Contractors Classroom Privacy Policy

Version 2026-10-13

Effective date: [EFFECTIVE DATE]

This Privacy Policy explains what personal information Contractors Classroom collects, why we collect it, who we share it with, how long we keep it, and the choices and rights you have. It applies to our website, the classroom, the Application Tool, and the other parts of the Service described in our Terms of Use. It is also our notice at collection: it tells you what we collect at or before the time we collect it.

The short version. The full Policy below controls; this summary is only to help you read it.

We collect what we need to run your account and your course: your name, email, username, a one-way scrambled form of your password, what you bought, your study progress, and technical records (devices, sessions, IP address, browser) that keep the service secure and enforce the Terms.
Your card details go to Stripe, our payment processor. We never see or store your card number.
We do not sell your personal information. We do not share it for cross-context behavioral advertising. We do not run advertising trackers.
California residents can ask to know, delete, or correct their information, and we will not treat you worse for asking. Email support@contractorsclassroom.com.
The free trial classrooms do not need an account, and we do not ask for your name or email to use them.

1. Who We Are and What This Policy Covers

1.1 Who we are. "Contractors Classroom," "we," "us," and "our" mean [LEGAL ENTITY NAME], doing business as Contractors Classroom, [BUSINESS MAILING ADDRESS]. For the personal information described here, we decide why and how it is used (in privacy-law terms, we are the "business" or "controller").

1.2 What this covers. This Policy covers personal information we collect through the website (contractorsclassroom.com and its Spanish pages), the classroom interface, the Application Tool, the free trial classrooms, our emails, and our support email. It does not cover other websites we link to, such as the California Contractors State License Board (CSLB), or the payment page run by Stripe. Those have their own policies.

1.3 California privacy laws. The California Consumer Privacy Act as amended by the California Privacy Rights Act (the "CCPA," Cal. Civ. Code § 1798.100 and following) applies only to businesses that meet certain size or data thresholds, and we may not meet them. We give California residents the rights in Section 10 whether or not the CCPA applies to us. This Policy is also written to meet the California Online Privacy Protection Act (Cal. Bus. & Prof. Code § 22575 and following).

2. Information We Collect and Why

We collect the following. For each group we say where it comes from and why we need it.

2.1 Information you give us.

Your name and email address when you buy, and the username and account we create from them. You may also give us updated details if you ask us to correct them.
Your password. We never store it. We store only a one-way scrambled version of it (an scrypt hash with a random salt) that cannot be turned back into your password.
What you type into the Application Tool: your application preparation answers for the trade you bought. Please do not enter your Social Security number, tax ID number, driver's license number, bank or card numbers, or date of birth. The Application Tool is designed so that you do not need them, and we remove fields we recognize as a Social Security or tax ID number before saving, but we cannot guarantee that something typed into a free-text box is never saved.
Messages you send us (for example to support@contractorsclassroom.com), and anything in them.

Why: to create and run your account, give you the course you bought, answer you, and keep the Application Tool progress you ask us to save.

2.2 Purchase information. When you buy, you are sent to a payment page run by Stripe. You give Stripe your card details, billing details, and anything else its page asks for. Stripe tells us that the payment succeeded, failed, or was refunded, and sends us your name and email, the trade you bought, and a payment reference number. What we store: your name, email, the trade, the payment reference number, the dates access starts and ends, and the status of the purchase. What we do not store: your card number, card security code, or bank details. We pass Stripe only your name, email address, the product, and our internal order details (the trade and access period) so that your purchase can be matched to your account.

Why: to take payment, give you access, handle refunds and disputes, keep tax and business records, and prevent fraud.

2.3 Account, device, and security records. While you use the classroom we create and keep these technical records:

Login sessions: a one-way hash of your session token, the time created and last used, when it expires, your browser's user-agent text, and a one-way hash of your IP address.
Registered devices: each Account may register up to three devices. For each one we keep a random device ID, a hash of a secret that device holds, a device name, and the times it was registered and last used.
The active-device record: which one registered device is currently using the classroom, with a short expiry that is refreshed while the classroom is open. This is how we enforce one active device at a time.
Login-attempt limiting: a one-way hash that combines a hash of your IP address with the username or email typed, a count of failed attempts, and the times, so that guessing passwords is slowed down. These records expire on their own.
Password setup and reset links: a one-way hash of the link, who it is for, and when it expires and was used.
Your Terms of Use acceptance record: your name, email, username, the version and fingerprint (hash) of the Terms you accepted, the date and time, your full IP address, and your browser's user-agent text (see Section 16 of the Terms).
Account status records, including a ban or removal flag and a record of any action an administrator takes on your Account, and a list of email addresses that are not allowed to buy.

