Privacy Policy

    Last updated: July 8, 2026

    This Privacy Policy explains how cprclasses.xyz (the “Service”), operated by Juan Tristan (“we”, “us”), collects, uses, and protects personal information about students, instructors, and organizations who use the site. This page is maintained by the site operator to answer common privacy questions; it is not an independent certification.

    1. Information we collect

    • Account information: name, email, phone, and password when you sign up.
    • Profile information: address, city, state, ZIP, company/organization (optional).
    • Class activity: classes you book, attendance, scores, certifications issued to you.
    • Payment information: handled by Stripe; card details are never stored by us.
    • Technical information: IP address and browser type recorded by our hosting layer for security and abuse prevention.

    2. How we use it

    • To create and secure your account and log you in.
    • To match you with nearby classes and let you book seats.
    • To deliver transactional email (booking confirmations, reminders, certificates, password resets).
    • To let instructors and organizations manage the classes you enroll in.
    • To meet legal and accounting obligations (payment records, certification history).

    We do not sell personal information. We do not use your data for advertising and we do not run advertising SDKs on the site.

    3. Who we share it with (subprocessors)

    • Lovable Cloud / Supabase (AWS) — hosting, database, authentication, storage.
    • Stripe — payment processing and subscription billing.
    • Resend — transactional email delivery.
    • Google — optional federated sign-in.
    • OpenStreetMap / Nominatim — address geocoding for search.

    Each vendor is contractually bound by their own Data Processing Agreement.

    4. Cookies and analytics

    We use only the cookies required to keep you logged in. We do not run third-party analytics, session-replay tools, or advertising trackers. If that changes in the future, we will update this policy and add a consent banner where required.

    5. Data retention

    We retain your account information for as long as your account is active. If you ask us to delete your account, we remove your personal information within 30 days, except records we are required to keep for legal, tax, or certification-audit purposes (typically payment records and issued-certificate history).

    6. Your rights

    Depending on where you live (including under California CCPA/CPRA, Colorado, Virginia, and other US state laws), you may have the right to access, correct, delete, or export your personal information, and to opt out of any sale or sharing. To exercise these rights, email privacy@cprclasses.xyz. We will respond within 45 days.

    7. Security

    Data is encrypted at rest by the hosting platform and in transit via HTTPS/TLS. Access to production is limited to the operator and protected by two-factor authentication. To report a security vulnerability, see security.txt or email security@cprclasses.xyz.

    8. Children

    The Service is not intended for children under 13, and we do not knowingly collect personal information from them.

    9. Changes to this policy

    We will post material changes on this page and update the “Last updated” date above.

    10. Contact

    Questions: privacy@cprclasses.xyz.