Privacy Policy
Last updated: September 2026
1. Introduction
The Exterior Hardwood Certification Institute ("EHCI," "we," "us," or "our") respects your privacy and is committed to protecting the personal information you share with us. This Privacy Policy explains how we collect, use, disclose, retain, and safeguard your information when you use our website, platform, and related services (the "Services"). By using the Services, you consent to the data practices described in this policy. We encourage you to read this Privacy Policy carefully and contact us with any questions.
2. Information We Collect
We collect several categories of information: **Information You Provide Directly:** Full name, email address, company name, mailing address, city, state, phone number, professional credentials and certifications, professional biography, website URL, years of experience, service area, and payment information (processed securely through Stripe — we do not store credit card numbers). **Information Generated Through Use:** Exam attempt records (scores, timestamps, answers — without revealing correct answers), course enrollment and progress data, module completion records, credential issuance and expiration data, AI Study Assistant conversation logs (scoped to educational content only), and profile visibility preferences. **Automatically Collected Information:** Browser type and version, device type and operating system, IP address (anonymized for analytics), pages visited and features used, session duration and navigation patterns, referring website URLs, and cookie and local storage data.
3. How We Use Your Information
We use the information we collect for the following purposes: (a) **Service Delivery** — providing and maintaining our certification platform, processing course enrollments, administering examinations, issuing digital credentials and badges, and populating the professional directory for opted-in users; (b) **Account Management** — creating and managing your user account, authenticating your identity, processing payments, and communicating account-related information; (c) **Communication** — sending certification-related notifications (exam results, credential expiration reminders, renewal notices), platform updates and service announcements, and educational content recommendations; (d) **Platform Improvement** — analyzing usage patterns to improve the user experience, identifying and fixing technical issues, developing new features and services, and conducting aggregated analytics (non-personally identifiable); (e) **Legal Compliance** — complying with applicable laws and regulations, responding to legal requests and court orders, and enforcing our Terms and Conditions.
4. Information Sharing and Disclosure
We share your personal information only in the following circumstances: **Public Directory (Opt-In Only):** If you choose to appear in the EHCI professional directory, your company name, credential types, certification status, general location (city, state), and verification link will be publicly visible. Contact information (email, phone, website) is only displayed if you explicitly enable it in your profile settings. You may opt out of the directory at any time. **Credential Verification:** When a third party uses the EHCI Verify system, they can access your certificate ID, certification status (active/expired), company name, and credential scope. This is necessary for the integrity of the certification system. **Service Providers:** We share information with trusted third-party service providers who assist in platform operation, including Stripe (payment processing), hosting providers (infrastructure), and email services (transactional notifications). These providers are contractually obligated to protect your information and use it only for the services they provide to us. **Legal Requirements:** We may disclose information when required by law, subpoena, court order, or government regulation, or when we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others. **Business Transfers:** In the event of a merger, acquisition, or sale of assets, user information may be transferred as part of the transaction, subject to the same privacy protections described in this policy.
5. Data Security
The platform manages account authentication, and the app stores course progress, exam results and credential records to provide its services. This policy does not assert independently audited security, immutable exam storage or a fully isolated exam bank. No method of electronic storage or transmission is completely secure. Do not share account access or submit unnecessary sensitive information; report suspected unauthorized access through Contact.
6. Data Retention
We retain your information according to the following schedule: (a) **Active accounts** — all account data retained for the duration of the account's active status; (b) **Exam records** — retained indefinitely to maintain certification integrity and prevent exam fraud; (c) **Payment records** — retained for 7 years in accordance with financial record-keeping requirements; (d) **AI conversation logs** — retained for 90 days for service quality purposes, then automatically deleted; (e) **Inactive accounts** — account data retained for 3 years after last activity, then anonymized or deleted; (f) **Deleted accounts** — upon account deletion request, personal data is removed within 30 days, except for exam records (anonymized) and payment records (retained per legal requirements).
7. AI and Study Assistant Data
Our AI-powered Study Assistant processes conversations to provide educational guidance related to EHCI certification content. Important disclosures: (a) The AI system does NOT have access to the exam question bank — it cannot provide exam answers; (b) AI interactions are rate-limited to prevent abuse; (c) Conversations are scoped to exterior hardwood educational content only; (d) AI conversation data may be used in aggregated, anonymized form to improve educational content quality; (e) No AI-generated content constitutes professional advice — it is educational guidance only; (f) AI responses may not always be accurate and should be verified against course materials.
8. Cookies and Tracking Technologies
We use cookies and similar technologies for the following purposes: **Essential Cookies** — Required for platform functionality, including session management, authentication state, and security tokens. These cannot be disabled. **Analytics Cookies** — Used to understand how visitors interact with the platform, including pages visited, time spent, and navigation patterns. This data is aggregated and anonymized. **Preference Cookies** — Store your display preferences, language settings, and interface customizations. We do NOT use third-party advertising cookies or sell your data to advertisers. You can manage cookie preferences through your browser settings. Disabling essential cookies may prevent you from using certain features of the platform.
9. Your Rights and Choices
Depending on your jurisdiction, you may have the following rights regarding your personal data: **Right of Access** — Request a copy of the personal information we hold about you. **Right of Correction** — Request correction of inaccurate or incomplete personal information. **Right of Deletion** — Request deletion of your personal data, subject to legal retention requirements. **Right to Opt Out** — Remove yourself from the public directory at any time via your profile settings. **Right to Data Portability** — Request your data in a structured, machine-readable format. **Right to Withdraw Consent** — Withdraw consent for optional data processing at any time. **Right to Non-Discrimination** — We will not discriminate against you for exercising your privacy rights. To exercise any of these rights, contact us at [email protected]. We will respond to verified requests within 30 days.
10. California Residents (CCPA/CPRA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA): (a) We do not sell your personal information as defined by the CCPA; (b) We do not share your personal information for cross-context behavioral advertising; (c) You may designate an authorized agent to make requests on your behalf; (d) You have the right to know the categories and specific pieces of personal information collected about you. For CCPA-specific requests, contact us at [email protected] with the subject line "CCPA Request."
11. International Users (GDPR)
If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data under the following legal bases: (a) **Consent** — for optional services like the public directory and AI Study Assistant; (b) **Contract Performance** — to provide the certification services you requested; (c) **Legitimate Interest** — for platform security, fraud prevention, and service improvement; (d) **Legal Obligation** — for record-keeping and regulatory compliance. You have the right to lodge a complaint with your local data protection authority.
12. Children's Privacy
EHCI Services are intended for professional adults. We do not knowingly collect personal information from individuals under the age of 18 (or the applicable age of majority in your jurisdiction). If we become aware that we have inadvertently collected personal information from a minor, we will take steps to delete such information promptly. If you believe a child has provided us with personal information, please contact us at [email protected].
13. Third-Party Links
Our platform may contain links to third-party websites or services that are not owned or controlled by EHCI. We are not responsible for the privacy practices or content of these third-party sites. We encourage you to review the privacy policies of any third-party sites you visit.
14. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will: (a) update the "Last Updated" date at the top of this policy; (b) notify registered users via email; (c) display a prominent notice on the platform. Your continued use of the Services after the effective date of any changes constitutes acceptance of the updated Privacy Policy.
15. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at: Exterior Hardwood Certification Institute (EHCI) Email: [email protected] We aim to respond to all privacy-related inquiries within 30 business days.