Privacy Policy

1. Introduction and Scope

Welcome to Substitute Teacher Training. We operate the website substituteteachertraining.com (the "Platform"), which provides practical, skills-based professional development training and educational resources for substitute teachers, focused on classroom management and professional competencies. Substitute Teacher Training ("we," "us," or "our") is the operator of the Platform.

This Privacy Policy describes how we collect, use, disclose, and protect your personal information when you visit our Platform, create an account, purchase or access our courses, use our AI Study Buddy feature, download free resources, submit contact or inquiry forms, or otherwise interact with us. It applies to all users ofsubstituteteachertraining.com, including visitors, registered students, school administrators, and anyone who contacts us.

By accessing or using our Platform, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy. If you do not agree with this Privacy Policy, please do not use our Platform. This Privacy Policy should be read in conjunction with our Terms of Service, which govern your use of the Platform.

2. Information We Collect

We collect several categories of information depending on how you interact with our Platform. Below is a detailed description of each category.

2.1 Account Information

When you create an account on our Platform, we collect the following information:

• Name: Your full name, as provided during registration or obtained from your Google account if you sign in with Google OAuth.
• Email Address: Your email address, used as your primary account identifier and for communications.
• Password: If you register with an email and password (rather than Google OAuth), your password is hashed using bcrypt via NextAuth before storage. We never store your password in plain text and cannot retrieve it.
• Profile Avatar: If you sign in with Google OAuth, we may receive and store your Google profile picture. This is optional and used solely for display purposes within your account.

2.2 Payment Information

When you purchase a course or bundle, your payment is processed entirely through Stripe, our third-party payment processor. We do NOT store your credit card number, debit card number, bank account number, or any other sensitive payment instrument details on our servers. The payment data we do store includes:

• Stripe Customer ID: A unique identifier assigned by Stripe to your account, used to associate your purchases with your Stripe profile.
• Payment Intent IDs: Identifiers for each transaction processed through Stripe, used for record-keeping and support inquiries.
• Transaction Records: The amount paid, date of purchase, course(s) purchased, and payment status (succeeded, failed, refunded).

For information about how Stripe handles your payment data, please review Stripe's Privacy Policy.

2.3 Course Progress Data

As you use our Platform to take courses, we collect and store data about your learning progress, including:

• Lesson Completion Status: Which lessons you have completed and when.
• Video Watch Position and Percentage: Your playback position within course videos and the percentage of each video you have watched, used to track your progress and allow you to resume where you left off.
• Quiz and Exam Scores: Your scores on quizzes and final exams within each course, including individual question responses.
• Overall Course Grades: Your calculated grade for each course based on your quiz, exam, and assignment performance.
• Certificate Eligibility Status: Whether you have met the requirements to receive a certificate of completion for a given course.

2.4 AI Chat Data

Our Platform includes an AI Study Buddy feature powered by Anthropic's Claude. When you use this feature, we collect and store:

• Your Messages: The text of the messages and questions you send to the AI Study Buddy.
• AI Responses: The text of the responses generated by the AI Study Buddy in reply to your messages.
• Conversation Metadata: Timestamps, conversation identifiers, the course context in which the conversation occurred, and your user ID associated with the conversation.

All AI chat data is stored in our database. For more details about how AI data is handled, see Section 5 ("AI Features and Data Disclosure").

2.5 Contact and Lead Data

When you interact with us through forms on our Platform, we collect:

• Contact Form Submissions: Your name, email address, phone number (if provided), school or organization name (if provided), and the content of your message.
• School Inquiry Forms: Information submitted by school administrators or districts inquiring about group enrollments, including school name, contact person, email, phone number, and inquiry details.
• Free Resource Download Requests: Your name and email address, provided when you request access to free downloadable resources.

2.6 Technical Data

When you visit our Platform, we automatically collect certain technical information, including:

• IP Address: Your Internet Protocol address, used for security, fraud prevention, and general analytics.
• Browser Type and Version: The web browser you use to access our Platform (e.g., Chrome, Firefox, Safari).
• Device Type: Whether you are accessing from a desktop computer, laptop, tablet, or mobile device.
• Operating System: The operating system of your device (e.g., Windows, macOS, iOS, Android).
• Referring URL: The web address that directed you to our Platform.
• Pages Visited: Which pages on our Platform you accessed and in what order.
• Timestamps: The date and time of your visits and interactions.

