MahjongPrivacy Policy
What we collect, why we collect it, how long we keep it, and how you can see, change or delete it.
Summary
In short: you can watch the videos, take the quizzes and play the games without giving a name or an email address. We only collect personal information once you register as a student.
About us
Mahjong Academy CIC is a community interest company founded in Cambridge, United Kingdom, in 2026 by Chris and Carina. Company number 17435406, registered in England and Wales. Registered office: Unit C, Blackett Street, Manchester, M12 6AE, United Kingdom.
This policy covers the mahjong.academy website, student accounts, courses, the newsletter and course feedback.
Contact: hello@mahjong.academy
What we collect
Visitors who have not registered
You can watch the public videos, take the quizzes and play the games without giving a name or an email address.
While you browse, however, the services that host and protect the site may automatically process a small amount of technical information, such as: your IP address; your browser, device and operating system; the time of your visit and the pages requested; and error, access and security logs.
This is used to deliver the pages, keep the site running, diagnose faults, prevent misuse and protect accounts. It is never used for advertising or to build a marketing profile.
Registering as a student
Registering as a student is for those aged 18 and over. When you register we collect: your email address; your table name; the city you are in; how much mahjong you already know; the language you would like to hear from us in; whether you chose the newsletter; and a record of your registration, sign-ins and consent.
City and mahjong background must be answered, but both offer a "Prefer not to say" option. You do not have to tell us where you are or how much you know.
We do not ask for your real name, your address or your telephone number.
Your learning progress
Before you register, your progress, badges and game records are stored in the browser on your own device (technically, in local storage). They are not sent to us. If you clear your browsing data or use private browsing, they disappear.
Once you register, your progress is kept with your account and follows you between devices. Anything you finished before registering is carried over.
The same is true of your Mahjong Challenge result: before you register it stays in your own browser and never reaches us; once you register it is kept with your account, and is used to suggest which level to begin at and to open that level for you.
Course feedback
You may leave feedback on a course, and you may also tell us which country or region you are in and which of our activities you have joined. Only we can see any of it, unless you agree to it being public.
If you do agree, we review it first, and may then publish it on the website showing your table name, the country or region you gave, and which of our activities you joined. Your email address is never shown.
If you email us, we receive your email address, the contents of your message, and anything else you choose to tell us in it.
Why we ask for it
Everything we collect has a purpose, and a legal reason. The "legal reason" is something the law requires us to state: what entitles us to handle that piece of information.
Your email address — to send your sign-in link, and notices about the course.
Reason: necessary to provide the student service.
Your table name — it appears in the lessons in place of your real name.
Reason: necessary to provide the student service.
Your language — it decides which language we write to you in.
Reason: necessary to provide the student service.
Your city — so we can decide which cities to hold events in.
Reason: our legitimate interest in planning community events. You may choose "Prefer not to say".
Your mahjong background — to improve what the course teaches and how it is arranged. We look at the overall picture, and never use it to make decisions about you as an individual.
Reason: our legitimate interest in improving the course. You may choose "Prefer not to say".
The newsletter — we only send news about new lessons and events if you ticked the box.
Reason: your consent. You can unsubscribe at any time, and it does not affect your student account.
Public course feedback — we only consider publishing feedback you have asked us to make public.
Reason: your consent. You can withdraw it at any time.
Technical and security logs — to deliver the pages, keep the site running, diagnose faults and prevent misuse.
Reason: our legitimate interest in running the site safely.
Replying to your email — to answer your question and deal with your request.
Reason: our legitimate interest in responding to enquiries.
Where it is kept, and who helps us
Vercel
Vercel hosts the website, delivers the pages, and handles the necessary technical and security logs. It may process IP addresses, browser and device information, request times, the addresses requested, and error and security logs.
Supabase
Student accounts, registration details, learning progress and feedback records are held by Supabase, with our main database region in London, United Kingdom.
Supabase's sign-in and security systems may also record sign-ins, sign-outs, registrations, email verification, IP addresses, device or browser information and times.
We use account permissions and database access rules so that one student can never see another student's private records.
Brevo and Google
Sign-in links and necessary account emails are sent by Brevo, a French company that processes data within the European Union and holds ISO 27001 security certification. Brevo processes your email address, the contents of the message, and delivery records such as whether it arrived.
Brevo also counts how often emails are opened and links are clicked, and links in the email pass through Brevo’s servers on the way. We have switched anonymous tracking on, so those counts are not tied to individual students and Brevo does not record who clicked.
