Website Privacy Policy

Checkout information. For individual purchases: first name, last name, email address, and optionally a company name. For group/business purchases: also a phone number, PO number or order notes, and billing address. We also store order details: courses purchased, quantities and seats, amounts, currency, order status, and Stripe payment reference IDs.

Payment information. Card and payment credentials are entered directly into Stripe's secure payment fields and are never received or stored by us. Stripe processes your payment data as an independent service provider under its own privacy policy. If you choose Apple Pay, Google Pay, Stripe Link, or Klarna, that provider also processes your data under its own terms. Klarna, for example, may perform eligibility checks for its pay-later options.

Contact form. First name, last name, email, company, and your message. Submissions are delivered by email to our team; we do not maintain a separate database of contact submissions beyond our email delivery logs.

Email operations data. Logs of transactional emails we send (recipient, template, delivery status), unsubscribe tokens, and a suppression list (bounces, complaints, unsubscribes).

What we do not collect. The Site has no visitor accounts or passwords, no newsletter list, and no analytics, advertising, or tracking technologies of any kind. Our application does not log or store your IP address, browsing behavior, or device fingerprints. We do not collect government IDs, Social Security numbers, precise geolocation, or biometric data. Our infrastructure providers (edge hosting, database, and payment providers) maintain their own standard server logs as described in Section 5.

We use personal information to: process orders and payments; provision course enrollments and business seat pools on our learning platform; send transactional emails (order confirmations and contact-form responses); respond to inquiries; prevent fraud and defend against payment disputes; comply with legal, tax, and accounting obligations; and maintain business records. We do not use your information for advertising, and we do not send marketing email.

Where laws such as the EU/UK GDPR apply, we process personal information to perform our contract with you (orders and enrollment), for our legitimate interests (security, fraud prevention, record-keeping), to comply with legal obligations, and, where required, with consent.

When your purchase completes, we transmit enrollment data to our learning platform (a separate system) so your training access can be provisioned: for individual purchases, the course, order and payment reference IDs, amount, and the learner's name and email; for business purchases, also the business name, administrator contact details, phone, billing address, PO number, and seat count. From that point, the platform's Privacy Policy governs that data, including learner course activity and certificates. Note that platform data is stored in Canada, as described there.

We do not sell personal information and we do not share it for cross-context behavioral advertising. We share personal information only with:

Service providers: Lovable and Cloudflare (website hosting and content delivery; as hosting providers they process all web requests, including IP addresses, in standard server logs); Supabase on Amazon Web Services, US-West (Oregon) region (our database); Lovable's transactional email service (email delivery); and Google Fonts (which receives your IP address and browser information when your browser loads our typefaces).

Payment providers: Stripe, and your selected wallet or financing provider (Apple Pay, Google Pay, Link, or Klarna), which process payment data directly.

Our learning platform, as described in Section 4.

Legal and safety: to comply with law, legal process, or governmental request; to enforce our Terms; to defend payment disputes; or to protect the rights, safety, or property of the Company, our users, or others.

Business transfers: in a merger, acquisition, financing, or sale of assets, subject to this Policy.

Site data is stored in the United States (AWS US-West, Oregon). Data transferred to our learning platform is stored in Canada. All data is encrypted in transit (TLS) and at rest. If you access the Site from outside the United States, your information will be transferred to and processed in the United States; where required for EEA/UK data, we rely on appropriate safeguards.

We retain order and customer records for as long as needed for the purposes above, including tax, accounting, and dispute-defense obligations. Enrollment delivery logs and email delivery logs are automatically deleted after 12 months. You may request deletion of your personal information by emailing team@oshasafetytraining.org. We will erase your personal information within thirty (30) days of a verified deletion request, except where retention is required by law or is necessary to comply with tax, accounting, and legal obligations (order and transaction records), resolve disputes and defend payment claims, honor your unsubscribe (suppression records), or maintain training records as described in the platform Privacy Policy. Where full deletion is not required, we retain only the minimum necessary information.

Depending on your jurisdiction, you may have rights to access, correct, delete, or receive a copy of your personal information. Email team@oshasafetytraining.org from the email address you used with us (or provide other verification we reasonably request); we respond within the time required by applicable law. We will not discriminate against you for exercising your rights. Where applicable law allows, you may use an authorized agent, and you may appeal a refusal by replying to our response.

Email choices. Our Site email is transactional (order confirmations and contact responses). Every message includes an unsubscribe link; unsubscribing adds you to our suppression list.

In the preceding 12 months we have collected: identifiers (name, email, phone for business orders); commercial information (orders, courses purchased, amounts); and other information you voluntarily provide (contact messages, billing address for business orders). Sources: you. Purposes: Section 2. Recipients: Section 5. We do not sell personal information, we do not share personal information for cross-context behavioral advertising, and we have not done so in the preceding 12 months. We do not collect or use sensitive personal information for purposes requiring a right to limit. We have no actual knowledge of selling or sharing personal information of consumers under 16. Because we do not sell or share personal information and use no advertising cookies, there is no "Do Not Sell or Share" opt-out to exercise; California residents may exercise the rights to know, access, correct, and delete as described in Section 8.

The Site is not directed to children, and purchases require you to be at least 18. We do not knowingly collect personal information from anyone under 18; if you believe we have, contact team@oshasafetytraining.org and we will delete it.

We use safeguards appropriate to the data we handle: TLS encryption in transit, encryption at rest, row-level security on our database, server-side-only payment processing through Stripe (no card data on our systems), role-restricted admin access, and signed, replay-protected transfers to our learning platform. No system is perfectly secure.

We may update this Policy from time to time. We will post the updated version with a new "Last Updated" date and, for material changes, provide reasonable notice on the Site. Continued use after the effective date constitutes acceptance.

OSHA Safety Training LLC
Attn: Privacy
2900 S Shell Gulch Spur, Etna, CA 96027
team@oshasafetytraining.org

If you are in the EEA/UK and believe we have not resolved your concern, you may lodge a complaint with your local supervisory authority.