2.7 Certificate Data

When you earn a certificate of completion, we create and store the following information:

• Your Name: As displayed on the certificate, which you provide or which is pulled from your account profile.
• Email Address: Associated with your account for certificate delivery.
• Course Completed: The name of the course for which the certificate was issued.
• Grade Achieved: Your final grade or score in the course.
• Unique Verification Code: A code assigned to each certificate that allows third parties (such as schools or employers) to verify the authenticity of your certificate.
• Certificate PDF: A generated PDF file of your certificate, stored in Cloudflare R2 object storage.

3. How We Collect Information

We collect information through three primary methods:

3.1 Directly from You

We collect information that you voluntarily provide to us when you:

• Create an account or register on our Platform.
• Purchase a course or bundle.
• Complete your profile or update account settings.
• Submit a contact form, school inquiry, or support request.
• Request a free resource download.
• Use the AI Study Buddy feature by typing messages and questions.
• Take quizzes, exams, or complete lessons.
• Communicate with us via email.

3.2 Automatically

We automatically collect technical data when you visit and interact with our Platform. This data is gathered through server logs and standard web technologies. As described in Section 6, we use only strictly necessary and functional cookies and do not use analytics or advertising trackers.

3.3 From Third Parties

If you choose to sign in using Google OAuth, we receive certain profile information from Google, including your name, email address, and profile picture. We only receive this information with your authorization through Google's OAuth consent flow. We do not purchase or obtain personal information from data brokers or other third-party sources.

4. How We Use Your Information

We use the information we collect for the following purposes:

• Account Management: To create, maintain, and secure your user account, authenticate your identity, and manage your account settings.
• Course Delivery and Progress Tracking: To provide you with access to purchased courses, track your lesson completion, video progress, quiz scores, and overall grades, and to enable you to resume courses where you left off.
• Payment Processing: To process your course purchases through Stripe, issue receipts, handle refund requests, and maintain transaction records.
• Certificate Generation and Verification: To generate certificates of completion when you meet course requirements, deliver certificate PDFs to you, and enable third-party verification of your certificates through our verification system.
• AI Study Assistant Functionality: To power the AI Study Buddy feature by sending your messages to Anthropic's Claude API, returning AI-generated responses to you, and storing conversation history so you can review past interactions.
• Customer Support: To respond to your inquiries, troubleshoot issues, and provide assistance with your account or courses.
• Email Communications: To send you transactional emails such as purchase confirmations, password reset links, certificate delivery notifications, and account-related alerts.
• Platform Improvement: To understand how our Platform is used, identify areas for improvement, and develop new features and course content.
• Fraud Prevention and Security: To detect and prevent fraudulent activity, unauthorized access, and other security threats to our Platform and users.
• Legal Compliance: To comply with applicable laws, regulations, legal processes, and government requests.

5. AI Features and Data Disclosure

Our Platform includes an AI Study Buddy feature designed to help you study course material. This section provides detailed information about how this feature works and how your data is handled.

5.1 How the AI Study Buddy Works

The AI Study Buddy is powered by Anthropic's Claude API. When you send a message to the Study Buddy, your message text is transmitted to Anthropic's servers for processing. Anthropic's Claude model generates a response, which is then returned to you through our Platform. Responses are generated in real-time and are not pre-reviewed by Substitute Teacher Training staff.

5.2 Data Sent to Anthropic

When you use the AI Study Buddy, the following data is sent to Anthropic for processing:

• The text of your message or question.
• Relevant course context (such as the lesson or topic you are studying) to help the AI provide more relevant answers.
• Prior messages in the current conversation thread, to maintain conversational context.

We do not send your name, email address, payment information, or other personal account details to Anthropic unless you include such information in your chat messages.

5.3 Data Storage

Your AI Study Buddy conversations -- including your messages, the AI's responses, and conversation metadata -- are stored in our InstantDB database. This data is associated with your user account and is retained as part of your account data (see Section 9 for data retention details).

5.4 Anthropic's Data Handling

Anthropic processes data sent to their API in accordance with their own privacy policy and terms of service. We encourage you to review Anthropic's Privacy Policy to understand how they handle data received through their API. Under Anthropic's API terms, data sent through the API is not used to train their models.

5.5 Your Choices

Use of the AI Study Buddy feature is entirely optional. You can complete all courses and earn certificates without ever using the AI Study Buddy. If you choose not to use this feature, no AI chat data will be collected from you.