Our own inbox is provided by Google Workspace. When you email us, Google processes your address, your message and the related security records.
Our own inbox is provided by Google Workspace. When you email us, Google processes your address, your message and the related security records.
The mailing list
The mailing list is held by Brevo as well — the same company that sends your sign-in links, registered in France, processing data within the European Union and holding ISO 27001 security certification.
Only students who chose the newsletter are added to the mailing list. For them we also send: your table name; your newsletter language; your city, or your "Prefer not to say" choice; and your subscription status and consent record. Students who did not choose the newsletter are not added to the list, and none of that extra information is sent.
Once you press play, YouTube (Google) handles data according to their own privacy policy.
YouTube
Lesson videos are provided by YouTube, using the youtube-nocookie.com mode.
The page shows only a still image stored on our own site — the YouTube player loads only when you press play. Until then, YouTube does not receive your IP address and places no cookies.
Once you press play, YouTube (Google) handles data according to their own privacy policy.
Facebook and Instagram
The site may link to our Facebook or Instagram pages, but the website itself has no public comment area.
When you follow a link, visit a page, comment or interact with a post, Meta handles your information according to their own privacy policy. We may see your public name, profile and comments.
We do not republish your social media comments on the website as feedback without asking you first.
Do we share or sell it
We never sell, rent or trade your personal information.
We pass it on only: to the service providers above, so far as is necessary to run the website, accounts, email or newsletter; where the law, a valid court order or a lawful request requires it; where necessary to investigate fraud, a security incident or serious misuse; and where necessary to protect the lawful rights and safety of ourselves, our students or others.
We require providers acting on our behalf to keep appropriate confidentiality and data protection measures.
You are welcome to email us to ask which safeguards apply to your information.
Information leaving the UK
Our main Supabase database region is in London, and Brevo is provided by a company in France.
Vercel, Google, Supabase, Brevo and their sub-processors may process some information in the United Kingdom, the European Economic Area, the United States or other countries.
Where personal information is transferred out of the United Kingdom, we rely as appropriate on the UK adequacy regulations, the UK Extension to the EU–US Data Privacy Framework, contractual safeguards, or other protections recognised by UK data protection law.
You are welcome to email us to ask which safeguards apply to your information.
· Published feedback: until you withdraw consent, we remove it, or it is no longer needed
· Email enquiries: usually no more than 24 months after the enquiry is dealt with
· Technical and security logs: as long as needed for security and fault-finding, and according to our providers' settings — never indefinitely
· Consent and unsubscribe records: only the minimum needed to show that we honoured your choices and met our legal duties
You can ask us to delete your account at any time — for now by emailing hello@mahjong.academy, and from your student page once it is ready. When you do, we remove your account and learning progress from Supabase; if you had subscribed to the newsletter, we also remove you from Brevo. So that we never write to you again by mistake, we may keep a minimal unsubscribe record, which is never used for marketing.
Some information may remain briefly in encrypted backups until the normal backup cycle overwrites them. Backup data is not used from day to day.
How long we keep it
We keep information only for as long as is needed for the purpose it was collected for, to protect the service, or to meet a legal duty.
In general:
· Account details and learning progress: until you delete your account
· Newsletter details: until you unsubscribe or delete your account
· Published feedback: until you withdraw consent, we remove it, or it is no longer needed
Your rights
Under UK data protection law you may have the right to: ask for a copy of the information we hold about you; correct anything inaccurate or incomplete; ask us to delete it; ask us to restrict how we use it; object to processing based on legitimate interests; receive it in a portable format where that applies; withdraw your consent to the newsletter or to public feedback at any time; and complain to the regulator.
Please email hello@mahjong.academy to make any of these requests — including a copy of your information, changing your details or newsletter setting, or deleting your account. We may need to confirm who you are first, and we will normally reply within one month.
A student page is being built. Once it is ready you will be able to download your data, change your settings and delete your account yourself, and we will let you know.
Not every right applies in every situation. If we cannot do everything you ask, we will explain why.
Cookies and browser storage
We use no advertising cookies and no cross-site tracking cookies.
Progress before you register: your progress, badges and game records are kept in your own browser (local storage). They are not sent to us unless you later register and choose to bring your existing progress into your account.
Keeping it safe
We take reasonable technical and organisational measures to protect your information, including account permissions, database access rules, encrypted transmission and limited administrative access.
No online service can promise perfect security. Please do not pass your sign-in email or sign-in link to anyone else. If you suspect your account has been used without your permission, contact us straight away.
Changes to this policy
We may update this policy as our services, our providers or the law change.