Privacy Policy

Effective date: 16 October 2026 · Last updated: 16 October 2026

1. Who we are

1.1 Palistra is an AI academy operated by Hermessi LLC, a limited liability company registered in the State of Delaware, United States, and the proprietor and provider of the Palistra website at palistra.ai ("Palistra", "we", "us" or "our"). Palistra is a brand fully owned by Hermessi LLC, which also operates hermessi.com.

1.2 Hermessi LLC is the data controller for the personal data described in this policy. This means we decide why and how your personal data is processed, and we are responsible for protecting it. We do not sell or rent your personal data to anyone.

1.3 For any question about this policy or how we handle your personal data, contact us at info@palistra.com.

2. Scope

2.1 This policy explains how we collect, use, share, protect and keep personal data when you:

• visit palistra.ai, or join our live online sessions and community spaces;

• sign up for updates, free sessions or webinars;

• apply for, pay for or take part in a Palistra programme, including Demo Day;

• are nominated or sponsored by an employer or other organisation;

• contact us, follow us on social media or attend our events; or

• apply to work with us as staff, mentor, facilitator or partner.

2.2 It does not cover third-party websites or AI tools you use during a programme. Those providers have their own privacy policies.

2.3 This policy should be read with our Terms and Conditions; how we use cookies is explained in section 9 of this policy.

2.4 In this policy:

• Personal data or Data means any information relating to an identified or identifiable individual that you give us, or that we collect, through the Website, the Platform or our other communications.

• Cookies means small text files placed on your device when you visit the Website or use certain features (see section 9).

• User or you means anyone who uses the Website or Platform, other than our staff, consultants or service providers acting in that capacity.

• Website means palistra.ai and its sub-domains, unless a sub-domain has its own privacy notice.

• Platform means the online meeting tools and community spaces we use to deliver our programmes.

• Data Privacy Laws means the laws listed in section 3.

3. Laws we follow

3.1 We serve learners across Africa and in other regions. We process personal data in line with:

• the data protection and privacy laws of the country where you live, wherever you are in Africa;

• applicable United States federal and state privacy laws; and

• where they apply to you, the EU General Data Protection Regulation and the UK GDPR.

3.2 Where these laws give you different rights, we apply the protection that the law of your place of residence requires.

4. Personal data we collect

5. How we collect it

5.1 From you when you fill in forms, apply, pay, take part in sessions, submit work, post in community spaces or contact us.

5.2 Automatically through cookies, server logs and similar technologies when you use our website (see section 9).

5.3 From third parties, including Sponsors who nominate you, payment processors confirming your payment, and publicly available professional profiles you link to your application.

5.4 You do not have to give us personal data, but if you do not provide what an enrolment form marks as required, we may be unable to enrol you or deliver the programme.

6. Why we use your data and our lawful basis

6.1 We use personal data only where we have a lawful basis under the Data Privacy Laws.

6.2 Where we rely on legitimate interests, we have balanced our interests against your rights and you may object at any time (section 14).

6.3 Where we rely on consent, we ask for it separately from acceptance of our Terms, and you may withdraw it at any time without affecting earlier processing.

6.4 Recordings and Demo Day. You can join live sessions with your camera off and a display name. We will not publish photos, videos or recordings in which you can be identified without your consent.

7. Children and sensitive data

7.1 Our programmes are for adults and, with verifiable consent from a parent or legal guardian, learners aged 16 or 17. We do not knowingly collect personal data from anyone under 18 without that consent, or from anyone under 16. If we learn we have done so, we will delete it.

7.2 We do not ask for sensitive personal data, such as health, religious, ethnic, biometric or political information. If we offer scholarships or accessibility support that needs such data, we will ask for your explicit consent and use it only for that purpose. Please do not post sensitive data in community spaces.

8. Who we share your data with

8.1 We do not sell your personal data. We share it only as described below, and only as much as each recipient needs.

• Service providers (processors) acting on our instructions, including trusted third-party providers of hosting, online meeting, communication, payment processing and analytics services, and our professional advisers.

• Sponsors who pay for or nominate you: attendance, progress and completion records only.

• Mentors and facilitators who teach you: your name, submissions and progress.

• Employers and hiring partners: only if you opt in to career support, and only the profile details you approve.

• Demo Day guests: your name and project, when you present.

• Group companies and successors: Hermessi, our sister brand also owned by Hermessi LLC, and other affiliated companies, where needed to run shared systems or support, and any buyer or investor in a merger, acquisition or sale, under confidentiality terms.

• Authorities: data protection regulators, tax authorities, courts and law enforcement, where the law requires it or to protect rights and safety.

8.2 Every service provider may access only the personal data it needs to perform the service we ask of it, and may not use it for any other purpose. A list of our main service providers and the countries where they process data is available on request from info@palistra.com.

9. Cookies and similar technologies

9.1 We use strictly necessary cookies to run our website securely; these do not need consent.

9.2 We use analytics cookies and advertising pixels only if you accept them in our cookie banner. You can change your choice at any time through the cookie settings on palistra.ai.

9.3 We do not send your personal data to advertising platforms for conversion tracking unless you have accepted advertising cookies. The cookie banner on palistra.ai lists the cookies we use and lets you choose which to allow.