6. Cookies and Similar Technologies

We use a minimal number of cookies to operate our Platform. We believe in transparency about tracking technologies, and we want you to know exactly what cookies are set when you use our Platform.

6.1 Cookies We Use

Our Platform uses only the following three cookies:

1. next-auth.session-token / __Secure-next-auth.session-token: This cookie stores your authentication session token, which keeps you logged in as you navigate the Platform. It is a strictly necessary cookie required for the Platform to function. It expires after 30 days, at which point you will need to sign in again.
2. next-auth.csrf-token: This cookie provides Cross-Site Request Forgery (CSRF) protection, which is a security measure that prevents malicious websites from performing unauthorized actions on your behalf. It is a strictly necessary cookie and expires at the end of your browser session.
3. theme: This cookie stores your preferred theme setting (light or dark mode). It is a functional cookie that enhances your experience and persists until you clear your browser cookies or change your preference.

6.2 Cookies We Do NOT Use

We do NOT use analytics cookies, advertising cookies, tracking pixels, or third-party tracking cookies. We do not use Google Analytics, Facebook Pixel, or any similar tracking service. Your browsing activity on our Platform is not tracked for advertising purposes, and we do not build advertising profiles based on your activity.

7. Third-Party Service Providers

We use a limited number of third-party service providers to operate our Platform. Each provider has access only to the data necessary to perform their specific function. Below is a complete list of our third-party service providers, what they do, and what data they may access.

7.1 Stripe

Purpose: Payment processing.

Data Accessed: Payment details you enter during checkout (credit/debit card number, expiration date, CVC, billing address), transaction amounts, and billing information. Stripe processes this data directly -- it does not pass through our servers.

Stripe's Privacy Policy

7.2 InstantDB

Purpose: Database hosting.

Data Accessed: All application data stored in our database, including account information, course progress, AI chat history, transaction records, certificate records, and contact form submissions.

7.3 Resend

Purpose: Transactional email delivery.

Data Accessed: Email addresses of recipients, email subject lines, and the content of transactional emails (such as purchase confirmations, password reset links, and certificate notifications).

Resend's Privacy Policy

7.4 Cloudflare R2

Purpose: File storage.

Data Accessed: Certificate PDF files and course materials stored as objects in Cloudflare R2 storage buckets.

Cloudflare's Privacy Policy

7.5 Anthropic

Purpose: AI processing for the Study Buddy feature.

Data Accessed: Chat messages you send to the AI Study Buddy, including your questions, the conversational context, and related course context. See Section 5 for detailed information.

Anthropic's Privacy Policy

7.6 Vercel

Purpose: Website hosting and deployment.

Data Accessed: Technical and request data, including IP addresses, HTTP request headers, URLs accessed, and server logs generated during your use of our Platform.

Vercel's Privacy Policy

7.7 Google

Purpose: OAuth authentication (Sign in with Google).

Data Accessed: When you choose to sign in with Google, we receive your name, email address, and profile avatar from your Google account. This data is provided through Google's OAuth consent flow and only with your explicit authorization.

Google's Privacy Policy

7.8 Mapbox

Purpose: Interactive map rendering for our state requirements map feature.

Data Accessed: No personal data is shared with Mapbox. Mapbox is used solely to render an interactive map displaying substitute teacher requirements by state. Mapbox may collect standard technical data (such as IP addresses) through its map tile requests as described in their privacy policy.

Mapbox's Privacy Policy

8. Data Sharing

We do NOT sell your personal information to any third party for any purpose. We have never sold personal information and have no plans to do so.

We may share your personal information only in the following limited circumstances:

• Service Providers: With the third-party service providers listed in Section 7, solely to the extent necessary for them to perform their services on our behalf. Each provider is contractually obligated to use your data only for the purpose of providing their service to us.
• Legal Requirements: When we are required to do so by law, court order, subpoena, or other legal process, or when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.
• Business Transfers: In connection with a merger, acquisition, reorganization, sale of assets, or bankruptcy proceeding, your personal information may be transferred to the acquiring entity. We will provide notice before your personal information is transferred and becomes subject to a different privacy policy.
• With Your Consent: We may share your information with third parties when you have given us explicit consent to do so.
• Certificate Verification: When a third party (such as a school, school district, or employer) uses our certificate verification system, they can view the following information associated with a verification code: the certificate holder's name, the course completed, the date of completion, and the verification status (valid or invalid). This information is publicly verifiable by design, as the purpose of certificates is to provide proof of course completion to third parties.

