Privacy Policy
Effective · Starboard Labs LLC, which operates SafetyAid · United States only
1. What we collect
Your name and email address, so you can sign in and so your certificate has a name on it. The name shown on your certificate is recorded at the moment it is issued, so a later change to your account does not make the paper and the screen disagree.
Your purchase — that you bought the course, when, and a reference number from Stripe. Billing details you enter at checkout go to Stripe.
What you do in the course — which lessons you have finished, your answers to the practice exercises, your knowledge-check and final assessment scores, and your certificate.
Technical information — your IP address, your browser and device, which pages you viewed, and how the videos played. Some of this is in ordinary server logs; some of it is how we stop the public certificate-checking page from being hammered.
If you ask to hear when the course opens — your name and email address, and the company and crew size if you give them. If you unsubscribe from that email, we record that you did. You do not need an account for this, and it is kept apart from course records.
Your practice answers are kept. Your exam answers are not.
When you answer a practice exercise inside a lesson, we store what you chose, so you can see your feedback and so we can tell which exercises are confusing everyone. For the module quizzes and the final assessment we store your score and whether you passed — not the individual answers.
What we do not collect
We never see or store your card number — that goes straight to Stripe. We do not collect Social Security or other government identification numbers, bank details, health information, biometrics, your precise location, your contacts, or anything about your employment beyond what you choose to tell us. We do not ask your age beyond confirming you are 18, and we do not ask your race, religion, politics, health or sexual orientation. We collect no sensitive personal information as the state privacy laws define it.
2. Where it comes from
From you, and from two services acting on our behalf: Clerk, which handles sign-in, and Stripe, which handles payment and passes us your name and email so we know who bought what.
We do not buy personal information from data brokers, scrape it from public records or social media, or receive it from marketing partners.
3. How we use it
- To run the course: give you access, remember where you got to, score your work.
- To issue your certificate, and to answer when somebody checks it with your code.
- To send you the email the course requires — your receipt, your certificate, and a reminder before it expires.
- To keep the service working and secure, including rate-limiting the public pages.
- To improve the course — which lessons people abandon, which questions everybody gets wrong.
- To comply with the law and to establish or defend legal claims.
That is the complete list. We do not use your information for advertising, we do not build a profile of you to sell things, and we do not use your data or your answers to train AI models.
4. Automated scoring
Your final assessment is scored by software, with no person involved, and that score alone decides whether you get a certificate.
The scoring is arithmetic — your answers against a fixed answer key, 70% to pass. There is no profiling, no model, and nothing about you as a person enters into it. If you think your result is wrong, email privacy@safetyaid.org and a person will look at it.
6. Certificate checking
Your certificate carries a code. Anyone who enters that code sees your name, the course, and the issue and expiry dates. They do not see your email address, your scores, your answers, how long you took, or anything else — the page is built to return only what is already printed on the certificate itself.
You decide who can check it, by deciding who gets the code. That is how a checkable certificate has to work, and it has a consequence worth stating: anyone you give the code to can pass it to somebody else. The code is long and random, there is no directory, and there is no way to search for a person or to work backwards from a name — but it is a key, and whoever holds it can open that one door.
There is also a recovery form for holders who lost their code. It always gives the same answer no matter what you type into it, and any email it sends goes to the address on the account rather than the one typed in — so it cannot be used to find out whether somebody has a certificate, or to send mail to a stranger.
7. How long we keep it
We keep personal information for as long as it takes to do the job we collected it for, and then for as long as we need it to meet legal, accounting or tax requirements, or to establish or defend a legal claim. In deciding how long that is we weigh how much information it is, how sensitive it is, what harm its disclosure could do, and whether we could achieve the same thing without it.
We have not set a fixed retention period for each kind of course data. When we set one, this section will say what it is. It gates nothing you can ask for today: request deletion and we will remove your information, whether or not a period would have come due.
Two things already expire on their own: the security counters behind the public pages, which hold an IP address for a matter of hours, and your certificate, which stops being valid two years after you pass.
If you asked to hear when the course opens, we keep your name, email address and anything you told us about your crew until you ask us to delete them. If you ask us to stop emailing you, we stop, and keep your address marked so that nobody contacts you again.
If you ask us to delete everything, ask yourself about the certificate first. Deleting the record means it stops verifying — anyone who checks the code afterwards, including an employer who accepted it before, will get nothing back. We will confirm what you want to happen to it before we delete anything.
8. Your choices
See and change your information
Sign in to your account to review or update your details.
Most of what we send is not optional — a receipt, your certificate — because it is the thing you bought. The one you can turn off is the reminder before your certificate expires. Email privacy@safetyaid.org and we will stop it.