9.4 You can also block or delete cookies in your browser settings. Blocking strictly necessary cookies may stop parts of the Website from working, for example remembering your cookie choices. We recommend keeping your browser up to date and using its help pages to adjust your privacy settings.

10. International transfers

10.1 Hermessi LLC is registered in the State of Delaware, United States, and some of our service providers store data in other countries, including the United States. Your personal data will therefore be transferred outside your country of residence.

10.2 When we transfer personal data out of your country, we rely on a transfer ground recognised by the Data Privacy Laws that apply to you, such as:

• transfers to countries or recipients recognised by your data protection authority as providing an adequate level of protection;

• contractual clauses or other safeguards giving protection at least equivalent to the law of your country;

• where needed to perform our contract with you, for example to run live sessions and deliver the programme; and

• your explicit consent, after we have explained the risks, where no other ground applies.

10.3 For transfers from the EU or UK we use the European Commission's Standard Contractual Clauses or the UK International Data Transfer Agreement, as applicable.

10.4 You can ask for details of the safeguards used for a transfer by emailing info@palistra.com.

11. AI tools and your data

11.1 We do not use your personal data, submissions or Learner Work to train AI models, and we do not allow our processors to do so, unless you give separate consent.

11.2 If we use AI tools to help mentors review your work or answer support questions, a person remains responsible for any decision that affects you. We do not make decisions about you that have legal or similarly significant effects based solely on automated processing.

11.3 When you use third-party AI tools during a programme, you share data directly with those providers under their own terms. Do not enter other people's personal data or confidential information into them unless you are allowed to.

12. How long we keep your data

12.1 We keep your personal data while you are enrolled with us, or for as long as we need it to provide our services to you. When your programme ends, or if you ask us to delete your data, we delete or anonymise it within 90 days.

12.2 We keep a short record of your name, the programme you completed and your completion date, so that we can confirm your certificate if you or someone else asks us to. You can ask us to delete this record, but we will then be unable to verify your certificate.

12.3 We may keep data longer where the law requires it, or where we need it to resolve a complaint or dispute. If you unsubscribe from marketing, we keep a minimal record so that we do not contact you again.

12.4 We do not keep financial transaction records. Payment records are held by the third-party payment processors you pay through, under their own policies.

13. Security and breaches

13.1 We use reasonable physical, electronic and managerial measures to protect personal data. These include encrypting personal data in transit; limiting access to personal data to staff who need it for their role, for example learner support; keeping the systems that store personal data in secure environments; confidentiality obligations on staff and contractors; and written terms with our service providers.

13.2 No transmission of data over the internet is completely secure, and we cannot guarantee the security of data you send us online.

13.3 If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the relevant data protection authorities within the time their laws require, which in many countries is 72 hours. If the breach is likely to result in a high risk to you, we will also tell you directly and without undue delay, with steps you can take to protect yourself.

14. Your rights

14.1 Depending on the Data Privacy Laws of the country where you live, you may have the right to:

• be informed about how we process your data (this policy);

• access a copy of the personal data we hold about you;

• have inaccurate or incomplete data corrected;

• have your data deleted where we no longer need it, you withdraw consent, or the processing is unlawful;

• restrict our processing in certain cases, for example while a correction is checked;

• receive your data in a structured, commonly used, machine-readable format, and have it sent to another controller;

• object to processing based on legitimate interests, and to direct marketing at any time;

• not be subject to a decision based solely on automated processing that significantly affects you; and

• withdraw consent at any time.

14.2 To exercise a right, email info@palistra.com. We may need to verify your identity. We will respond within 30 days, and tell you if we need longer and why. Requests are free unless they are clearly unfounded or excessive.

14.3 If you are not satisfied with our response, you may complain to the data protection authority in the country where you live.

15. Additional information for US residents

15.1 Depending on your state of residence (for example California, Virginia or Colorado), you may have rights to know, access, correct and delete personal data, and to opt out of the "sale" or "sharing" of personal data for targeted advertising.

15.2 We do not sell personal data. We share data for targeted advertising only with your cookie consent, and you can opt out through the cookie settings on palistra.ai. We honour Global Privacy Control signals where the law requires.

15.3 We will not discriminate against you for exercising your rights. You may use an authorised agent to make a request on your behalf.

16. Marketing

16.1 We send marketing emails, SMS or WhatsApp messages only with your consent, or to existing learners about similar programmes where the law allows. Every message has a simple way to opt out, or you can email info@palistra.com.

16.2 You will still receive service messages about programmes you are enrolled in.

17. Changes to this policy

We may update this policy from time to time. The "Last updated" date shows the latest version. We will tell you about material changes by email or a notice on palistra.ai at least thirty (30) days before they take effect.

18. Contact us

Hermessi LLC, trading as Palistra
Website: palistra.ai
Email: info@palistra.com (data protection and general enquiries)

19. General

19.1 You may not transfer your rights under this policy to anyone else unless the Data Privacy Laws allow it. We may transfer our rights where we reasonably believe this will not adversely affect your rights, for example to an affiliate or a buyer of our business, and we will tell you if we do.

19.2 If any part of this policy is found invalid or unenforceable, that part is treated as deleted and the rest remains in force.

19.3 A delay or failure by us in exercising a right or remedy does not waive it.

19.4 This policy is governed by the laws of the State of California, United States. This does not limit any right you have under the Data Privacy Laws that apply where you live, including your right to complain to your data protection authority.