This policy explains what personal information michaelhlinka.com collects, why, who else handles it, how long we keep it, and what you can ask us to do with it. It is written for Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).
Who we are
This site is run by Michael Hlinka ("we", "us"). It is where Michael Hlinka offers his CFA® and CSC® exam preparation. Michael is responsible for how personal information is handled here. You can reach him at michael@michaelhlinka.com.
The short version
- We collect what we need to run your account, your courses, your study plan, donations and tutoring. Nothing is collected for advertising, and we don't sell, rent or trade your information.
- We record how the site is used, including IP addresses, for every visitor. We don't ask first, and there is no switch to turn it off.
- We don't delete these records automatically. You can ask us to delete yours at any time.
- While you watch a course video, your email and a short code move across the picture.
- We monitor activity on accounts to keep them secure and to protect the course material.
- Some of the companies that host the site and take payments are outside Canada, mainly in the United States and the European Union.
What we collect and why
Your account
When you sign up we collect your name, your email address and a password. The password is stored only as a salted hash, so nobody (Michael included) can read it. We send a link to confirm your email address and record when you confirmed it. We also keep the date you joined, when you last signed in, your time zone if you set one, and a short account code that appears in the video watermark.
Why: to give you an account, keep it secure, make sure each account belongs to a real person with a working email address, and contact you about it.
The questionnaires
To open a level you answer a short questionnaire: for example your name, where you live, your role and employer type, the program and level you're preparing for, your exam date, how many hours a week you can study, why you're studying and which attempt this is. Some questions are optional, such as your phone number, your employer's name, your LinkedIn profile and how you found the site. Adding another level asks a few more questions. Midway through your plan we may ask how it's going.
Why: completing the questionnaire is what opens a level, and your answers build your study plan and keep it on track. They also help Michael see who studies here and what works. Michael can see your answers. We keep them, together with your email confirmation, for as long as we run your study plan.
Study plan and progress
We keep your study plan (exam date, level, pathway, hours per week, start date and study days) and the schedule it produces. We also keep what you've opened and completed, and where you stopped in a video or audio lesson so you can pick up again.
Why: this is the course itself. It's how the site remembers where you are.
Quizzes
We keep the questions you were given, your answers, your scores, how long you took, and when. If you report a problem with a question, we keep the reason and any message you write.
Why: to show you your results, track your progress, and fix wrong or unclear questions.
Course videos and the watermark
When you press play we open a short-lived streaming session. We record which video it was, when it started and stopped, and your IP address and browser, together with scrambled one-way codes (hashes) of your network.
While a video plays, your email and a short code move across the picture. The watermark is drawn by our player and is not saved into the video file. Anyone who can see your screen can see it too.
Why: to limit how many videos an account can play at once, to spot one account being used from many places, and to trace a leaked recording back to the account it came from.
Donations and tutoring payments
Payments are taken by Stripe on Stripe's own checkout page. We never see or store your full card number. From Stripe we receive and keep your name and email, what the payment was for, the amount, currency and any tax, the date, its status, any refund or dispute, your card brand and its last four digits, and Stripe's reference numbers.
Why: to send receipts, handle refunds, and meet tax and accounting law.
Tutoring bookings
We keep the time you booked, its length, the topic you describe, your time zone, the price and tax, the payment, the meeting link, any reschedule or cancellation, and any private note Michael makes about the session.
Why: to run the session and keep the records the law requires.
Emails
We keep a log of the emails we send you: the subject, the date, and the delivery status our email provider reports. We keep your email preferences and, if you unsubscribe, a record that you did.
Why: to deliver email reliably and to respect your choices.
Messages
If you write to us through the contact form or by email, we keep your message, your address and our reply.
Why: to answer you.
How the site is used
For every visitor, signed in or not, we record the pages you view, how long you stay and how far you scroll, the links you follow out of the site, what you search for on the site, your downloads, your video and quiz activity, the page that sent you here and any campaign tags in the address, your IP address, the approximate location worked out from it (country, region and city), your browser, device and operating system, and your screen size. Two cookies (below) tell your visits apart. When you're signed in, these records are linked to your account.
We don't ask for consent before recording this, and there is no switch to turn it off.
Why: to learn which lessons help and where students get stuck, to keep the site running well, and to spot misuse. Michael sees this in his console.
Approximate locations come from IP geolocation by DB-IP, used under the Creative Commons Attribution 4.0 licence.
