Privacy Policy
Last Updated: 15/10/2026
At Anytime Creativity, we are committed to protecting your personal data and privacy. This Privacy Policy outlines how we collect, use, store, and share your personal information in compliance with the General Data Protection Regulation (GDPR).
1. Who we are and our role
Anytime Creativity Limited (‘we’, ‘us’) is a company registered in Ireland, with its registered office at 47 Clonturk Park, Drumcondra, Dublin 9, D09E6X9. When a university or other institution (the ‘Customer’) uses the platform with its students and staff, the Customer is the data controller and we act as its data processor, following its documented instructions under a data processing agreement. We are the controller only for personal data about visitors to our website, people who request a demo, and our own business contacts, which we hold in our CRM
2. Personal Data We Collect
- Identification and contact data: name, email address and the institution a user belongs to
- Work and communications: documents, images, prototypes, comments and peer feedback that users submit
- Progress and activity data: challenge participation, stage progress, timestamps and activity logs
- Engagement indicators: patterns in usage over the course of a challenge, used to estimate motivation and engagement and to prompt students with motivational nudges
- Device and usage data: browser type, operating system, IP address and interaction data, collected through Microsoft Clarity
- Authentication data: sign-in events and, for users with a local login rather than single sign-on, a hashed password
- AI feature data: the text a user submits to the optional AI stage and the response returned
We do not ask for special category data (such as health, ethnicity or religion) and users should not enter it.
3. How We Use Your Data
We use your data for the following purposes:
- To create and manage accounts and deliver the challengesTo facilitate participation in challenges, track progress, and issue digital badges
- To show educators student progress and produce each student’s impact portfolio
- To estimate engagement over a challenge and prompt students with motivational nudges
- To provide support, keep the platform secure and fix faults
- To provide the optional AI coaching feature
- To improve and optimise the platform, using anonymised and aggregated usage data wherever possible
- To meet legal obligations
4. Legal Basis for Processing Your Data
For users at a Customer, the Customer decides the legal basis (public universities usually rely on their public task) and we process on its instructions. For our own controller activities we rely on legitimate interests, such as security, support and running our business, and on consent where the law requires it, including for analytics cookies.
5. Data Storage and Security
- Your personal data is stored on secure servers hosted by Amazon Web Services (AWS) in Ireland.
- We implement technical and organisational measures to protect your data against unauthorized access, alteration, disclosure, or destruction.
- AWS provides robust security infrastructure, ensuring compliance with EU data protection regulations.
6. Data Sharing and Disclosure
We may share your data with:
- Amazon Web Services: Hosting, storage and backups (Ireland)
- OpenAI: Optional AI coaching feature (U.S)
- Legal Authorities: If required by law or to enforce our rights, we may share data with legal authorities.
- Microsoft Clarity: Usage analytics
- Microsoft and Google: Single sign-on, email address only
- Our CRM database supplier: Hubspot, Inc. (No student or user data is stored here, only buyer details.)
We also share data with staff and contractors who need it to run the platform, and with authorities where the law requires it. We do not sell personal data or share it for direct marketing. We tell Customers before we add or replace a sub-processor.
7. Where data is stored and transferred
Personal data is stored in the European Union, on AWS in Ireland. We do not give personnel outside the EU/EEA access to personal data. Text submitted to the optional AI feature is sent to OpenAI, which may process it in the United States under Standard Contractual Clauses set out in its data processing addendum with us
8. Data Retention
Platform data is kept for the Customer’s subscription, and the Customer can ask us to delete it earlier
AI submissions and responses are deleted after 90 days. User and timestamp records are kept separately for audit
After the agreement ends we keep data for 90 days so the Customer can retrieve it, then delete it securely
Database backups are kept for 14 days
9. Your Rights Under GDPR
You have the following rights regarding your personal data:
- Right to Access: Request access to the data we hold about you.
- Right to Rectification: Correct any inaccuracies in your personal data.
- Right to Erasure (Right to be Forgotten): Request the deletion of your personal data.
- Right to Restriction of Processing: Restrict the processing of your personal data under certain conditions.
- Right to Data Portability: Receive your data in a commonly used format and transfer it to another service.
- Right to Withdraw Consent: Withdraw consent at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, please contact us at info@anytimecreativity.com.
If you use the platform through an institution, contact its data protection officer first, and we will help. You can also contact us at info@anytimecreativity.com. Our data protection contact is Jack Carey. You can complain to the Data Protection Commission at www.dataprotection.ie.
10. Security of Your Data
We take data security seriously and have implemented strict security measures:
- Access to your data is strictly controlled.
- Our online CRM supplier Hubspot, Inc. complies with the Privacy Shield Framework and GDPR regulations.
- We do not provide your personal information to third parties for direct marketing.
- We do not outsource any data storage or processing beyond Amazon Web Services (Ireland).
- Data is encrypted in transit and at rest.
- Access is limited by role, sign-in events are logged, the database is not publicly accessible, and we monitor the platform for threats.
- We have an incident response plan and a SOC 2 Type II report, available on request
11. Data Breach Notification
We tell the Customer without undue delay if we become aware of a breach affecting its data. For data where we are the controller, we notify the Data Protection Commission within 72 hours where the law requires it, and tell affected people where there is a high risk to them.
12. Updates to This Privacy Policy
We may update this Privacy Policy periodically. Any changes will be communicated via email or through the platform. We encourage you to review this policy regularly.
13. Contact Us
If you have any questions or concerns about this Privacy Policy or how we handle your personal data, please contact us at:
- Email: info@anytimecreativity.com
- Address: 47 Clonturk Park, Drumcondra, Dublin 9, D09E6X9
Resources & Further Information
At Anytime Creativity, we are committed to protecting your personal data and privacy. This Privacy Policy outlines how we collect, use, store, and share your personal information in compliance with the General Data Protection Regulation (GDPR).