Why: to log you in, keep your account and the course content safe, enforce the one-active-device rule and the Terms, detect account sharing, scraping, and copying, prevent fraud and abuse, prove that you accepted the Terms, and meet legal duties. These records are not used for advertising.

2.4 Study information. We keep your progress in the classroom so you can continue on any registered device: which sections and categories you have finished and when, scores and counts, which questions you missed, weak topics, flashcard review progress, and similar resume points. We keep the access you bought (trade, start date, end date). We also keep the language you picked and display settings in your browser (see Section 4).

Why: to give you your progress, Resume, Missed Questions, and flashcards, and to show you which topics to review.

2.5 Website analytics (Google tag), if turned on. Our public pages and some signed-in website pages (but not the classroom page itself) can load the Google tag (Google Analytics) to count visits and the actions people take, such as which page was opened and whether a demo video was played. When it is on, Google may receive your IP address, browser and device type, the page address (without any query string on signed-in pages) and page title, and the time, and may set its own cookies in your browser. It is off if the setting for it is empty. It is not loaded at all when your browser sends a Global Privacy Control or Do Not Track signal (Section 11).

Why: to understand which pages are useful and to improve the website.

2.6 Server logs. Our servers and our hosting company keep ordinary technical logs of requests: your IP address, the time, the page or file requested, your browser's user-agent text, and the response code. Error logs can include the technical details of a failed request.

Why: security, troubleshooting, and keeping the service running.

2.7 Voice features. The classroom's optional interactive voice features use your browser's built-in speech recognition and speech output if you turn them on and allow your microphone. Depending on your browser, the speech may be processed by the browser maker (for example, Chrome sends it to Google). We do not receive, record, or store your voice or the audio. If you use hosted read-aloud voices, our server sends the study text to be read aloud (not your name or email) to a text-to-speech service (Section 5.2) and returns the audio to you.

2.8 Free trials and public pages. You do not need an account for the free trial classrooms or the public pages, and we do not ask for your name or email for them. The trial classroom keeps its settings and your practice progress in your own browser storage on your device, not on our servers. Our server and hosting company still see the technical request data in Section 2.6, and the trial pages load a few code files from a content delivery network (Section 5.2).

2.9 What we do not collect. We do not collect your card number, your Social Security number, your precise location, or recordings of your screen, keystrokes, or microphone. We do not buy personal information about you from data brokers. We do not build advertising profiles.

2.10 Information from others. We receive payment status, your name, and your email from Stripe. If a card network, bank, or Stripe notifies us of a dispute, refund, or chargeback, we receive information about it.

3. How We Use Personal Information

We use personal information to: provide, secure, and support the Service; set up your account and send you the emails described in Section 3.1; take payments and handle refunds; give you your progress and course access; enforce the one-active-device rule, the Terms, and our other rules (including detecting copying and account sharing); detect and respond to fraud, security incidents, and abuse; understand and improve the website; comply with the law and respond to legal requests; and protect our rights, including in disputes.

3.1 Emails we send. We send transactional emails only: the welcome email with a link to set your password after you buy, password reset emails when you ask for one, and notices about your account, your purchase, or changes to our Terms and policies. We do not send marketing email unless you separately ask for it.

We do not use personal information for automated decisions that have legal or similarly significant effects on you, we do not use it to train artificial-intelligence models, and we do not use sensitive personal information to infer characteristics about you.

4. Cookies and Similar Technologies

4.1 What they are. Cookies are small text files a website places in your browser. Browser storage ("local storage") is similar and is kept on your device. We use them as follows.

4.2 What we use.

cc_session (cookie, required): keeps you logged in. It is marked HttpOnly (page scripts cannot read it) and, on the live site, Secure. It lasts for the login session, normally 8 hours, or up to 30 days if you choose to stay logged in. We store only a hash of its value on our side.
cc_device_id and cc_device_proof (cookies, required): identify and prove which registered device you are using for the one-active-device rule. HttpOnly, Secure on the live site, SameSite Strict, about one year.
cc_locale (cookie, preference): remembers whether you chose English or Spanish. About one year.
Browser local storage (preference, on your device): classroom display and voice settings, theme, whether you have seen the welcome tour, the device ID and secret for the device you registered, saved progress for the free trial classrooms, and tool settings you choose to save on the Business Center pages.
Google tag cookies (analytics, only if Section 2.5 is turned on and your browser is not sending an opt-out signal): Google sets its own cookies to tell visits apart (for example names beginning with _ga).

We do not use advertising cookies, social media tracking pixels, or cross-site tracking cookies.

