Last updated: 15 August 2026
By using the Services, you agree to the terms of this Privacy Policy. You must not use the Services if you do not agree with this Privacy Policy or any other agreement that governs your use of the Services.
AMP Academy Private Limited ("the Company," "we," "us," or "our") operates the online culinary education platform located at amp-academy.com and artisanpastryacademy.com ("the Platform"). This document explains what personal data we collect, how we use it, who we share it with, and your rights regarding your personal information when you use our website, mobile interfaces, video player, and educational services ("the Services").
We collect certain data from you directly, such as information you enter yourself, data about your consumption of content, and data from third-party platforms you connect with AMP Academy. We also collect some data automatically, such as information about your device and what parts of our Services you interact with.
1.1. In this Privacy Policy, "Personal Data" means any information relating to an identified or identifiable natural person. "User" means any individual who accesses or interacts with the Platform. "Student" means a registered User who purchases or accesses educational content. "Chef" means a culinary instructor who publishes educational content on the Platform.
You provide data directly to us when you create an account, update your profile, submit an instructor application, make purchases, or communicate with us.
Account and profile data: When you create an account or edit your profile, we collect your full name, display name, username, email address, password credentials (stored using secure one-way hashing), profile photo, cover image, country of residence, biographical description, culinary specialties, and selected interface language (English or Sinhala).
Learning and course interaction data: When you access educational content, we collect records of your course enrollments, completed lessons, personal notes saved with lesson video timestamps, questions asked in course Q&A, answers submitted, course ratings, written reviews, and earned Certificates of Completion ("Certificates").
Chef and instructor onboarding data: If you apply to teach on the Platform, we collect your culinary resume, portfolio links, professional biography, social media account URLs, and payout destination details (consisting of verified PayPal email addresses for international disbursements, or Sri Lankan bank account details including account holder name, bank name, branch code, and account number for local bank transfers).
Payment and transaction data: When you make a purchase, we collect internal order identifiers, purchase record identifiers, purchased content identifiers, transaction currency (United States Dollars or Sri Lankan Rupees), gross amount paid, and payment gateway transaction references (such as PayPal order identifiers, PayPal capture identifiers, PayHere order identifiers, and PayHere payment identifiers). We do not store complete credit card numbers, debit card numbers, expiration dates, or card verification codes on our servers. All payment transactions are processed directly by PCI-DSS certified payment gateways.
Communications and support data: If you contact customer support, submit inquiries through our Help Center, or report a technical issue, we collect your contact information, messages, screenshots, and related correspondence.
When you access the Services, we automatically collect certain technical and usage data from your device.
Category of Personal Data | Description |
|---|---|
System and device data | Technical information about your computer or mobile device, including your Internet Protocol (IP) address, operating system, browser type, browser version, device identifiers, and language settings. |
Usage and playback telemetry | Information about your interactions with the Platform, including pages visited, referring URLs, search queries, API rate-limiting metrics stored in Redis memory cache, and video watch telemetry. Our video player records a verified 10-second segment watch bitmap to calculate genuine dwell time and track course completion progress. |
Video security telemetry | To protect intellectual property, our player exchanges short-lived signed JSON Web Tokens (JWTs) with Cloudflare Stream, renders dynamic watermark overlays displaying your registered email address, and records tab visibility or window blur events for capture deterrent enforcement. |
We use tools like cookies, session storage, and server telemetry to gather the data listed above. We also receive data from third-party services when you choose to connect them.
You provide Personal Data directly when you register an account, enroll in a course, upload lesson materials, write notes, post reviews, or submit support tickets.
We use first-party cookies for essential session authentication, cross-site request forgery (CSRF) defense, and interface language preferences (NEXT_LOCALE).
We use third-party cookies and edge beacons from Cloudflare and Google Analytics 4 to evaluate aggregated platform usage, mitigate bot traffic, and optimize page load speeds. For detailed information on our cookie deployment, refer to our Cookie Policy.
Social authentication: If you choose to log in through Google OAuth 2.0, we receive your verified email address, full name, and avatar image from Google LLC.
Payment gateways: When you complete a transaction, PayPal, Inc. or PayHere (Private) Limited sends webhook notifications confirming payment approval, settlement amounts, and transaction status.