Account security and content protection
We monitor activity on accounts for account security and to protect the course material. We record sign-ups, sign-ins, failed sign-in attempts, sign-outs, password resets and important account changes, with the IP address and browser used. Automated checks look for patterns that suggest scraping, account sharing or leaked material, such as requests faster than a person can click or one account streaming from many networks. These checks flag activity for Michael to review. Anything that would suspend or close your account is decided by Michael, not by software.
Class recordings
Some course videos are recordings of Michael's past live classes, and they may show the people who took part: their names, faces or voices. If you appear in one and want to be removed or blurred, write to us through the contact page and tell us which recording. We'll take it down while we edit it.
Cookies and browser storage
We use no advertising cookies and no third-party tracking cookies. This is what the site stores in your browser:
- payload-token (cookie): keeps you signed in. Scripts on the page can't read it. It lasts up to 30 days.
- mh_in (cookie): tells the page that you're signed in, so the header shows the right buttons. It holds nothing about you.
- mh_vid (cookie): a random visitor identifier for the usage records above. It lasts 395 days.
- mh_sid (cookie): a random identifier for one visit. It lasts 30 minutes after your last page.
- Local storage: a few display preferences, and when your sign-in was last refreshed.
Stripe sets its own cookies on its checkout page. If you press play on an embedded YouTube video, YouTube may store information in your browser; we use YouTube's privacy-enhanced mode and load nothing from YouTube until you press play. Our fonts are served from our own server.
You can clear cookies and local storage in your browser settings at any time. You'll be signed out.
Who else handles your information
These service providers handle information on our behalf, and only for the job listed:
- Railway Corporation (United States): hosts the website, its database and its file storage.
- Bunny.net (BunnyWay d.o.o., Slovenia, European Union): stores the course videos and streams them through servers around the world. When you play a video, Bunny receives your IP address and browser details, as any video server does.
- Stripe: processes donations and tutoring payments. Stripe stores payment data in the United States and elsewhere, and uses it to prevent fraud under its own privacy policy.
- Forward Email (United States): delivers our emails. It receives your email address, your name and the content of the message.
- Zoom (tutoring only): when you join a session you use Zoom under its own terms and privacy policy.
- YouTube (Google): only if you press play on an embedded YouTube video.
We may also share information when the law requires it, with our accountant or lawyer (who must keep it confidential), to protect someone's safety or our rights (for example in a payment dispute), or if the site is ever transferred, in which case the new owner must follow this policy.
Information stored outside Canada
Most of our providers store or process information in the United States or the European Union. While your information is there, the laws of those countries apply to it, and their courts, law enforcement and national security authorities may be able to access it.
How long we keep it
Nothing is deleted automatically. We keep your account, questionnaire answers, study plan, progress, quiz history, the usage and security records, and the email log for as long as we run the site, unless you ask us to delete them.
When you ask us to delete your account, we delete your account and what belongs only to it. Usage and security records are kept for the site's statistics, but with your name, email and IP address removed, so they no longer point to you. Payment and tutoring records stay for as long as Canadian tax law requires, and an unsubscribe record keeps your email address only so we keep honouring it.
How we protect it
- The whole site runs over HTTPS.
- Passwords are stored only as salted hashes, and the sign-in cookie can't be read by scripts on the page.
- Course videos are delivered through signed links that expire.
- Only Michael, and anyone he authorizes, can see member data in the console.
If a breach of our safeguards creates a real risk of significant harm to you, we will tell you and the Office of the Privacy Commissioner of Canada as soon as we can, and we keep a record of every breach.
Your rights
- See your data: ask us for a copy.
- Correct it: change your name or email on your account page, or ask us.
- Delete it: ask us to delete your account and your data, as described above.
- Stop emails: use the link at the bottom of any newsletter or reminder, or change your preferences on your account page. Receipts, password resets, booking confirmations and security notices are always sent, because they are part of the service.
- Complain: tell us first. If you're not satisfied, you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca.
If the law where you live gives you further rights (for example in Quebec, the European Union or the United Kingdom), write to us and we'll honour them.
We answer requests within 30 days. We may ask you to confirm your identity first, usually by writing from the email address on your account.
Children
The site is meant for adults preparing for professional exams. It isn't directed at children, and we don't knowingly collect their information.
Changes to this policy
The date at the top of this page is the date of this version. If we make an important change, we'll email members before it takes effect.
Contact
Michael Hlinka · michael@michaelhlinka.com