Privacy policy

This policy explains how MangoFolio handles personal information: what we collect, why, who we share it with, how long we keep it and what your rights are.

Who we are

MangoFolio is provided by MightyMango, company number [company number], registered at [registered address]. We are registered with the Information Commissioner's Office under number [ICO registration number].

If you have a question about this policy or your information, email us at [contact email].

Who is responsible for your information

MangoFolio is used by training providers to run work-based learning programmes. Who is responsible for your information depends on what it is.

• Your learning record. Your training provider decides what is recorded about your programme and why. They are the controller of that information. We are their processor: we store and handle it on their behalf and only on their instructions.
• Your account and our website. We are the controller for your sign-in details, for how you use MangoFolio and for visits to our public pages.

If you are a learner and have a question about your learning record, contact your training provider first. They can answer most questions directly and will involve us when needed. Your provider also gives you its own privacy notice when you enrol.

What we collect

Account details

Your name, email address, role (for example learner, assessor or employer) and the organisation you belong to. If you turn on two-factor authentication or passkeys, we store what is needed to check them.

Learning record

Information your training provider and you add while you are on a programme, including:

• enrolment details, such as your date of birth, contact details and the programme you are on;
• evidence you upload, such as documents, photos, audio and video;
• reviews, observations, witness testimonies and your learning journal;
• signatures, with the date and time each was made.

Special category and equality information

At enrolment, your training provider may ask for information such as your ethnicity, any disability or learning difficulty, and other equality details. This is special category information under data protection law and needs extra protection. Your provider decides whether to collect it and why.

Technical information

Server logs, including your IP address, browser type and the pages you request, which we use to keep MangoFolio secure and working. We also use the essential cookies described below.

Why we use it and our lawful basis

• Learning records: we process them as your training provider's processor, to provide the service they have asked for. The provider decides the lawful basis. For special category information, the provider also relies on a condition under data protection law: [provider's condition for special category data].
• Your account: to give you access to MangoFolio and keep it secure. Our lawful basis is the contract with your organisation and our legitimate interest in running a secure service.
• Technical information: to detect and fix faults and protect against misuse. Our lawful basis is legitimate interests.

We do not sell personal information and we do not use it for advertising.

Who handles it for us

We use a small number of other companies (sub-processors) to run MangoFolio:

When information goes outside the UK, for example to Anthropic, we protect it with [safeguard: IDTA or UK Addendum].

We plan to keep all data, including AI processing, within the UK. Until that work is finished, the AI features use the service described above.

We may also share information when the law requires it, for example with a regulator or the police.

How long we keep it

• Learning records: each training provider sets its own retention period. The default is seven years, which matches typical funding and audit requirements. Your provider is responsible for removing records at the end of that period.
• Your account: kept while your account exists, then for [account data retention period].
• Server logs: kept for a short period for security and fault-finding, then deleted.

Your rights

You have the right to:

• see the information held about you (a subject access request);
• have inaccurate information corrected;
• have information erased, in some circumstances;
• restrict how it is used, in some circumstances;
• object to how it is used;
• receive your information in a portable format.

To use these rights for your learning record, contact your training provider, who is the controller. For your account or our website, email us at [contact email]. We will reply within one month.

If you are unhappy with how your information has been handled, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put things right first.

Cookies

We only use cookies that MangoFolio needs to work:

• a session cookie, which keeps you signed in;
• a security token (CSRF), which protects forms from misuse;
• a Remember me cookie, only if you tick that box when you sign in, which keeps you signed in on that device until you sign out;
• on the demo site only, a cookie that remembers you have entered the access code, for 30 days.

Your browser also remembers your light or dark theme choice and, on the demo, that you have closed the demo banner. This stays on your device and is not sent to us.

We do not use analytics, tracking or advertising cookies.

Keeping your information safe

• Signatures are encrypted in the database.
• All connections to MangoFolio use encryption (HTTPS).
• People only see what their role allows: a learner sees their own record, and staff see the learners they work with.
• Each training provider's data is kept in its own separate database.

Changes to this policy

We will update this policy when how we handle information changes. The date at the bottom of this page shows when it last changed. If a change significantly affects you, we will tell you through MangoFolio or by email.

Last updated 13 October 2026