Privacy Policy

EAIRI collects account details such as name, email address, organization, role, and authentication identifiers. We also collect assessment responses and scores, training progress, certification exam attempts, certificate records, checkout and subscription references, contact form submissions, and support communications.

We may collect technical information such as device, browser, IP address, referrer, usage events, security logs, and cookie/session identifiers needed to run, secure, improve, and troubleshoot the service.

We use information to provide assessments, training, certification exams, certificates, public credential verification, organization dashboards, billing support, customer support, security monitoring, and service analytics.

We may use aggregated or de-identified information to improve course content, scoring models, user experience, and organizational reporting. We do not use raw assessment answers or exam responses to publicly identify a user.

If you accept a team invitation or hold a team role, authorized owners or managers may see relevant learner identity, assessment summaries, training progress, certification results/status and team access information. Raw quiz/exam responses and answer keys are not included. Team members do not receive owner or manager privileges just by accepting an invitation.

Managers should use this information for training, readiness planning, and credential management, not for unlawful employment, lending, housing, insurance, healthcare, or other regulated decisions.

Public verification pages are designed to show limited credential information: credential ID, recipient name, certificate title, status, issue date, expiration date, and revocation status when applicable.

Verification pages should not expose email addresses, raw assessment answers, raw exam answers, assessment scores, exam scores, payment details, or private organization notes.

Supabase provides database and authentication services, Cloudflare R2 serves public media, Resend delivers transactional emails, Stripe processes payments, and Vercel hosts the website. Providers may process data outside Canada under their own applicable terms and safeguards; sales territory does not guarantee data residency. We do not put learner records, billing documents or support requests in the public media bucket.

Payments are processed by Stripe. EAIRI stores Stripe customer, checkout, subscription, and payment references, but does not store full card numbers.

During signup and password reset, EAIRI checks password safety using Have I Been Pwned's Pwned Passwords service. Only the first five characters of a SHA-1 hash are sent in a padded range query from our server; the password, full hash and your email are not sent to that service. Checks occur on submission, not while you type. EAIRI does not log or retain the password or its screening hash.

We use necessary authentication/session cookies. The service also records first-party usage events, such as assessment completion and checkout starts, for administration and conversion reporting. Support and refund requests are not marketing opt-ins. Google Analytics is not represented as active merely because an integration placeholder exists; any optional analytics deployment must include the notices and consent controls required for its actual configuration.

Do not include passwords, full payment card details, API keys, identity documents, client confidential data or secure exam answers in support forms. We may need to verify your identity before giving access to personal information, changing an account or processing a refund, but will request only information reasonably necessary for that purpose.

We retain account, training, assessment, certification, billing, and security records for as long as needed to provide the service, comply with legal obligations, resolve disputes, prevent abuse, and maintain credential verification.

You may request access, correction, export, or deletion of personal information by contacting EAIRI. Some records may be retained where required for security, fraud prevention, tax, accounting, legal compliance, dispute handling, or credential integrity.

Operational account, assessment and learning records are reviewed for deletion after 24 months without account activity and after paid access ends. Purchase, consent, tax, refund and dispute records are kept for at least six years after the relevant tax year, subject to applicable obligations and documented legal holds. Closed support cases are reviewed after 24 months; raw usage and routine security logs after 90 days. Minimal public credential records are reviewed 24 months after expiry, with any continued verification purpose documented. Requests for deletion are reviewed individually; no promise is made to erase records we must lawfully retain. Database backups are encrypted and access restricted. Backup expiry and deletion-request reapplication are managed separately; a restore must reapply completed erasures before returning to service.

EAIRI uses role-based access controls, row-level security, server-only secret handling, limited public credential fields, and operational safeguards intended to protect user and organization information.

No online service can guarantee absolute security. Users are responsible for protecting their login credentials and promptly reporting suspected unauthorized access.