Privacy policy

Information we handle

• Learner and enrollment details: the student's name, email address, U.S. certificate-mailing confirmation, enrollment status and purchase date. The student can be a different person from the cardholder or mailing recipient.
• Learning records: quiz and exam attempts, scores, pass status, module progress and completion dates. These records support saved progress and the personal completion record.
• Certificate details: the mailing recipient's name and postal address, including any corrections you save. Course completion and address notices can contain these details.
• Payment references: Stripe customer, Checkout Session and event identifiers, payment confirmation and related purchase records. Card details are entered on Stripe's hosted checkout; the course application's database does not store full payment-card numbers or security codes.
• Account and technical information: sign-in and session records, request information handled by the hosting service, and diagnostics associated with account, payment or email operations. Sign-in tokens and session identifiers are stored as hashes in the course database.
• Correspondence: information you include when contacting us about access, corrections, certificate delivery, refunds or other support.

The course does not ask you to upload SSNs, ITINs, tax returns or identity-document images. Do not include them in an ordinary course-support email. The application practice kit is a set of study tools; it does not submit your worksheets or an application to the IRS.

Why we use it

We use this information to establish the correct student's enrollment, confirm payment, provide email sign-in, save learning progress, grade assessments, verify completion, prepare and mail certificates, correct mailing details and respond to support or refund requests. Account and transaction records also help prevent duplicate enrollment, investigate errors or misuse, resolve payment disputes and meet applicable recordkeeping obligations.

Service providers and disclosures

The course uses these services for its operation:

• Cloudflare: website hosting, request handling and the D1 database containing course account and learning records. Cloudflare privacy policy.
• Stripe: hosted checkout and payment processing. We send the learner's name and email with course metadata to connect the payment to the intended student. Stripe handles the payment and billing information entered on its checkout. Stripe privacy policy.
• Resend: delivery of account, sign-in, course-completion and certificate-address emails. This involves recipient addresses and the information contained in those messages. Resend privacy policy.

Related correspondence is also handled through our business email service. Preparing and delivering physical certificates requires the recipient's name and postal address for printing, addressing and carrier delivery. Information may also need to be disclosed to address a payment dispute or comply with applicable law or a valid legal request.

These providers' own policies explain their processing, including technical information collected when their services are used. Following a link to an official source or another website takes you to that site's own privacy practices.

Cookies, local storage and tracking

The course sets a first-party cookie named session to keep you signed in. Its maximum age is 30 days; signing out clears it and ends that session. Blocking the cookie prevents the signed-in course from working. You can clear cookies through your browser settings.

The signed-out Module 1 practice feature can use browser local storage named caa-progress to remember practice progress on that device. It is separate from an enrolled student's saved account record. Clearing browser storage removes that local practice state.

The course application does not include advertising pixels or cross-site advertising analytics. It does not change its own cookie or practice-storage behavior in response to a browser's Do Not Track signal. Other companies may collect technical or activity information when their services are used. Stripe's privacy policy describes collection of device and usage information across its services and third-party websites, including for fraud prevention. See the Stripe privacy policy and Stripe cookie policy for its practices and choices when using its separate hosted checkout.

Retention

Course access has no fixed expiration under the current offer. We retain information as needed to provide that access, preserve learning and completion records, fulfill or replace certificates, handle support and payment disputes, and meet applicable legal obligations. We have not set one fixed deletion period for all course records.

Sign-in links expire after 30 minutes and sessions after up to 30 days. Those access limits do not automatically erase enrollment, payment, completion, correspondence or service-provider records. Copies held in email, transaction systems or backups may have different retention needs.

Corrections, deletion requests and contact

You can review saved course progress and update the certificate mailing address on your signed-in dashboard. For a learner-name or email correction, an information-access question or a deletion request, contact us using the details below. We may need to verify account ownership before changing or releasing account information.

Requests are handled manually. We assess them under applicable law and whether particular records are still needed for transactions, completion verification or another purpose described above. A deletion request does not itself erase all records or change a provider's independent legal obligations. Removing information needed for your account can affect continued access, progress or certificate verification; contact us to discuss the records involved.

Policy changes

We will post a revised policy here with its effective date and describe material changes on this page. The date above identifies the version in effect. Review this page when you want to check the course's current information practices.