Privacy Policy

This Privacy Policy explains how FosterTRAIN collects, uses, discloses, and retains personal information when you visit our public website, use the FosterTRAIN platform, or communicate with us.

For agency and administrator accounts, the Customer is the data controller (the "business" under California law) and determines why learner and staff data is collected and how long it is kept. FosterTRAIN acts as a service provider (a "processor"): we process that data only to deliver the Service, on the Customer's documented instructions, and we do not use it for our own purposes.

For our own website visitors, prospects, and account holders, FosterTRAIN acts as the controller of the contact and account information we collect directly.

If your information was entered by an agency, trainer, or administrator, please direct access, correction, and deletion requests to that organization first. We will assist them in fulfilling your request.

• Identifiers: name, email address, phone number, account identifiers, IP address, and device or browser identifiers.
• Professional and Organizational Information: job title, role in an agency or administrator organization, employer or agency affiliation, trainer credentials, license number and issuing state, areas of expertise, and biography content.
• Training Records: registration, attendance, completion, evaluation responses, certificates, and credit or billing references.
• Commercial Information: subscription plan, billing status, invoice and payment references. Card numbers are handled by our payment processor and are not stored on our systems.
• Internet or network activity: pages viewed, actions taken in the application, session timestamps, approximate location derived from IP, and security event logs such as login attempts.
• Communications: messages, emails, support tickets, call notes, and attachments exchanged through or about the Service.
• Inferences: limited inferences drawn from the above, such as engagement or training-compliance status, used for administration and reporting.

We do not knowingly collect biometric identifiers, precise geolocation, or government identification numbers through the public website. Where a Customer chooses to store tax or identity documents for trainer or vendor records, those are stored on the Customer's instruction in a restricted, encrypted-at-rest area of the platform.

When we act as a service provider, we use sensitive personal information only to provide the Service, and never to infer characteristics about a person beyond what the Service needs to operate, never to advertise, and never to train general-purpose AI models.

Access to learner-level records is restricted to the Customer's authorized staff through role-based permissions and row-level security. Sensitive records are not included in public pages, public search results, or public sitemaps.

We do not knowingly collect information about a child's case. Learners and training participants are adults; if a Customer enters information about a minor, the Customer is responsible for having a lawful basis and the appropriate consents.

• From You: when you register, complete an intake or profile form, register for a training, submit an evaluation, contact support, or subscribe to updates.
• From Your Organization: when an agency, administrator, or trainer adds you as a participant or staff member.
• Automatically: through server and application logs when you use the Service.
• From Service Providers: email delivery, payment, and security providers that return delivery, billing, or fraud-prevention signals.

• Create and administer accounts and authenticate users.
• Provide Core Functionality: training listings, registration, attendance, evaluations, certificates, billing support, and reporting.
• Send operational messages such as invitations, password resets, confirmations, reminders, and security notices.
• Provide customer support and respond to requests or concerns.
• Maintain security, detect abuse, rate-limit automated traffic, and investigate incidents.
• Improve reliability and usability using aggregated or de-identified usage information.
• Meet legal, tax, accounting, and audit obligations.
• Send marketing communications where permitted, with an unsubscribe link in every message.

We do not use personal information for automated decision-making that produces legal or similarly significant effects about an individual.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We do not run third-party advertising pixels on authenticated areas of the Service, and we do not use learner or training records to build advertising audiences.

Because we do not sell or share personal information in those senses, there is no "Do Not Sell or Share My Personal Information" opt-out to exercise, but you may still submit a request and we will confirm the status of your data.

We disclose personal information only in the following circumstances:

• To Your Organization: agency, administrator, and trainer staff see the training and participant records they are entitled to administer.
• To Service Providers: hosting, database, storage, email delivery, payment processing, error monitoring, and AI-assisted features, each under contract and limited to the purpose of the engagement.
• For Legal Reasons: to comply with a valid legal request, enforce our Terms, or protect the rights, safety, and security of users or the public.
• In a Business Transaction: in connection with a merger, acquisition, financing, or sale of assets, subject to continued confidentiality protection.
• With Your Direction: when you ask us to share information with a third party.