4.3 Your choices. You can block or delete cookies and local storage in your browser settings. If you block the required cookies, you cannot log in to the classroom. You can use a browser or extension that sends the Global Privacy Control signal (Section 11).

5. Who We Share Personal Information With

5.1 We do not sell personal information, and we do not share it for cross-context behavioral advertising (see Section 6). We share it only as follows.

5.2 Service providers (companies that process information for us under their own terms).

Stripe, Inc.: payment processing and the payment page. Stripe receives your payment details and the name, email, and order details above and handles them under its own privacy policy at https://stripe.com/privacy.
[HOSTING PROVIDER]: hosts the website and the application, and keeps ordinary request logs.
[DATABASE PROVIDER]: stores the account, purchase, device, progress, and security records described in Section 2.
[EMAIL DELIVERY PROVIDER]: sends our transactional emails (your email address, name, and the message, including password setup and reset links).
Google LLC (Google Analytics / Google tag): website analytics, only if turned on (Section 2.5).
Google LLC (Gemini API text-to-speech): read-aloud voices only, if enabled (Section 2.7). Receives the study text to be read aloud.
Google Fonts (Google LLC): the font files on some website pages are loaded from Google, which therefore receives your IP address and browser details.
jsDelivr (content delivery network): the classroom and trial pages load two code libraries (a guided-tour tool and a PDF tool used by the Application Tool) from jsDelivr, which therefore receives your IP address and browser details.

5.3 Other disclosures. We may disclose information (a) when the law requires it, such as to answer a subpoena or court order; (b) to protect the safety, rights, or property of you, us, or others, including to a payment processor or card network with records that show a purchase was authorized and the product was delivered when a payment is disputed; (c) to a rights holder or law enforcement when we reasonably believe the Content or the Service is being copied, shared, or attacked; (d) in a sale, merger, financing, or transfer of our business, with the information continuing to be protected by this Policy or a policy at least as protective; and (e) with your direction or consent.

5.4 What we have disclosed. In the 12 months before the effective date, we disclosed identifiers, customer records, commercial information, internet and device activity, and study information for business purposes to the service providers in Section 5.2. We did not sell or share any personal information.

6. We Do Not Sell or Share Your Personal Information (Do Not Sell or Share)

We do not sell your personal information for money or other valuable consideration, and we do not share it with third parties for cross-context behavioral advertising. We have not done so in the past 12 months. Because we do not sell or share personal information, there is nothing for you to opt out of, and we do not have a "Do Not Sell or Share My Personal Information" button to click. If that ever changes, we will update this Policy first and give you a working opt-out link before any sale or sharing begins.

We do not knowingly sell or share the personal information of anyone under 16 years old. We do not offer any financial incentive or price difference in exchange for personal information.

7. How Long We Keep Personal Information

Login sessions: until they expire (normally 8 hours, up to 30 days if you chose to stay logged in) or you log out. Expired sessions are deleted automatically.
Active-device records: expire a few minutes after the classroom is closed and are deleted automatically.
Login-attempt limiter records and password setup or reset links: expire on their own, within minutes to days. Reset links last 2 hours and setup links 7 days.
Account, purchase, access, and device records: while your account exists and for [RETENTION PERIOD] after your access ends, so we can handle refunds, disputes, tax and business records, and returning students.
Study progress and Application Tool entries: while your account exists, and afterward for the same period unless you ask us to delete them sooner (Section 10).
Terms acceptance records, purchase and payment records, ban and enforcement records: for as long as we need them to show what you agreed to, handle disputes and legal claims, enforce our rights, and meet legal and tax duties. These records are not deleted when your access ends.
Server and hosting logs: for the period our hosting company keeps them, normally [LOG RETENTION PERIOD].
Email and support messages: for as long as needed to answer you and for our records.

When we no longer need information, we delete it or remove what identifies you.

8. Security

We use reasonable measures to protect personal information, including: storing passwords, session tokens, device secrets, and link tokens only as one-way hashes; encrypted connections (HTTPS) for the live site and Secure cookies; HttpOnly cookies; access limits so that only signed-in, accepted-terms, entitled accounts on an active registered device can load paid content; limiting repeated failed logins; and limiting who on our side can see account records. We keep card data off our systems by using Stripe.

No website or storage system is completely secure, and we cannot guarantee absolute security. Please choose a strong, unique password and do not share it. If a breach of your personal information occurs, we will notify you and the authorities as the law requires (see Cal. Civ. Code §§ 1798.82 and 1798.81.5).

9. Children

The Service is for adults who are at least 18 years old (see Section 1.4 of the Terms). It is not directed to children, and we do not knowingly collect personal information from anyone under 18. We do not knowingly sell or share the personal information of anyone under 16. If you believe a child has given us personal information, email support@contractorsclassroom.com and we will delete it.

