Privacy Policy

1. Information We Collect

We collect information in the following ways.

Information You Provide

Depending on how you use GRC Professor, you may provide:

• Your name and email address.
• Your password or information used to sign in through Google, Microsoft, or another sign-in provider.
• Billing, subscription, and transaction information.
• Communications you send to us, including support requests.
• Questions, prompts, and other information you submit to the AI Professor.
• Quiz answers, scenario responses, course progress, and other learning activity.
• Information associated with badges, certificates, and other credentials you earn.

Please do not submit highly sensitive personal information, confidential business information, trade secrets, health information, financial account information, or information about another person through the AI Professor.

Payment Information

Payments are processed by a third-party payment processor. We receive information such as your subscription status, payment status, transaction amount, and billing history.

We do not intend to directly collect or store complete payment card numbers or card security codes.

Information Collected Automatically

When you use GRC Professor, we and our service providers may automatically collect:

• IP address.
• Browser and device type.
• Operating system.
• Pages and features used.
• Login dates and times.
• Referring pages.
• Approximate location based on IP address.
• Cookie identifiers and similar technical information.
• Information about errors, performance, and security events.

We may use cookies and similar technologies to keep you signed in, remember preferences, understand how the service is used, and maintain security.

2. How We Use Information

We use personal information to:

• Create and manage your account.
• Authenticate users and prevent unauthorized access.
• Provide courses, quizzes, scenarios, credentials, and other learning features.
• Track course progress and completed learning activities.
• Process subscriptions and payments.
• Provide responses through the AI Professor.
• Maintain, troubleshoot, secure, and improve the service.
• Respond to support requests and other communications.
• Send service-related notices, such as account, billing, or security messages.
• Send promotional communications where permitted by law.
• Detect fraud, abuse, and violations of our Terms of Service.
• Comply with legal, tax, accounting, and regulatory obligations.
• Create aggregated or de-identified information that does not reasonably identify an individual.

We may review a limited number of AI Professor interactions when reasonably necessary to investigate a problem, prevent abuse, improve response quality, or protect the service.

3. AI Professor Information

When you use the AI Professor, your questions, prompts, and related context must be processed to generate a response.

We may use third-party artificial intelligence and technology providers to help provide this feature. Those providers may process your information on our behalf in accordance with their agreements with us.

The AI Professor is intended for education and general informational purposes. You should not include personal, confidential, regulated, or sensitive information in your questions.

AI Professor interactions may be retained for account history, security, troubleshooting, quality improvement, and the other purposes described in this Privacy Policy.

4. How We Disclose Information

We may disclose personal information to the following categories of recipients.

Service Providers

We use service providers to help us operate GRC Professor. These may include providers of:

• Website and application hosting.
• Cloud storage and databases.
• Account authentication.
• Payment processing.
• Artificial intelligence services.
• Email delivery.
• Customer support.
• Analytics and performance monitoring.
• Security and fraud prevention.

These providers may access information only as reasonably necessary to perform services for us, subject to applicable agreements and legal requirements.

Organization-Sponsored Accounts

If an employer, school, association, or other organization provides or pays for your account, that organization may receive information about your:

• Account and enrollment status.
• Subscription or access status.
• Course progress.
• Course completion.
• Earned credentials.

Any broader sharing with an organization sponsor will be described at enrollment or when the applicable feature is used.

Public Credentials

Some badges, certificates, or credentials may have a publicly accessible verification page. A verification page may display information such as your name, the credential earned, the date issued, and a credential identifier.

Public credential pages may be accessible to anyone with the link and may be shared on services such as LinkedIn. Contact us if you would like a public credential page deactivated or corrected.

Legal and Safety Reasons

We may disclose information when we reasonably believe disclosure is necessary to:

• Comply with a law, court order, subpoena, or other legal process.
• Respond to lawful requests from government authorities.
• Protect the rights, safety, or property of our users, the public, or GRC Professor.
• Investigate fraud, abuse, security incidents, or violations of our Terms of Service.
• Establish, exercise, or defend legal claims.

Business Changes

If GRC Professor is involved in a merger, acquisition, financing, reorganization, sale of assets, or similar business transaction, information may be disclosed or transferred as part of that transaction.

With Your Direction

We may disclose information when you ask us to do so or give us permission.

5. Selling and Advertising

We do not sell personal information for money.