9. Data Retention

We retain your personal information as follows:

• Account Data: Your account information (name, email, profile data) is retained for as long as your account remains active on our Platform. If you do not log in or use your account for an extended period, your account remains intact unless you request deletion.
• Payment Records: Transaction records and payment history are retained in accordance with tax and legal requirements. Under U.S. tax law and standard business practices, financial records are typically retained for a minimum of seven (7) years.
• Course Progress Data: Your lesson completion records, quiz scores, exam results, grades, and video progress data are retained for as long as your account is active, allowing you to access your historical progress and course records.
• AI Chat History: Conversations with the AI Study Buddy are retained for as long as your account is active. You can review past conversations within the Platform.
• Certificate Records: Certificate data and PDF files are retained indefinitely to support ongoing certificate verification by third parties, even after account deletion, unless you specifically request certificate removal.
• After Account Deletion: If you request deletion of your account, we will remove your personal information from our active systems within thirty (30) days. However, we may retain certain data where we are legally required to do so (such as financial records for tax purposes), and residual copies of your data may exist in backup systems for a limited time before being overwritten. Anonymized or aggregated data that cannot be used to identify you may be retained indefinitely for analytical purposes.

10. Data Security

We take the security of your personal information seriously and implement appropriate technical and organizational measures to protect it against unauthorized access, alteration, disclosure, or destruction. Our security practices include:

• Password Hashing: All user passwords are hashed using the bcrypt algorithm before being stored. Bcrypt is a widely trusted, industry-standard hashing function designed to be computationally expensive, making brute-force attacks impractical. We never store passwords in plain text.
• Encryption in Transit: All data transmitted between your browser and our servers is encrypted using HTTPS (TLS/SSL). This ensures that your information cannot be intercepted by third parties during transmission.
• Access Controls and Authentication: Access to our systems, databases, and administrative tools is restricted to authorized personnel and protected by strong authentication mechanisms. We follow the principle of least privilege, ensuring that each system component and person has only the minimum level of access necessary to perform their function.
• Regular Security Practices: We regularly review our security practices and update them as necessary to address new threats and vulnerabilities. Our infrastructure providers (Vercel, Cloudflare, Stripe) maintain their own robust security programs and certifications.

While we strive to protect your personal information, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee absolute security. If you become aware of any unauthorized access to your account or a potential security breach, please contact us immediately at support@substituteteachertraining.com.

11. Your Privacy Rights

Depending on your location, you may have specific rights regarding your personal information. Below we outline the rights available under applicable privacy laws.

11.1 California Residents (CCPA/CPRA)

If you are a resident of California, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) provides you with the following rights:

• Right to Know: You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which your personal information was collected, the business or commercial purpose for collecting your personal information, and the categories of third parties with whom we share your personal information.
• Right to Delete: You have the right to request that we delete personal information we have collected from you, subject to certain exceptions (such as data required for completing transactions, maintaining security, or complying with legal obligations).
• Right to Correct: You have the right to request that we correct inaccurate personal information that we maintain about you.
• Right to Opt-Out of Sale or Sharing: You have the right to opt out of the sale or sharing of your personal information. However, as stated in Section 12, we do not sell or share your personal information as those terms are defined under the CCPA/CPRA.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights. You will not receive different pricing, quality of service, or any other penalty for exercising your privacy rights.

To submit a request under the CCPA/CPRA, please contact us at support@substituteteachertraining.com. When you submit a request, we will take steps to verify your identity before fulfilling your request. This verification process may require you to provide information that matches information we already have on file (such as your email address associated with your account). We will respond to verifiable requests within forty-five (45) days, as required by law. If we need more time (up to an additional 45 days), we will inform you of the reason and the extension period.

11.2 Canadian Residents (PIPEDA)

If you are a resident of Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation provide you with the following rights:

• Right to Access: You have the right to request access to the personal information we hold about you and to be informed of how it has been used and to whom it has been disclosed.
• Right to Challenge Accuracy: You have the right to challenge the accuracy and completeness of your personal information and have it amended as appropriate.
• Right to Withdraw Consent: You have the right to withdraw your consent to the collection, use, or disclosure of your personal information at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawal of consent may limit our ability to provide certain services to you (for example, if you withdraw consent for us to store your course progress, we may be unable to track your course completion).
• Right to Complain: If you believe we have not handled your personal information appropriately, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada. You can learn more at www.priv.gc.ca.

