Privacy Policy

The Academy Data Center and Index are operated by CREATIVE ARTS UNIVERSITY LIMITED, a private company limited by shares incorporated in Uganda on 17 February 2026 under the Companies Act 2012 and registered with the Uganda Registration Services Bureau (URSB) under company registration number 80034406718367 (URA TIN 1057001675, provisional). Postal address: P.O. Box 204228, Kampala GPO, Uganda. Uganda is the company's country of incorporation and primary legal jurisdiction, subject to the applicable laws governing each service.

Our official privacy and legal contact is privacy@creativeartsuniversity.com.

Depending on your access and use, we process names, email addresses, profile information, institutional roles, account identifiers, academic records where applicable, research records, uploaded documents and associated metadata. Documents may include personal information supplied by authorized users.

We also process user activity and audit records, such as account changes, record creation and edits, imports and other logged actions. Hosting and security services may process technical information such as IP addresses, browser information, request logs and error details.

If you choose Google sign-in, Google authenticates your account and may provide basic account information authorized by you, such as your name, email address, profile picture and Google account identifier. We use this information to identify your account and manage sign-in. Google sign-in does not by itself grant institutional access or elevated permissions.

We do not receive your Google password. Google sign-in alone does not authorize access to your Google Drive files, contacts or other Google content. Any separate connection requires its own authorization. Google's handling of your Google account is governed by Google's privacy policies.

We use information for authentication, account and access management, educational services, academic and research administration, institutional communication, security, audit history and platform operations. Authorized users may use records for their institutional responsibilities, subject to assigned permissions.

Applicable legal bases for processing, including any reliance on consent, contractual necessity, legal obligations or legitimate interests, require confirmation by the responsible organization. We do not claim that one legal basis applies to every use.

Information is available to authorized institutional users according to their roles and record permissions. Private records are not made public merely because someone signs in or uses a public legal page.

Services used by the application include Google for optional authentication and Lovable hosting and Cloud backend services for accounts, records, file storage and platform operation. These providers process information necessary to supply their services.

Pages load typography from Google Fonts, which involves requests to Google servers and may disclose technical request information, including your IP address. Following a source, DOI or other external link takes you to a separate service governed by its own privacy practices.

Open research discovery uses OpenAlex and Crossref; Unpaywall may be used for open-access lookup when configured. Research queries and relevant identifiers may be sent to these providers. Avoid including confidential or personal information in external research searches. Other integrations process data only where configured and authorized; a listed integration is not necessarily connected.

Disclosures may also be necessary to meet applicable legal requirements, protect rights or respond to security incidents. Additional providers and contractual processing arrangements must be reviewed before new data sharing is enabled.

Records and uploaded files are stored through the platform's backend and storage services. Access controls, role-based permissions, private document storage and audit logging help protect institutional information. No online service can guarantee absolute security.

Users must protect their accounts, upload information only with authority, and report suspected unauthorized access to privacy@creativeartsuniversity.com. Storage locations, provider agreements and any additional security assurances require organizational verification; no certification is claimed here.

Information should be retained only as needed for its institutional purpose and applicable legal, academic, security or recordkeeping obligations. Specific retention periods and deletion schedules have not yet been approved and must be established by the organization.

Account closure or suspension does not necessarily delete academic records, shared research, audit records or information subject to a lawful retention obligation. Deletion requests will be assessed against applicable requirements, including any constraints affecting backups and historical logs. Contact privacy@creativeartsuniversity.com to request account closure or deletion information.

Depending on the laws that apply, you may have rights to access, correct or delete personal information, restrict or object to processing, receive a portable copy of certain data, or withdraw consent where processing relies on consent. These rights may be subject to lawful exceptions.

For data access, correction, deletion, privacy complaints or questions about your rights, email privacy@creativeartsuniversity.com. Describe your request and the account or records concerned, but do not send passwords or unnecessary sensitive documents. We may need to verify your identity and authority before responding.

You may also have the right to complain to the relevant privacy regulator. The applicable regulator and any statutory response deadlines depend on the jurisdiction and require legal review.

The platform uses browser storage and session mechanisms necessary to maintain authentication and operate account features. These may include cookies or locally stored session tokens, depending on the authentication flow. Google and hosting services may use their own mechanisms when you interact with them.

You can manage cookies and site storage in your browser. Blocking or clearing authentication storage may sign you out or prevent account features from working. Any optional analytics or non-essential tracking would require separate review and appropriate notice before introduction.

Service providers may process information outside your country. The organization must verify processing locations and any transfer safeguards required by applicable law before finalizing this policy. We do not claim a specific hosting country or international compliance mechanism without verification.

Access is intended for authorized institutional participants. The platform's minimum age and any arrangements for minors, including parental or guardian involvement where required, remain subject to institutional and legal review. No specific age threshold is asserted in this draft.

If you believe a child's information has been supplied without appropriate authorization, contact privacy@creativeartsuniversity.com so the organization can investigate.

Material changes should be communicated through an appropriate institutional channel. Before approval, administrators must confirm service-specific legal obligations and legal bases, provider and transfer arrangements, retention and deletion schedules, children's access rules, and procedures for handling privacy requests.

For privacy questions, data access, correction, deletion, privacy complaints and legal inquiries concerning the Creative Arts University Data Center and Index, contact privacy@creativeartsuniversity.com.

Operator: CREATIVE ARTS UNIVERSITY LIMITED (URSB reg. no. 80034406718367), P.O. Box 204228, Kampala GPO, Uganda. Use of this contact for the future University platform is subject to organizational approval.