We use your data to provide our Services, communicate with you, troubleshoot issues, secure against fraud and abuse, improve our platform, and comply with legal requirements.
3.1. We process your Personal Data for the following specific purposes:
Providing and administering the Services: Creating and maintaining your account, authenticating login sessions, enabling video streaming playback, saving student notes, tracking course progress, and issuing verifiable Certificates.
Processing payments and instructor payouts: Completing purchases, calculating platform commissions, maintaining the append-only instructor_ledger, enforcing the 30-day earnings maturation period, and executing manual payouts to Chefs.
Platform security and anti-piracy: Protecting user accounts from unauthorized access through Redis sliding-window rate limiting, enforcing two-factor authentication (2FA) for administrators, and deterring unauthorized video screen recording via dynamic watermarks and signed playback tokens.
Customer support and transactional communications: Sending purchase receipts, account verification emails, password reset links, administrator 2FA verification codes, course update notifications, and responding to help desk inquiries.
Service optimization and analytics: Evaluating course popularity, analyzing discovery patterns, improving bilingual search features, and diagnosing technical software errors.
Legal compliance: Fulfilling statutory accounting requirements, maintaining tax records, preventing financial fraud, and enforcing our Terms of Service.
We share certain data about you with instructors, service providers that process data on our behalf, payment gateways, and legal authorities when required by law. We do not sell your personal data.
4.1. We share your data under the following circumstances:
With Chefs and instructors: When you enroll in a course or post in a public course forum, the Chef can see your display name, profile avatar, country, course progress percentage, reviews, and Q&A questions. Chefs do not receive your password, full billing details, or private student notes.
With Third-Party Processors: We share data with verified external service providers ("Third-Party Processors") who perform essential operational functions on our behalf. Each provider is bound by contract to protect data confidentiality and security.
Processor | Operational role | Data transferred | Location |
|---|---|---|---|
Amazon Web Services (AWS Lightsail) | API container hosting, web container hosting, and PostgreSQL database storage | Account profiles, learning records, order data, encrypted credentials | United States |
Amazon Web Services (AWS SES) | Transactional email delivery and administrator two-factor authentication | User email addresses, recipient names, verification tokens | United States |
Amazon Web Services (AWS Lambda & SQS) | Serverless caption processing and audio machine translation | Video audio streams, subtitle transcripts, lesson identifiers | United States |
Cloudflare, Inc. (Cloudflare Stream) | Video hosting, adaptive bitrate transcoding, and signed playback streaming | Short-lived signed playback JWTs, video playback telemetry | Global Edge / United States |
Cloudflare, Inc. (Cloudflare R2) | Private object storage for recipe PDFs, certificates, and public image assets | Course documents, certificate PNG files, profile photos | Global Edge / United States |
Cloudflare, Inc. (Cloudflare Workers) | Certificate rendering engine and edge webhook routing proxy | Recipient names, course titles, incoming webhook payloads | Global Edge / United States |
PayPal, Inc. | Payment processing for international USD transactions | Buyer email addresses, billing names, transaction amounts | United States / Global |
PayHere (Private) Limited | Payment processing for Sri Lankan LKR transactions | Buyer names, email addresses, phone numbers, transaction amounts | Sri Lanka |
Google LLC | Optional Google OAuth authentication and aggregated platform analytics | OAuth profile identifiers, email addresses, pseudonymous analytics | United States / Global |
For legal compliance and protection: We may disclose your data if required by judicial subpoena, court order, or statutory mandate, or if we determine that disclosure is reasonably necessary to protect the rights, property, or safety of the Company, our Users, or the public.
We use appropriate security based on the type and sensitivity of data being stored. As with any internet-enabled system, there is always a risk of unauthorized access, so it is important to protect your password and to contact us if you suspect any unauthorized access to your account.
5.1. The Company implements technical, administrative, and physical security measures to safeguard your Personal Data against unauthorized access, destruction, loss, alteration, or disclosure.
5.2. Our security controls include:
Transport Layer Security (TLS 1.3) encryption for all network traffic between your browser and our servers.
Storage of sensitive system credentials and database connection strings as encrypted SecureString parameters within AWS Systems Manager Parameter Store.
