Privacy Policy

Last Updated: October 18, 2026

1. Information We Collect

Information You Provide

• Account Information: Email address, full name, password (encrypted)
• Payment Information: Processed by Stripe (we never store credit card details)
• Profile Information: Any additional details you choose to provide
• Practice Data: Your answers, scores, progress, and performance statistics
• Feedback: Question flags, error reports, and support messages

Automatically Collected Information

• Usage Data: Pages visited, time spent, features used
• Device Information: Browser type, operating system, IP address
• Analytics: Anonymous usage patterns via PostHog
• Cookies: Authentication tokens, preferences, analytics

2. How We Use Your Information

We use your information to:

• Provide and improve the Service
• Track your progress and generate performance reports
• Process payments and send receipts
• Send course certificates and verification documentation
• Communicate about your account and service updates
• Provide customer support
• Analyze usage patterns to improve content quality
• Prevent fraud and abuse
• Comply with legal obligations

3. Information Sharing

We share your information with:

Service Providers

• Supabase: Database and authentication hosting
• Stripe: Payment processing
• Resend: Email delivery
• PostHog: Anonymous analytics
• Vercel: Application hosting

Legal Requirements

We may disclose information if required by law, court order, or government request, or to protect the rights, property, or safety of Critical Path Academy, our users, or others.

We Do NOT:

• Sell your personal information to third parties
• Share your individual performance data publicly
• Use your data for advertising purposes
• Share your information with PMI unless you explicitly request it

4. Data Retention

• Active Accounts: Data retained while your account is active
• Deleted Accounts: Most data deleted within 30 days
• Legal Retention: Some data (payments, certificates) retained for 7 years for tax/audit purposes
• Anonymized Data: Aggregate analytics may be retained indefinitely

5. Your Rights

You have the right to:

• Access: Request a copy of your personal data
• Correction: Update inaccurate information in your profile
• Deletion: Request deletion of your account and data
• Export: Download your performance data and certificates
• Opt-Out: Unsubscribe from marketing emails (account emails are required)
• Restriction: Request limited processing of your data

To exercise these rights, email us at privacy@criticalpathacademy.com

6. Cookies and Tracking

We use cookies for:

• Essential: Authentication, security, session management (required)
• Analytics: Understanding usage patterns (PostHog)
• Preferences: Remembering your settings

You can control cookies through your browser settings, but some features may not work if cookies are disabled.

7. Security

We implement security measures including:

• Encrypted data transmission (HTTPS/SSL)
• Encrypted password storage
• Secure authentication via Supabase
• Regular security audits
• Access controls and monitoring

However, no system is 100% secure. You are responsible for maintaining the confidentiality of your password.

8. Children's Privacy

Critical Path Academy is not intended for users under 18. We do not knowingly collect information from children. If you are under 18, please obtain parental consent before using the Service.

9. International Users

Critical Path Academy is operated from the United States. If you access the Service from outside the U.S., your information will be transferred to and processed in the United States.

10. California Privacy Rights (CCPA)

California residents have additional rights including:

• Know what personal information is collected
• Know if personal information is sold or disclosed
• Opt-out of sales (we don't sell data)
• Non-discrimination for exercising privacy rights

11. European Users (GDPR)

If you are in the EU/EEA, you have additional rights under GDPR including:

• Lawful basis for processing (legitimate interest, consent, or contract)
• Right to object to processing
• Right to data portability
• Right to lodge a complaint with a supervisory authority

12. Changes to This Policy

We may update this privacy policy from time to time. Material changes will be communicated via email and posted on this page with an updated "Last Updated" date.

13. Contact Us

For privacy questions or to exercise your rights, contact us at:

• Email: privacy@criticalpathacademy.com
• Response Time: Within 30 days