If you signed up to hear when the course opens, reply to any email from us about it, or email privacy@safetyaid.org, and we will stop writing to you.
Delete your account and your data
Email privacy@safetyaid.org and we will delete your account and the course data behind it. Read the note about your certificate above first.
Feedback you sent anonymously is the one thing we cannot delete. We store it with no name and no account, exactly as the box you ticked says, so nothing in it can tell us it was yours.
Cookies
Our Cookie Notice lists every item stored in your browser, what each is for, and how to remove it. There is no consent banner because nothing is set until you sign in.
Do Not Track and Global Privacy Control
We do not track you across other websites, so there is nothing for these signals to switch off. We do not sell or share your personal information, which means a Global Privacy Control signal has no sale to stop. We do not otherwise respond to Do Not Track signals.
9. Security
We use technical and organizational measures to protect your information, and we keep the parts of it we do not need out of the system in the first place — most obviously card numbers, which never reach us. No internet service can guarantee perfect security.
We are based in the United States and the companies that serve the site operate here and in other countries, so your information may be processed outside your state.
10. Children
This service is for people 18 and over. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us information, email privacy@safetyaid.org and we will delete it.
11. Changes
We may update this policy. If we change it materially we will update the effective date at the top and say so on the site. Using the service after that means the updated policy applies to you.
12. How to contact us
Email privacy@safetyaid.org for anything in this policy, including to use any of the rights below.
Mailing address: Florida, USA
13. State privacy rights
This section applies if you live in a US state whose privacy law covers us. Those laws differ, so not every right below is available to everyone, and we may decline a request where the law permits.
Your rights
- Know what categories of personal information we have collected, where we got them, why, and who we disclosed them to.
- Access a copy of the personal information we hold about you.
- Correct personal information that is wrong.
- Delete the personal information we collected from you.
- Appeal if we refuse a request.
You may exercise these rights free from any penalty. We will not charge you more, give you a worse service, or refuse to sell to you because you asked.
Opt-out rights
- Targeted advertising. We do not process personal information for targeted advertising.
- Sale or sharing. We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those state privacy laws define those terms.
- Profiling. We do not profile you. We do score your assessment automatically, which decides whether a certificate is issued — see Automated scoring, including how to have a person review it.
- Sensitive personal information. We do not collect any.
Making a request
Email privacy@safetyaid.org from the address on your account and tell us what you want. If we cannot match the address to an account we may ask you for enough detail to identify it — we will not ask for government identification to answer a request about a training record. Someone may make a request on your behalf if you give them written permission, and we may check that they have it.
We do not attempt to re-identify information we have de-identified, except to test that our de-identification works.
What we collect, in the statutory categories
This describes our practices now and over the past 12 months. We do not sell or share any of it, so that column is the same for every row and is stated once here rather than repeated.
| What we collect | Statutory category | Why | Disclosed to |
|---|---|---|---|
| Name, email address, account id | Identifiers | Creating your account, issuing your certificate, sending course email | Clerk, Stripe, Resend, Neon |
| Name, email address, company, crew size and unsubscribe status, if you ask to hear when the course opens | Identifiers; professional or employment-related information | Telling you when the course opens, and following up about it | Neon, Resend, Notion |
| Billing details given at checkout | Identifiers; commercial information | Taking payment and keeping a record of it | Stripe, Neon |
| Purchase and enrollment records | Commercial information | Giving you access to what you bought, and support | Stripe, Neon |
| Course progress, practice answers, scores, certificate | Internet or other electronic network activity; commercial information | Running the course, scoring the assessment, issuing and checking certificates | Neon, Vercel |
| Feedback you send about the course, and the page you sent it from | Internet or other electronic network activity; customer records | Fixing what is wrong with the course, and deciding what to change next | Neon, Notion |
| IP address, device and browser information, pages viewed, and the page and site a waitlist sign-up’s visit began on | Identifiers; internet or other electronic network activity | Serving the site, keeping it secure and rate-limited, counting page views and sign-ups | Vercel, Mux |
| Video playback telemetry | Internet or other electronic network activity | Delivering video and measuring playback quality | Mux |
| Emails you send us | Identifiers; customer records | Answering you | Resend |
California
Under California’s Shine the Light law, California residents may ask which personal information we disclosed to third parties for their own direct marketing in the past year. We disclose none, because we do not do that. If you want that answer in writing, email privacy@safetyaid.org with the subject “Shine the Light Request”, your name and your mailing address.
Nevada and Texas
Nevada residents may direct us not to sell covered information; we do not sell it. Texas residents should note we do not sell sensitive personal data, because we do not collect any.