Mandatory email one-time password two-factor authentication (2FA) for all administrative accounts.
Network isolation of Redis cache sidecars and PostgreSQL database clusters within protected private network configurations.
Automated sliding-window rate limiting on API endpoints to prevent brute-force authentication attacks and denial-of-service attempts.
5.3. No system can be 100% secure. You are responsible for maintaining the confidentiality of your account credentials. You must not share your password with any third party, and you must notify our support team immediately if you believe your account has been compromised.
You have certain rights around the use of your data, including the ability to access, correct, or delete your personal data, as well as choices regarding cookies and promotional communications.
6.1. You possess the following rights regarding your Personal Data:
Opt out of marketing communications: You can opt out of promotional emails by clicking the unsubscribe link contained in any marketing email. Transactional service messages (such as purchase receipts, password reset links, and account notices) cannot be opted out of while maintaining an active account.
Manage cookies and analytics: You can configure your browser to block or delete cookies, or install the Google Analytics Opt-out Browser Add-on. Refer to our Cookie Policy for step-by-step instructions.
You can access, update, and manage your Personal Data as follows:
Update or correct your data: To update information you provide directly (such as your display name, biography, avatar photo, or interface language), log in to your account and edit your profile settings at any time.
Delete your data: To request account termination:
If you are a Student, visit your profile settings page, navigate to the account security section, and select the delete account option.
If you are a Chef, navigate to your instructor settings page or submit a written account closure request to [email protected] to reconcile pending earnings ledger balances.
If you experience any difficulty terminating your account, contact our customer support team at [email protected].
Public contributions note: Even after your account is deleted, some data may remain visible to other users, including public course reviews and questions submitted to course Q&A forums. These contributions are anonymized and disassociated from your personal profile to preserve educational curriculum context for other enrolled students.
We will acknowledge and process verified requests to exercise your data rights within 30 days of receipt. We may request specific proof of identity before processing your request to prevent unauthorized disclosure.
We retain your personal data for as long as needed to provide the Services, fulfill our legal obligations, resolve disputes, and enforce our agreements.
7.1. We retain Personal Data across the following defined retention schedules:
Active accounts: Data associated with active accounts (including profile information, learning records, and student notes) is retained for as long as your account remains active.
30-day soft-deletion grace period: When you request account deletion, your account enters a 30-day soft-deletion grace period. During these 30 days, your profile is hidden from public view, and you may contact support to cancel the deletion request. Upon expiration of the 30-day window, your personal identity information, password hashes, and private notes are permanently deleted from active databases.
Statutory financial records: Financial transaction records, invoices, purchase ledgers, and payout logs are retained for seven years following the transaction date to comply with applicable tax, accounting, and anti-money laundering legislation.
Temporary cache keys: Video watch telemetry bitmaps and session rate-limiting keys stored in Redis memory cache expire automatically within 30 days.
If you live in Sri Lanka, the European Economic Area, or other regions with comprehensive privacy legislation, you have specific statutory rights.
8.1. International data transfers: The Company operates from Sri Lanka, with primary server infrastructure hosted in the United States and content delivery edge networks distributed globally via Cloudflare. When data is transferred internationally, we ensure appropriate contractual safeguards and encryption standards are maintained with all Third-Party Processors.
8.2. Children's privacy: The Platform is intended for adult learners and students aged 18 years and older. Individuals between 13 and 18 years of age may use the Services only under the direct supervision of a parent or legal guardian who agrees to this Privacy Policy. We do not knowingly collect Personal Data from children under 13 years of age. If we discover an unauthorized account registered by a child under 13 years, we will delete the account and associated data within seven business days.
When we make a material change to this policy, we will notify users through prominent means. Changes take effect on the day they are posted.
9.1. We may update this Privacy Policy from time to time to reflect changes in our platform features, technology providers, or applicable legal requirements.
9.2. When material changes are made, we will notify registered Users by email or by displaying a prominent notification banner on the Platform at least 14 days before the updates take effect.
9.3. If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, you may contact us by:
Email: [email protected]
Postal address:
AMP Academy Private Limited
420/1, Thalagala
Kiriwattuduwa
Sri Lanka