Privacy Policy

1. Overview

This Privacy Policy explains how CraneQualified.com ("we," "us," or "our") collects, uses, discloses, and protects information in connection with CraneQualified, an online training platform developed and operated in association with MSC Safety Solutions and Colorado Crane Operator School (the "Platform").

This Policy applies to visitors, learners, instructors, company administrators, managers, and other authorized users of the Platform. It does not apply to third-party websites or services that we do not control.

2. Information We Collect

Information You Provide

Depending on how you use the Platform, we may collect:

• Your name, email address, telephone number, company, job role, team size, and messages or other information submitted through public contact or demonstration-request forms.
• Account and profile information, including identity, company association, portal access, role, course enrollment, and training pathway information.
• Setup and account-recovery information used to establish or recover access to an account. We do not intend to retain plaintext passwords or plaintext setup codes.
• Training and assessment information, including assigned courses, module and stage progress, completion status, attempts, scores, certificates, verification events, and related training records.
• Information submitted to support, administrative, security, or operational workflows.

Information Collected Automatically

When you visit or use the Platform, our systems and service providers may automatically process:

• Source page, submission date and time, browser user-agent information, request and response information, and similar technical records.
• Authentication and session information required to keep you signed in and route you to authorized areas.
• Device, security, audit, and activity information used to protect accounts, investigate misuse, maintain reliability, and document Platform operations.
• Progress and readiness events generated as you use training modules and assessments.

The Platform uses an authentication-gate cookie and browser storage for session and authentication functions. These technologies are used to provide account access, maintain security, and preserve necessary application state. They are not described as advertising cookies.

Public-Site Analytics

CraneQualified uses Vercel Web Analytics where implemented and, with your choice where presented, Google Analytics on approved portions of the public website, including the Crane and Rigging Resources center and published resource articles. These services help us understand website traffic, how public content is used, and whether the public website is effective. Our Google Analytics implementation is intentionally excluded from authenticated training, learner, assessment, setup, tracking, protected-viewer, and administrative experiences.

We do not intentionally send names, email addresses, phone numbers, company or contact details, walkthrough form contents, learner progress, assessment or quiz answers, scores, authentication data, or protected training content to Google Analytics. Google may process device, browser, approximate-location, referral, page, and usage information according to its applicable terms and privacy practices. Learn more from Google's information for sites and apps using its services and Google Analytics data safeguards. Vercel describes its Web Analytics as cookie-free and based on anonymized, aggregated data; see Vercel Web Analytics Privacy and Compliance.

Analytics Choice and Cookies

Where the Google Analytics choice is presented, CraneQualified stores the choice in first-party browser storage. Before permission is granted, the Google Analytics tag is blocked and does not send data to Google. If permission is granted, Google Analytics may set first-party analytics cookies used to distinguish visits and sessions. Advertising storage, advertising personalization, remarketing, and Google Signals are not enabled by this implementation. If permission is declined or later revoked, future Google Analytics collection is blocked and CraneQualified attempts to remove its accessible first-party Google Analytics cookies. Changing a preference does not retroactively delete information already received by Google. You may revisit your choice using the Analytics Preferences control on eligible public pages.

3. How We Use Information

We may use information to:

• Provide, authenticate, administer, support, and secure the Platform.
• Create and manage accounts, company relationships, portal access, enrollments, setup processes, and password recovery.
• Deliver courses, assessments, progress tracking, completion records, certificates, and related training functions.
• Respond to requests for demonstrations, support, account assistance, or other communications.
• Send transactional and operational email, including account setup, password recovery, onboarding, support, and service-related notices.
• Provide authorized organizations with appropriate training and progress information about their learners.
• Detect, prevent, investigate, and respond to fraud, abuse, unauthorized access, security incidents, and violations of Platform terms.
• Test, maintain, troubleshoot, improve, and understand the operation and reliability of the Platform.
• Satisfy legal obligations, enforce agreements, and protect the rights, safety, and property of users, organizations, the Platform, and others.

We do not promise that use of the Platform, or any training delivered through it, satisfies every legal, regulatory, employer, certification, or safety requirement applicable to a user or organization.

4. When We Share Information

Authorized Organizations and Managers

If your account is associated with an employer, customer, school, training provider, or other organization, authorized personnel for that organization may access information such as assigned courses, progress, completion, attempts, scores, certificates, and related training records, subject to their role and organization. They are not provided with your password, setup code, authentication secrets, or other account-security credentials.

Service Providers

We use service providers to operate the Platform. Current providers supported by the Platform include:

• Supabase, for authentication and Platform data such as profiles, enrollments, progress, setup, security, and operational records.
• Vercel, for website hosting, request routing, serverless functions, and related infrastructure.
• Resend, for transactional and operational email delivery.
• jsDelivr, for browser delivery of the Supabase client library.

These providers process information on our behalf or as necessary to provide their services, subject to their applicable agreements and privacy practices.

Legal, Safety, and Business Reasons

We may disclose information when reasonably necessary to comply with law or valid legal process; enforce agreements; protect rights, safety, systems, or property; investigate security incidents or misuse; or support a business transaction involving the Platform, subject to applicable law.

We do not sell personal information for money, and we do not use personal information for cross-context behavioral advertising based on the current Platform practices described in this Policy.

5. Public Forms and Communications

When you submit a public form, the Platform may process your name, company, email, optional phone number, optional role, optional team size, message, source page, submission timestamp, and browser user-agent information. Form submissions are delivered by email to appropriate personnel through our email service provider. Do not submit passwords, setup codes, confidential assessment content, or other sensitive information through public forms.

