The Privacy Policy has the full details. In short:
- Each organization's data is stored separately, and encrypted in transit and at rest.
- Access is checked by the server on every action.
- There are no advertising or analytics trackers.
- YouTube videos don't load until someone presses play.
Your data
Under Account settings, you can download your data or delete your account. Training records an organization keeps about you stay with that organization, so ask its Super Users to erase them.