Account data & privacy

What this service stores

When you register, we store your name, verified email address, organisation, workspace membership, training assignments, deadlines, lesson confirmations, assessment attempts and security events in Cloudflare D1. Workspace administrators can see their members’ progress, roles and groups.

The website and portal store your English or Bulgarian interface preference and the last course you selected in this browser. These preferences do not contain account credentials and are not sent to a translation service.

Contact enquiries

The contact form sends your name, company, work email, training interest, preferred language and message through Cloudflare Email Service to our academy team. Replies go to the work email you provide. Enquiries are handled in our email mailbox; the website does not save a separate copy of your message in its database. Contact us to request deletion of your correspondence.

Cloudflare Turnstile checks browser and network signals to prevent automated submissions. We check the email domain against a local list of free and disposable providers and use Cloudflare DNS to check that it accepts email. Rate-limit counters use hashed identifiers and expire automatically. These checks do not verify ownership of the mailbox or enrol you in marketing communications.

Signing in

Cloudflare delivers one-time sign-in emails. Links expire after 15 minutes. Essential secure cookies bind links to your browser and keep you signed in for up to eight hours. Signing out revokes all of your active sessions.

Company demos

Domain lookup sends the company domain to Microsoft’s public discovery service. We store the resolved Entra tenant ID, company domain and demo start and end dates. The 30-day demo starts after work-email verification. No card or payment details are collected, and no automatic subscription is created. After expiry, training is paused and existing records remain accessible.

Company accounts

A workspace owner can configure Microsoft 365 or Google Workspace sign-in and selected group sync. Provider credentials are encrypted. Company sign-in is linked explicitly to your verified account; email domains alone do not grant company access. Directory group sync reads selected groups and matches existing workspace members.

Retention and requests

Expired links, sessions and rate-limit counters are removed daily. Workspace audit events are kept for one year. Learning and account records currently remain until an administrator handles a deletion request. Contact sales@blueteam.academy for access, correction, export or deletion requests. You can download your own account and learning data from My account, and revoke individual sessions there. Automated account deletion and tenant retention controls are not yet available.

Learning records

The signed-in portal stores your learning progress in your workspace. The public catalogue links to these courses. Sample course results are not accredited certificates or proof of regulatory compliance. No advertising analytics are installed.