Public trainer profiles can be published on the Customer's or trainer's instruction. Those profiles show professional information only (name, credentials, expertise, and the contact details the trainer chooses to publish) and never learner records.

We retain personal information only as long as necessary for the purposes described above, and in line with the Customer's instructions where we are a service provider.

• Account and Profile Data: for the life of the account, then deleted or de-identified after a wind-down period following cancellation, unless the Customer requests earlier deletion or law requires longer retention.
• Training and Attendance Records: retained for the period configured by the Customer, or as needed to support audit, licensing, or Title IV-E documentation obligations. Industry practice is a multi-year period because funding and licensing reviews can reach back several years.
• Downloadable Backups: automatically purged seven (7) days after creation.
• Deleted Communications: recoverable from Trash for thirty (30) days, then purged, unless placed on legal hold.
• Security and Authentication Logs: retained for a limited period for fraud prevention and incident investigation, then aggregated or deleted.
• Billing and Tax Records: retained as required by applicable financial recordkeeping law.

When retention ends, records are deleted or de-identified. Residual copies may persist in encrypted backups for a short period before rotation.

We use administrative, technical, and physical safeguards designed to protect personal information, including encrypted transport, encrypted storage of credentials and sensitive documents, role-based access control, row-level data isolation between organizations, session timeouts, and security event logging.

No method of transmission or storage is perfectly secure. If we become aware of a breach involving personal information, we will notify affected Customers and, where required, individuals and regulators, in accordance with applicable law.

If you are a California resident, you have the right to:

• Know the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of recipients.
• Delete personal information we collected from you, subject to legal exceptions such as records we must keep for tax, audit, or defense of legal claims.
• Correct inaccurate personal information we maintain about you.
• Opt out of the sale or sharing of personal information. We do neither, as described above.
• Limit the use and disclosure of sensitive personal information to the purposes permitted by law. We already limit our use of sensitive information accordingly.
• Non-discrimination: we will not deny service, charge a different price, or provide a different level of service because you exercised a privacy right.
• Use an authorized agent to submit a request on your behalf, with proof of your authorization.

Submit a request through the Contact page and select a privacy request. Tell us whether you are asking to know, delete, or correct, and include enough information for us to locate your records.

We will acknowledge your request and verify your identity before acting. Verification normally requires matching information to an existing account or record. We aim to respond within forty-five (45) days; if a request is complex we may extend that period once, by a further forty-five (45) days, and will tell you if we do.

Where we act as a service provider, we will forward your request to the Customer that controls the data and support their response. We may decline a request where the law allows, for example where fulfilling it would impair another person's privacy or where a legal retention obligation applies, and we will explain the reason.

The Service uses strictly necessary cookies and browser storage to keep you signed in, maintain session integrity, and remember interface preferences. We do not use advertising cookies in authenticated areas of the application.

Where analytics are enabled on public pages, they are configured not to receive personal identifiers. You can block or clear cookies in your browser, though signing in requires session storage. We honor Global Privacy Control signals as an opt-out of sale and sharing where our systems receive them.

The Service is intended for adult professionals and caregivers and is not directed to anyone younger than 18 years of age. We do not knowingly collect personal information from children. If you believe a child's information has been entered into the Service, contact us through the Contact page and we will work with the controlling organization to remove it.

We may update this Privacy Policy to reflect changes in our practices or the law. The revised version will be posted here with a new "Last Updated" date, and material changes will be communicated by email or in-app notice where appropriate. Continued use of the Service after the effective date means you accept the updated policy.

For privacy questions, or to submit a request under this policy, use the Contact page on this site and select the Privacy option. Customers with contractual data processing terms should use their designated account contact for processor-related requests.