Privacy Policy

This policy covers the website at https://futureline.ai, including the public pages, the enquiry forms, the course catalogue, the sign-in and student dashboard areas, and the FL Tourism enquiry page. FutureLine is the controller of the personal data described here.

We collect only what we need to answer your enquiry, run your account, and deliver the courses and services you ask for. Where we describe a third party below, it is because our code genuinely uses that service — we have not listed anything we do not use.

Our enquiry forms — the services enquiry, the course enquiry, the AI audit enquiry, the Get Started request, and the FL Tourism form — ask for your first name, last name, and email address, and the message you write. Depending on the form, they may also ask for your phone number, your company name, and the topic or type of service you are interested in. Only the name, email, and message are required; phone and company are optional.

Each submission is saved as an enquiry record in our database together with the page or form it came from (for example "FL Services", "FL Courses", "FL Tourism", or "Get Started") and the date and time. As our team works on your enquiry, we may add internal follow-up information to that record: a stage (new, contacted, follow-up, won, lost), a priority, an estimated value, the team member handling it, dates of last contact and next follow-up, and internal notes written by our staff.

When you submit an enquiry, our system sends a confirmation email to the address you gave and an internal notification to FutureLine so we can respond.

If you create an account, we store your first name, last name, email address, and a hashed version of your password. We never store your password itself. Your account also carries a role (customer, instructor, or administrator), an active/inactive flag, and the date the account was created.

You can instead sign in with Google. In that case Google tells us your name, your email address, and your Google profile picture link, and we create or link an account for you using that information. We do not receive your Google password. Because you sign in through Google, no password of ours is used for your account.

Instructors and administrators may additionally have a short biography and a profile photo link on their account, which appear on public course and instructor sections of the site. If you ask us to reset a password, we store only a one-way hash of the reset token together with its one-hour expiry time, and both are erased as soon as the reset is used.

When you enrol in a course, we record the enrolment (which account, which course, the date, your progress percentage, and whether you have completed it). For paid courses we create an order record holding your account, the course, the amount, the payment method, and the payment status.

We do not take card payments on this website and we do not collect, process, or store card numbers, CVV codes, or bank credentials anywhere on the site. Paid enrolments are arranged by bank transfer, handled outside the website; an administrator marks the order as paid once the transfer is confirmed. Any payment details you share with your bank stay with your bank.

For instructors, we also keep earnings records linking an instructor and a course to an amount, the platform and instructor shares, and the period the earnings relate to.

Our forms and sign-in endpoints are rate-limited to prevent abuse. To do this we store a short-lived counter keyed to your IP address (or, for sign-in attempts, your email address) together with a reset time. The counter resets at the end of each short window and is not used to build a profile of you.

Our servers keep ordinary operational logs. These include records of successful and failed sign-in attempts, which contain the email address used, and error messages generated by the application. These logs exist for security and troubleshooting only.

The AI course recommender asks about your learning goal, skill level, delivery preference, and budget. Those answers are used to search our course catalogue in the moment and are not saved to your record or sent to any external AI service.

The only cookie our website sets is the sign-in session cookie created by our authentication system. It holds a signed token identifying your account and role, it is strictly necessary for keeping you signed in, and it expires two hours after sign-in. If you never sign in, our site does not set a session cookie for you.

We also use your browser's session storage — which is cleared when you close the tab — for two purely functional things: remembering that you have already seen the site's opening animation, and carrying the details you typed into the Get Started form across the sign-in step so you do not have to retype them.

We do not use advertising cookies, tracking pixels, or third-party analytics of any kind. There is no Google Analytics, no Meta pixel, no advertising network, and no behavioural tracking on this website. We do not sell or rent personal information to anyone.

We use enquiry information to reply to you, understand what you need, and follow up about the services, courses, or tours you asked about. We use account information to authenticate you, show you your dashboard, and give you access to the courses you are enrolled in. We use enrolment and order information to administer your place on a course, confirm payment, and track your progress. We use technical information to keep the site secure and working.

We send transactional emails — enquiry confirmations, welcome emails, password reset links, password change confirmations, enrolment confirmations, payment-pending notices, and updates on the status of your enquiry. These relate to something you asked for or did. We do not run a marketing mailing list from this site.