6. Data Retention

We retain information for as long as reasonably necessary for the purposes described in this Policy, including operating the Platform, maintaining training and business records, supporting organizations and users, meeting security and audit needs, resolving disputes, enforcing agreements, and satisfying legal obligations. Retention periods vary by record type, customer relationship, operational requirement, and applicable law. We have not established one retention period that applies to every category of information.

Training, completion, safety, security, audit, email-delivery, and business records may remain after an account becomes inactive or a request is received because those records may support organizational recordkeeping, legal obligations, security, dispute resolution, or the integrity of training history. A request does not necessarily require deletion of every related record.

7. Security

We use administrative, technical, and organizational measures designed to protect information. These measures include authenticated access, role- and organization-based controls, protected server-side functions, and security and audit records. No method of transmission, storage, or security is guaranteed to be completely secure, and we cannot promise absolute security.

You are responsible for keeping your credentials confidential, using a secure device and network, and promptly reporting suspected unauthorized access.

8. Your Choices and Requests

You may contact us to ask about, request correction of, or request deletion of personal information associated with you. We will review and respond to requests as required by applicable law and based on the records and operational tools reasonably available to us. We may need to verify your identity, authority, and relationship to an organization before acting. Contacting us does not guarantee that a request can be fulfilled in full.

We may deny, limit, or defer a request where permitted by law, including when information must be retained for training, safety, security, audit, legal, contractual, dispute, or legitimate business-record purposes, or where changing or deleting it would affect another person's rights or the integrity of organizational records. If your account is managed by an organization, that organization may control certain account, training, or employment records, and we may refer the request to that organization.

9. Children's Privacy

The Platform is generally intended for adults age 18 or older and is not directed to children. We do not knowingly collect personal information directly from children under 13. Individuals under 18 may use the Platform only through an authorized, supervised organizational or adult arrangement, where permitted by applicable law. The Platform does not provide self-service onboarding for minors.

If you believe a child has provided personal information without appropriate authorization, contact us so we can review the matter.

10. Third-Party Links and Resources

The Platform may link to third-party websites, standards, regulations, manufacturer resources, or other materials. Those third parties control their own services and privacy practices. This Policy does not govern third-party sites or services.

11. Changes to This Policy

We may update this Policy to reflect changes in the Platform, our practices, legal requirements, or business operations. We will post the updated version and effective date. Where required, we will provide additional notice or obtain consent.

12. Contact

13. Industry Contributor Information

CraneQualified may invite selected individuals to contribute industry experience and perspective to Crane and Rigging Resources. If you participate, we may collect your name, verified email address, professional title, organization, general industry experience, selected contribution topic, interview answers, notice acceptance, editorial correspondence, correction or withdrawal requests, and information about how your contribution may be attributed.

We also process limited technical and security information needed to verify the invitation, protect the interview, prevent abuse, preserve an audit record, and operate the workflow. This may include timestamps, token and session fingerprints, request identifiers, delivery status, and privacy-protected network or browser identifiers. We do not intend to collect audio, attachments, credentials, government identifiers, confidential incidents, customer or employee identities, protected learner information, or protected training and assessment content through this workflow.

How We Use Contributor Information

We may use contributor information to verify invitation control; present and preserve a guided contributor interview; communicate about possible Resource development; distinguish contributor perspective from independently verified fact; prepare, fact-check, edit, review, correct, attribute, or decline potential Resources; allow the contributor to review representation; maintain security, version, consent, delivery, and editorial audit records; and address correction, withdrawal, privacy, security, or legal requests. Submitting an interview does not guarantee publication. CraneQualified retains factual, editorial, and publication control.

Service Providers

Contributor records are stored using CraneQualified’s controlled database infrastructure. CraneQualified uses Vercel to host and operate the application, Supabase to store private workflow records, and Resend to deliver invitation and operational email. Interview answers are not sent to Google Analytics, Vercel Web Analytics, or other public-site analytics. Verification and interview pages do not load third-party analytics. Phase 1 does not send contributor interviews to an AI provider and does not use AI to draft or publish articles. Phase 1 participation does not authorize undisclosed future AI processing.

Access

Contributor contact information and full interview answers are private operational and editorial records. Aggregate workflow status may be available to authorized Operations administrators, but full answers are limited to personnel specifically authorized for Resource editorial development, privacy administration, security investigation, or legal compliance. CraneQualified does not make contributor email addresses or unpublished interviews publicly searchable.

Retention

Unverified invitations are retained 30 days; abandoned interviews 90 days after last activity; submitted unpublished interviews 365 days after submission; contributor identity and contact 365 days after last active contribution; published-article source and audit records 3 years after latest publication or material update; email delivery metadata 90 days; expired verification and encrypted token material 7 days or less after final state; withdrawn unpublished contributions within 30 days after resolution; and minimal content-free withdrawal audit 365 days. Longer only for a documented law, legal claim, security, or publication-integrity reason, with access restricted and the reason documented.

Correction, Withdrawal, and Deletion

An Industry Contributor may ask CraneQualified to correct contact information, professional attribution, or submitted contribution, or request withdrawal. Before publication, CraneQualified will normally stop development and remove the unpublished contribution per schedule. After publication, withdrawal does not automatically remove or silently alter the Resource; CraneQualified reviews correction, update, de-attribution, or removal while preserving a minimum editorial-integrity record. Identity verification may be required. Some records may be retained for permitted security, audit, legal, dispute, or publication-integrity needs.

Prohibited Information

Contributors should not submit confidential employer or customer information; identifying employee, learner, or incident information; passwords or credentials; protected training or assessment content; certification documents; copyrighted standards or manuals; or unauthorized third-party material.

Security

CraneQualified uses server-side authorization, encrypted contact storage, restricted workflow access, expiring verification links, session controls, rate limits, immutable submitted-interview records, and audited administrative actions. No storage or transmission method can be guaranteed completely secure.

This implementation remains subject to qualified legal review.