10. Your California Privacy Rights

If you are a California resident, you have the following rights. We provide them to California residents whether or not the CCPA legally applies to us (Section 1.3).

Right to know. To ask what personal information we collected about you in the past 12 months (and, for information collected on or after January 1, 2022, longer, unless doing so is impossible or takes disproportionate effort): the categories and the specific pieces, where we got it, why we collected it, and the categories of companies we disclosed it to.
Right to delete. To ask us to delete personal information we collected from you, with the exceptions the law allows (for example, to complete a transaction, keep the records we need to detect security incidents or fraud, comply with legal obligations, defend legal claims, or exercise our rights under our Terms). If we keep something, we will tell you what and why.
Right to correct. To ask us to correct inaccurate personal information we hold about you.
Right to opt out of sale or sharing. We do not sell or share personal information (Section 6), so there is nothing to opt out of.
Right to limit use of sensitive personal information. The only sensitive personal information we hold is your account log-in with password (stored only as a one-way hash). We use it only to log you in and secure your account, which the law treats as outside this right, so there is nothing to limit.
Right to non-discrimination. We will not deny you the Service, charge you a different price, or give you a lower level of service because you used these rights.

How to submit a request. Email support@contractorsclassroom.com with the subject "Privacy Request" and tell us which right you want to use. You can also write to [LEGAL ENTITY NAME], [BUSINESS MAILING ADDRESS]. Because we run entirely online, an email address is our method for requests. We cannot take requests only by social media.

How we verify you. To protect your account, we must confirm that you are the person the information is about. We will match your request to the email address on your account and send a confirmation to that address, and we may ask you to log in or to confirm details we already hold (such as the trade you bought and the approximate date). We will not ask for your Social Security number or card number. If we cannot verify you, we will tell you and explain what we need.

Authorized agent. You may use an authorized agent. We will need your signed written permission for the agent (or a power of attorney) and we may contact you directly to confirm it and to verify your identity.

When we respond. We will confirm that we received your request within 10 business days and will respond within 45 days of receiving it. If we need more time we may extend by up to 45 more days, and we will tell you why. There is no fee, unless a request is clearly unfounded or excessive, in which case we will explain before charging or declining. You can make a request to know twice in any 12-month period. If we deny a request, we will tell you why. You may also contact the California Privacy Protection Agency (cppa.ca.gov) or the California Attorney General (oag.ca.gov) with a complaint.

Categories of personal information (CCPA). In the last 12 months we collected these categories, from the sources and for the purposes in Section 2, and disclosed them to the service providers in Section 5.2 for business purposes only:

Identifiers (name, email, username, IP address, device identifiers) and customer records.
Commercial information (what you bought, payment status and reference).
Internet or other electronic network activity (sessions, user-agent, usage and study activity, and analytics if turned on).
Inferences drawn from your study activity (for example, topics you may want to review), shown back to you.
Sensitive personal information: account log-in with password (as a one-way hash).

We did not collect biometric information, precise geolocation, or audio, electronic, or visual recordings, and we did not collect protected-class or professional or employment information except what you choose to type into the Application Tool.

Shine the Light. California Civil Code § 1798.83 lets California residents ask which categories of personal information a business shared with third parties for the third parties' own direct marketing. We do not share personal information for that purpose.

11. Global Privacy Control and Do Not Track

We recognize the Global Privacy Control (GPC) and Do Not Track (DNT) browser signals. Because we do not sell or share personal information, a GPC signal has nothing to opt you out of, but we treat it as a valid opt-out request anyway: when your browser sends GPC or DNT, our website does not load the Google tag or any other analytics script. We do not track you across other websites, and we do not allow third-party advertising networks to collect information about your browsing on our site. Some of our service providers (Section 5.2) receive your IP address when your browser loads their files (for example, fonts); we cannot stop that using these signals alone.

12. Links to Other Sites

The Service links to other websites, such as the CSLB and other government sites, and sends you to Stripe to pay. We do not control them and are not responsible for their privacy practices.

13. Changes to This Policy

We may update this Policy. Each version has a version number and effective date at the top. If we make a material change, we will tell you by email or by a notice in the Service before it takes effect, and if the change affects what we collect or how we use it, we will ask for any consent the law requires. The previous version stays available on request. Your continued use after the effective date means you accept the updated Policy for information collected afterward.

14. Contact

Questions, privacy requests, and complaints: support@contractorsclassroom.com, or write to [LEGAL ENTITY NAME], [BUSINESS MAILING ADDRESS]. Please put "Privacy Request" in the subject line.