Our legal basis is your consent when you choose to submit a form or create an account, and the necessity of processing to perform the service or contract you have asked for (such as delivering a course you enrolled in). Keeping secure logs and rate-limiting rests on our legitimate interest in protecting the site. We handle personal data in the spirit of applicable data-protection law, including the personal data protection rules of the Sultanate of Oman. You may withdraw consent at any time by contacting us.

We share personal data only with the providers we need to operate the site: Google, if you choose to sign in with your Google account; Resend, which delivers our transactional emails and therefore handles your email address and the content of those messages; and our hosting and database provider, which stores the application and its PostgreSQL database on our behalf. Each of these acts on our instructions for the purposes described above.

These providers operate internationally, so your information may be stored or processed on servers outside the Sultanate of Oman. We choose established providers that offer contractual and technical safeguards for the data they hold for us.

We may also disclose information where we are legally required to do so by a competent Omani authority or court. We do not share your data with advertisers or data brokers.

Some course preview videos and lesson videos are hosted on YouTube or Vimeo and embedded in our pages. Our site does not host or store those videos itself.

When a page containing an embedded video loads, your browser connects directly to YouTube or Vimeo, and those services may set their own cookies and receive your IP address, browser details, and the page you are viewing. That processing is governed by their own privacy policies, not ours. Pages without an embedded video make no such connection.

We keep enquiry records, including internal notes and follow-up history, for as long as needed to handle the enquiry and to maintain a reasonable record of our business dealings with you. Account, enrolment, and order records are kept for as long as your account is active, and afterwards only where we need them for legitimate accounting or record-keeping reasons.

Password reset tokens expire after one hour and are deleted as soon as they are used. Rate-limiting counters are short-lived and reset within minutes. Operational logs are retained only as long as they are useful for security and troubleshooting.

If you ask us to delete your data, we will do so unless we are required to retain specific records by law, and we will tell you if that applies.

Passwords are stored only as bcrypt hashes with a work factor of 12, so the original password cannot be recovered from our database. Password reset tokens are stored only as SHA-256 hashes with a one-hour expiry. The site is served over HTTPS with HTTP Strict Transport Security enabled.

Access inside the application is role-based: administrator areas are guarded at the network middleware layer and the account's role is re-checked against the database on each session refresh, so a revoked administrator cannot keep elevated access. Sign-in sessions expire after two hours, and deactivated accounts are refused at sign-in.

We apply standard browser protections through security headers, including a content security policy, clickjacking and MIME-sniffing protection, a strict referrer policy, and a permissions policy that blocks camera, microphone, and geolocation access. Enquiry, registration, sign-in, password reset, and checkout endpoints are rate-limited. No system can be guaranteed completely secure, but we take these measures seriously and review them as the site evolves.

You can ask us for a copy of the personal information we hold about you, ask us to correct anything inaccurate, ask us to delete it, ask us to stop using it for a particular purpose, or withdraw consent you previously gave. If you have an account, you can also update your own name and password from within your account and change your password at any time.

To make a request, email flservices.ai@gmail.com from the address associated with your enquiry or account, or tell us clearly which records your request concerns. We may need to ask a question or two to confirm your identity before acting, so that we do not disclose someone else's data. We aim to respond to every request within 30 days.

If you are not satisfied with how we have handled your request, tell us and we will look at it again.

Our courses and services are intended for adults and working professionals. The website is not directed at children, and we do not knowingly collect personal information from anyone under 18.

If you believe a child has given us personal information, contact us at flservices.ai@gmail.com and we will delete it. Where a young person attends a course, enrolment is arranged with a parent, guardian, or sponsoring organisation.

We may update this policy as the website changes or as our practices develop. When we do, we will change the date at the top of this page. Material changes will be described plainly rather than buried, and continuing to use the site after an update means the updated policy applies to you.

This policy and any dispute relating to it are governed by the laws of the Sultanate of Oman, and the courts of Oman have jurisdiction.

For any privacy question, data request, or complaint, contact FutureLine at flservices.ai@gmail.com. We read every message sent to that address.