Privacy Policy

1. Information We Collect

We collect the following categories of information:

• Account information: your name, email address, job title, department, organization name, and organization city and state.
• Training data: lesson progress, quiz scores, completion dates, and certificate numbers.
• Payment information: processed by Stripe — we never store your card numbers on our systems.
• Usage data: login times and lesson activity recorded by the platform to track training progress. We do not use third-party web analytics.
• Communications: the contents of emails and messages you send us.

2. How We Use Your Information

We use the information we collect to:

• Deliver cybersecurity awareness training.
• Issue completion certificates.
• Provide compliance reports to your organization administrator.
• Process payments via Stripe.
• Send transactional emails — welcome messages, enrollment codes, and renewal notices — via Brevo.
• Send newsletter or marketing emails via Brevo if you have opted in (for example, through our contact form or a resource download). You can unsubscribe at any time.
• Respond to support inquiries.
• Maintain, secure, and improve our platform.

3. How We Share Your Information

We share information only as needed to operate the service:

• Stripe (payment processing) — stripe.com/privacy.
• Brevo (email delivery and contact-list management — receives your name, email, and organization details) — brevo.com/legal/privacypolicy.
• Your organization administrator can view your training progress and certificates.
• We do not sell your personal information.
• We do not share your data with advertisers.
• We may disclose information if required to do so by law.

4. Data Retention

We retain different categories of data for different periods, keeping each only as long as it serves the purpose it was collected for:

• Account and profile data is retained while your account is active, and for 12 months after account deletion so that accidental deletions can be recovered and organizations whose subscriptions lapse and later renew (for example, across government fiscal years) do not lose their student rosters.
• Usage logs (login times and session activity) are retained for 90 days.
• Training completion records and certificates are retained for 7 years as compliance records, so your organization can produce proof of training completion for future audits.
• Billing and payment records are retained for 7 years as required for tax and financial reporting. Card details are held by Stripe, never on our systems, in accordance with Stripe's policy.
• You may request deletion of your data by contacting us, subject to the retention requirements above.

5. Security

• Data is encrypted in transit using TLS.
• Passwords are hashed with Argon2.
• We perform regular security assessments.
• Our platform is built to OWASP Top 10:2025 security standards.
• No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

6. Cookies

• We only use strictly necessary authentication storage (session cookies and browser storage), which is required for login and cannot be disabled.
• We do not use analytics, advertising, or third-party tracking cookies.
• See our Cookie Policy for full details.

7. Your Rights

You have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your data, subject to our retention requirements.
• Opt out of non-essential communications.
• Contact us at admin@encryptedtechnology.com to exercise any of these rights.

8. Texas Residents

If you are a Texas resident, you have rights under the Texas Data Privacy and Security Act (TDPSA), including the right to access, correct, and delete your personal data, and the right to opt out of certain processing.

• We do not sell personal data.
• We do not process sensitive data for the purpose of targeted advertising.

How to exercise your rights: submit a request to admin@encryptedtechnology.com. We will respond within 45 days of receiving your request. If we decline to take action on your request, we will notify you and explain the justification for our decision.

Right to appeal: if we decline your request, you may appeal our decision by replying to our response, or by emailing admin@encryptedtechnology.com with the subject line "TDPSA Appeal." We will respond to your appeal within 60 days with a written explanation of the actions taken or not taken, and the reasons for our decision. If your appeal is denied, you may submit a complaint to the Texas Attorney General online at texasattorneygeneral.gov/consumer-protection/file-consumer-complaint.

9. Children's Privacy

Our platform is not directed at children under 13, and we do not knowingly collect personal information from minors. If you believe a minor has provided us information, contact us and we will delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email. Your continued use of the platform after a change takes effect constitutes acceptance of the updated policy.

11. Contact Us

Encrypted Technology LLC
admin@encryptedtechnology.com
1-855-778-9347
Texas, United States