are hosted and played by Gumlet. When a lesson page with a video opens, Gumlet’s player loads from Gumlet’s own servers, which receive your IP address. The player keeps two identifiers in your browser — gm_analytics_user_id and gm_analytics_session_id — and sends viewing statistics to Gumlet’s analytics service, which we can see in our Gumlet account. It also remembers your volume, playback speed, audio language and where you stopped in each video. We do not send Gumlet your name, your email address or your account number. Gumlet’s policy is at gumlet.com/privacy.

The AI features, in detail

Two features send text to an AI provider: the course tutor, which answers questions from the course material, and AI feedback, which comments on work you submit in a lesson. Both are available only to logged-in learners. The tutor is limited to 40 questions per person per day, and feedback to 3 requests per lesson per day.

Where the text goes

The generating model is Claude, from Anthropic (model claude-sonnet-4-6). Our server calls Anthropic’s API directly. What we send is the instruction for the task and one message. Depending on the feature, that message contains:

the question you typed (tutor — capped at 1,000 characters)
extracts of the site’s own course material, so the answer is grounded in it
what you wrote in the lesson’s fields (feedback — capped at 4,000 characters per field)
what you entered in the lesson’s interactive workbook (capped at 4,000 characters)
a summary of your journey so far on that course, where the Folio is switched on (capped at 4,000 characters)
the lesson’s own text, so the feedback is about that lesson (capped at 6,000 characters)

We do not send Anthropic your name, your email address, your account number or any other identifier. The request carries the text and nothing else that identifies you. If your own writing contains personal details, those travel with it — so treat these boxes as you would any other text you are handing to a third party.

Separately, the tutor uses OpenAI (model text-embedding-3-small) to work out which parts of the course material your question is about. Your tutor question is sent to OpenAI for that purpose, on its own, with no identifier attached. The site’s own course text is sent to the same service when it is indexed. OpenAI is used only for this matching step; it does not write any answer you see.

Both services are used on their standard commercial API terms. Under those terms, what we send is not used to train their models, and each provider keeps it only for a limited period — by default up to 30 days — unless the law or its own safety rules require longer. Their own policies are published at anthropic.com/legal/privacy and openai.com/policies/privacy-policy.

What we keep afterwards

When an AI reply comes back, four things are written on our own server:

the reply, in full, saved against your account — this is what the “email me a copy” button reads, so it never has to trust anything sent back from your browser
an extract of up to 800 characters of what you submitted, and up to 800 characters of the reply, recorded in your Folio so your progress on the course reads as one story
a row counting the tokens used, with your account number, the provider, the model and the feature — no text at all
a counter of how many requests you have made today, so the daily limits work

The tutor is different: tutor questions and tutor answers are not stored. Only the daily counter and the token-count row are written.

There is one further behaviour you should know about. If what you write contains signals of a personal crisis, the system responds with a short supportive reply before anything else happens. That check runs on the text you submitted and is not recorded anywhere as a flag on your account.

Emails, forms and consent

Emails we send you

We log the emails the site sends: the type of email, the address it went to, your account number, the subject line, whether it was sent, and when. We log that it was sent — not what you did with it. There is no open, click or read tracking in any email this site sends.

The contact form

The contact form takes your name, your email address and your message, and emails them to us. Your IP address is not stored: it is converted to an irreversible fingerprint and held for one hour purely to stop the form being abused, then it disappears.

Signing up to a mailing list or a live session

Where the site offers a sign-up form, we record your email address, your name if you gave it, and where you signed up from. If that form asked you to opt in to emails, we also keep a permanent record of the opt-in as evidence: the exact wording you agreed to, the date, where you were, your IP address and your browser’s user-agent string. This record is never edited or deleted — it is what proves the consent was real. Withdrawing consent adds a new record; it does not erase the old one.

Comments, avatars and images

If commenting is open on a post and you leave a comment, we keep what you typed, the name and email address you gave, and your IP address and browser user-agent, to help spot spam. Your email address may be sent as an anonymised fingerprint to the Gravatar service to fetch your avatar; Gravatar’s policy is at automattic.com/privacy. If you upload an image to the site, strip its embedded location data first — other visitors can download it and read that data.

Who your data is shared with

We do not sell, rent, or trade personal information, and we do not share it for anyone else’s marketing. It reaches these companies, each doing a job for us:

Stripe — takes payments and handles card details (stripe.com/privacy)
Anthropic — generates the AI tutor answers and AI feedback (anthropic.com/legal/privacy)
OpenAI — matches a tutor question to the right course material (openai.com/policies/privacy-policy)
Gumlet — hosts and streams the course videos, and records viewing statistics for us (gumlet.com/privacy)
Google — serves the typeface on the home page through Google Fonts, so your browser sends Google your IP address when you open that page (policies.google.com/privacy)
HostArmada, our web host — runs the server the site, its database and its email sit on, in the United Kingdom

Some of these providers are based outside the United Kingdom, including in the United States. Where data leaves the UK it is protected by the standard contractual safeguards those providers publish.

Cookies

This site sets no cookies of its own on an ordinary visit, and there is no advertising. Two things come from outside the site: the home page’s typeface, from Google Fonts, and the video player on lesson pages, from Gumlet, which keeps identifiers in your browser for its viewing statistics. Our own cookies appear only when you do something that needs one — putting an item in a basket, or logging in. The full list is on our Cookie Notice.

How long we keep things

Records of AI usage — the token counts, with no text in them — are deleted automatically after 365 days.

Nothing else is deleted automatically. Everything else described in this policy is kept until you ask us to delete it, with two exceptions: order records, which we must keep for as long as tax law requires, and marketing consent records, which we keep permanently because their purpose is to evidence the consent.

If you ask us to close your account, we delete what we are not required to keep.

Your rights

Under UK data protection law you have the right to ask us for a copy of the personal information we hold about you, to have it corrected if it is wrong, to have it deleted, to have it sent to you or another provider in a portable form, and to object to or restrict how we use it. You can withdraw consent to marketing emails at any time.

To exercise any of these, email legal@academicmethod.com. We will reply as quickly as we can, and within one month of receiving your request; if we need something from you to confirm who you are, the month starts when we have it. If a request is complex we may take up to two further months, and we will tell you within the first month if we need to. Data requests are handled by hand, so please say plainly what you want — an export, a correction, or deletion.

If you are unhappy with how we have handled your information you can complain to the Information Commissioner’s Office at ico.org.uk, or by calling 0303 123 1113.

Why we are allowed to hold it

To perform our contract with you — your account, your purchases, your course access, your progress, and the AI features that are part of the course you bought
Our legitimate interests — keeping the site secure, preventing abuse of the forms, and keeping the site working
Legal obligation — keeping records of sales for tax and accounting
Your consent — marketing emails, which you can withdraw at any time

Children

This site is sold to adults and is not directed at children. We do not knowingly collect information from anyone under 16. If you believe a child has given us personal information, write to legal@academicmethod.com and we will remove it.

Security and breaches

The site runs over HTTPS. Passwords are stored as one-way hashes. Card details are never held by us. If a breach occurs that is likely to put your rights at risk, we will notify the Information Commissioner’s Office within 72 hours and tell you directly where the law requires it.

Changes to this policy

If we change what we do with your information we will update this page and change the date at the top. Where the change is significant we will tell account holders by email.