To exercise any of these rights, please contact us at support@substituteteachertraining.com. We will respond to your request within thirty (30) days, as required by PIPEDA.

12. Do Not Sell or Share

We do NOT sell your personal information, as "sell" is defined under the California Consumer Privacy Act (CCPA) or any other applicable privacy law. We have not sold personal information in the preceding twelve (12) months, and we have no intention to sell personal information in the future.

We do NOT share your personal information for cross-context behavioral advertising purposes, as "share" is defined under the CCPA/CPRA. We do not use your data to build advertising profiles, and we do not provide your data to advertising networks or data brokers.

We do not offer financial incentive programs (such as discounts or rewards) tied to the collection, sale, retention, or deletion of personal information.

13. International Data Transfers

Our Platform is operated from the United States, and the data we collect is primarily stored and processed in the United States on servers operated by our service providers (Vercel, InstantDB, Cloudflare, and others as listed in Section 7).

If you are accessing our Platform from outside the United States, including from Canada or other countries, please be aware that your personal information will be transferred to, stored in, and processed in the United States. The data protection and privacy laws of the United States may differ from those of your jurisdiction.

By using our Platform, you consent to the transfer of your personal information to the United States. We take appropriate safeguards to ensure that your personal information is protected in accordance with this Privacy Policy regardless of where it is stored or processed. Our service providers are contractually obligated to protect personal data in accordance with applicable law and industry standards.

14. Children's Privacy

Our Platform is designed for users who are eighteen (18) years of age or older. Our courses are intended for adults seeking substitute teacher certification or professional development. We do not knowingly collect personal information from children under thirteen (13) years of age.

If we become aware that we have inadvertently collected personal information from a child under 13, we will take prompt steps to delete that information from our records. If you are a parent or guardian and believe that your child under 13 has provided personal information to us through our Platform, please contact us immediately at support@substituteteachertraining.com so that we can take appropriate action.

We comply with the Children's Online Privacy Protection Act (COPPA) and will not knowingly request or collect personal information from any person under the age of 13.

15. Email Communications

We may send you email communications in the following categories:

15.1 Transactional Emails

These are emails that are necessary for the operation of our service, including:

• Purchase confirmations and receipts.
• Password reset links.
• Certificate delivery notifications.
• Account security alerts.
• Responses to your support inquiries or contact form submissions.

Transactional emails are essential to your use of the Platform and cannot be opted out of while you maintain an active account. These emails are sent through Resend, our transactional email provider.

15.2 Marketing Emails

If we send marketing or promotional emails (such as information about new courses, special offers, or educational content), you will always have the ability to opt out of receiving such emails. Every marketing email will include a clear and conspicuous unsubscribe link. We will process your unsubscribe request promptly, and in any event within ten (10) business days as required by the CAN-SPAM Act.

15.3 CAN-SPAM Compliance

We comply with the CAN-SPAM Act and ensure that:

• We do not use false or misleading header information or deceptive subject lines.
• We identify marketing messages as advertisements where required.
• We include our physical or mailing address in marketing emails.
• We honor opt-out and unsubscribe requests promptly.
• We monitor the conduct of any third parties who send emails on our behalf.

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make changes, we will update the "Effective Date" at the top of this page.

If we make material changes to this Privacy Policy -- such as changes in how we collect, use, or share your personal information -- we will provide you with prominent notice. This notice may be provided by:

• Sending an email to the email address associated with your account.
• Displaying a prominent notice on our Platform when you next log in.
• Posting the updated policy on this page with a revised effective date.

Your continued use of our Platform after changes to this Privacy Policy take effect constitutes your acceptance of the revised policy. If you do not agree with any changes, you should discontinue use of the Platform and contact us to request deletion of your account.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

17. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Entity: Substitute Teacher Training
• Email: support@substituteteachertraining.com
• Website: substituteteachertraining.com

We will do our best to respond to all inquiries within a reasonable time frame. For privacy rights requests, please see Section 11 for specific response timelines required by applicable law.

Governing Law

This Privacy Policy and any disputes arising from or relating to it shall be governed by and construed in accordance with the laws of the State of Texas, United States, without regard to its conflict of law principles.