Privacy Policy

1. Overview

This Privacy Policy explains how [LEGAL ENTITY NAME TO BE CONFIRMED BY OPERATOR BEFORE PRODUCTION] ("we," "us," or "our") collects, uses, discloses, and protects information in connection with CraneQualified, an online training platform developed and operated in association with MSC Safety Solutions and Colorado Crane Operator School (the "Platform").

This Policy applies to visitors, learners, instructors, company administrators, managers, and other authorized users of the Platform. It does not apply to third-party websites or services that we do not control.

2. Information We Collect

Information You Provide

Depending on how you use the Platform, we may collect:

• Your name, email address, telephone number, company, job role, team size, and messages or other information submitted through public contact or demonstration-request forms.
• Account and profile information, including identity, company association, portal access, role, course enrollment, and training pathway information.
• Setup and account-recovery information used to establish or recover access to an account. We do not intend to retain plaintext passwords or plaintext setup codes.
• Training and assessment information, including assigned courses, module and stage progress, completion status, attempts, scores, certificates, verification events, and related training records.
• Information submitted to support, administrative, security, or operational workflows.

Information Collected Automatically

When you visit or use the Platform, our systems and service providers may automatically process:

• Source page, submission date and time, browser user-agent information, request and response information, and similar technical records.
• Authentication and session information required to keep you signed in and route you to authorized areas.
• Device, security, audit, and activity information used to protect accounts, investigate misuse, maintain reliability, and document Platform operations.
• Progress and readiness events generated as you use training modules and assessments.

The Platform uses an authentication-gate cookie and browser storage for session and authentication functions. These technologies are used to provide account access, maintain security, and preserve necessary application state. They are not described as advertising cookies. The current Platform does not use Google Analytics or a comparable advertising or cross-site behavioral tracking service.

3. How We Use Information

We may use information to:

• Provide, authenticate, administer, support, and secure the Platform.
• Create and manage accounts, company relationships, portal access, enrollments, setup processes, and password recovery.
• Deliver courses, assessments, progress tracking, completion records, certificates, and related training functions.
• Respond to requests for demonstrations, support, account assistance, or other communications.
• Send transactional and operational email, including account setup, password recovery, onboarding, support, and service-related notices.
• Provide authorized organizations with appropriate training and progress information about their learners.
• Detect, prevent, investigate, and respond to fraud, abuse, unauthorized access, security incidents, and violations of Platform terms.
• Test, maintain, troubleshoot, improve, and understand the operation and reliability of the Platform.
• Satisfy legal obligations, enforce agreements, and protect the rights, safety, and property of users, organizations, the Platform, and others.

We do not promise that use of the Platform, or any training delivered through it, satisfies every legal, regulatory, employer, certification, or safety requirement applicable to a user or organization.

4. When We Share Information

Authorized Organizations and Managers

If your account is associated with an employer, customer, school, training provider, or other organization, authorized personnel for that organization may access information such as assigned courses, progress, completion, attempts, scores, certificates, and related training records, subject to their role and organization. They are not provided with your password, setup code, authentication secrets, or other account-security credentials.

Service Providers

We use service providers to operate the Platform. Current providers supported by the Platform include:

• Supabase, for authentication and Platform data such as profiles, enrollments, progress, setup, security, and operational records.
• Vercel, for website hosting, request routing, serverless functions, and related infrastructure.
• Resend, for transactional and operational email delivery.
• jsDelivr, for browser delivery of the Supabase client library.

These providers process information on our behalf or as necessary to provide their services, subject to their applicable agreements and privacy practices.

Legal, Safety, and Business Reasons

We may disclose information when reasonably necessary to comply with law or valid legal process; enforce agreements; protect rights, safety, systems, or property; investigate security incidents or misuse; or support a business transaction involving the Platform, subject to applicable law.

We do not sell personal information for money, and we do not use personal information for cross-context behavioral advertising based on the current Platform practices described in this Policy.

5. Public Forms and Communications

When you submit a public form, the Platform may process your name, company, email, optional phone number, optional role, optional team size, message, source page, submission timestamp, and browser user-agent information. Form submissions are delivered by email to appropriate personnel through our email service provider. Do not submit passwords, setup codes, confidential assessment content, or other sensitive information through public forms.

6. Data Retention

We retain information for as long as reasonably necessary for the purposes described in this Policy, including operating the Platform, maintaining training and business records, supporting organizations and users, meeting security and audit needs, resolving disputes, enforcing agreements, and satisfying legal obligations. Retention periods vary by record type, customer relationship, operational requirement, and applicable law. We have not established one retention period that applies to every category of information.

Training, completion, safety, security, audit, email-delivery, and business records may remain after an account becomes inactive or a request is received because those records may support organizational recordkeeping, legal obligations, security, dispute resolution, or the integrity of training history. A request does not necessarily require deletion of every related record.

7. Security

We use administrative, technical, and organizational measures designed to protect information. These measures include authenticated access, role- and organization-based controls, protected server-side functions, and security and audit records. No method of transmission, storage, or security is guaranteed to be completely secure, and we cannot promise absolute security.

You are responsible for keeping your credentials confidential, using a secure device and network, and promptly reporting suspected unauthorized access.

8. Your Choices and Requests

You may contact us to ask about, request correction of, or request deletion of personal information associated with you. We will review and respond to requests as required by applicable law and based on the records and operational tools reasonably available to us. We may need to verify your identity, authority, and relationship to an organization before acting. Contacting us does not guarantee that a request can be fulfilled in full.

We may deny, limit, or defer a request where permitted by law, including when information must be retained for training, safety, security, audit, legal, contractual, dispute, or legitimate business-record purposes, or where changing or deleting it would affect another person's rights or the integrity of organizational records. If your account is managed by an organization, that organization may control certain account, training, or employment records, and we may refer the request to that organization.

9. Children's Privacy

The Platform is generally intended for adults age 18 or older and is not directed to children. We do not knowingly collect personal information directly from children under 13. Individuals under 18 may use the Platform only through an authorized, supervised organizational or adult arrangement, where permitted by applicable law. The Platform does not provide self-service onboarding for minors.

If you believe a child has provided personal information without appropriate authorization, contact us so we can review the matter.

10. Third-Party Links and Resources

The Platform may link to third-party websites, standards, regulations, manufacturer resources, or other materials. Those third parties control their own services and privacy practices. This Policy does not govern third-party sites or services.

11. Changes to This Policy

We may update this Policy to reflect changes in the Platform, our practices, legal requirements, or business operations. We will post the updated version and effective date. Where required, we will provide additional notice or obtain consent.

12. Contact