We do not use personal information for cross-context behavioral advertising or targeted advertising based on activity across unrelated websites or services.

We may use basic analytics to understand use of GRC Professor and improve the service.

6. Cookies and Analytics

We may use the following types of cookies and similar technologies:

Essential cookies are necessary for login, security, account management, payments, and core application functions.

Preference cookies remember settings and choices.

Analytics cookies help us understand traffic, feature use, errors, and application performance.

You can control cookies through your browser settings. Blocking essential cookies may prevent parts of GRC Professor from working properly.

Where required by applicable law, we will request consent before using non-essential cookies or similar technologies.

7. Communications

We may send transactional communications about your account, subscription, payments, credentials, security, or changes to the service.

We may also send educational or promotional communications. You can unsubscribe from promotional emails by using the unsubscribe link in the email or contacting us.

Unsubscribing from promotional emails will not stop necessary account, billing, security, or service communications.

8. Data Retention

We retain personal information for as long as reasonably necessary to:

• Provide and maintain your account.
• Complete transactions.
• Maintain course progress and credential records.
• Respond to support requests.
• Protect the security and integrity of the service.
• Comply with legal, tax, accounting, and contractual obligations.
• Resolve disputes and enforce agreements.

When information is no longer reasonably needed, we may delete or de-identify it.

Some information may remain temporarily in backups or security logs. We may also retain limited records after an account is deleted when required by law or reasonably necessary to document transactions, prevent fraud, resolve disputes, or enforce our agreements.

9. Your Privacy Choices and Rights

Depending on where you live and subject to applicable law, you may have the right to:

• Request access to personal information we maintain about you.
• Request correction of inaccurate information.
• Request deletion of personal information.
• Obtain a portable copy of certain information.
• Object to or restrict certain uses of information.
• Withdraw consent where processing is based on consent.
• Opt out of promotional emails.
• Appeal a decision regarding a privacy request, where applicable.
• Submit a complaint to an applicable data protection authority.

To submit a request, email support@grcprofessor.com.

We may need to verify your identity before completing a request. We may deny or limit a request where permitted by law, including when information must be retained for legal, security, fraud-prevention, or transaction-record purposes.

You may also use an authorized agent where permitted by applicable law. We may request evidence that the agent is authorized to act for you.

We will not unlawfully discriminate against you for exercising an applicable privacy right.

10. Legal Bases for European and UK Users

If the European Economic Area or United Kingdom data protection laws apply, we generally process personal information under the following legal bases:

Performance of a contract: To create your account, provide courses and AI Professor features, process subscriptions, maintain progress, and issue credentials.

Legitimate interests: To secure and improve the service, prevent fraud, provide support, understand service use, and operate our business.

Consent: Where we request consent for non-essential cookies, certain communications, or another specific purpose.

Legal obligations: To comply with applicable tax, accounting, regulatory, and legal requirements.

You may contact us for additional information regarding the legal basis applicable to a particular activity.

11. International Data Transfers

GRC Professor is operated from the United States. If you access the service from another country, your information may be transferred to and processed in the United States or other countries where our service providers operate.

Privacy laws in those countries may differ from the laws where you live. Where required by applicable law, we use appropriate safeguards for international transfers of personal information.

12. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information.

However, no website, application, database, or transmission method is completely secure. We cannot guarantee that information will never be accessed, disclosed, altered, lost, or destroyed without authorization.

You are responsible for maintaining the confidentiality of your password and for notifying us if you believe your account has been compromised.

13. Children’s Privacy

GRC Professor is designed for professional and educational use and is not directed to children under 13.

We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided personal information to us, contact support@grcprofessor.com, and we will take appropriate steps to delete it.

Users who are under the age of legal majority where they live should use the service only with the involvement and permission of a parent or legal guardian.

14. Third-Party Services and Links

GRC Professor may contain links to other websites or services, including social media platforms.

This Privacy Policy does not apply to third-party services. Their collection and use of information are governed by their own privacy policies and terms.

15. Changes to This Policy

We may update this Privacy Policy as GRC Professor changes or as legal requirements evolve.

When we make changes, we will update the “Last Updated” date. If a change materially affects how we use personal information, we may provide additional notice through the service or by email.

Your continued use of GRC Professor after an updated policy becomes effective is subject to the updated policy.

16. Contact Us

Questions, requests, or concerns about this Privacy Policy may be sent to: