Privacy Policy
Scope
Applies to train.deepvectorlabs.com, app.train.deepvectorlabs.com, and the administrative tools of the Verity Train training platform.
Data we collect
- Employer account data — company name, administrator name/email, billing details.
- Employee roster data — employee name, work email, supervisor designation, as entered by the employer. We act as a processor of this data on the employer's behalf.
- Training records — assignment, progress, quiz scores, completion timestamps, certificate IDs.
- Technical data — IP address, browser user agent, session cookies (functional + login), umami privacy-respecting usage analytics (no advertising trackers, no cross-site profiles).
What we use it for
- Delivering training and issuing certificates in the employee's entered name.
- Maintaining the employer's compliance audit log and export.
- Operating, securing, and improving the platform; transactional email (assignments, renewals, receipts).
- Fraud prevention (fake-completion abuse voids audit value).
What we never do
- We do not sell personal data, rent it, or share it for cross-context behavioral advertising.
- We do not use biometric data. Nothing in the platform touches Illinois Biometric Information Privacy Act scope (no fingerprint, face, or voice templates).
- We do not send marketing to your employees. Roster emails receive only training workflow messages.
Sharing
- Subprocessors: Amazon Web Services (hosting, us-east-1), Stripe (payment processing — card data travels directly from browser to Stripe; we never see full card numbers), transactional email provider.
- Legal process: only when compelled (subpoena, court order), with notice to the account holder where lawful.
- Business transfer: data may transfer with an acquisition; this policy's commitments travel with it.
Retention
- Certificates and audit-log entries: retained for the longer of your state's statutory window (CA §12950.1 documentation: 2 years minimum) or account life.
- After cancellation: record export tooling stays available for the statutory period, then data is purged.
- Marketing analytics: aggregated, 12-month rolling.
Security
TLS in transit, encrypted-at-rest storage, least-privilege access (the platform runs on dedicated infrastructure; operator access is logged), and a standing fleet watchdog that alerts on service anomalies. See the FAQ for operational detail.
State privacy rights
- California (CCPA/CPRA): consumers may request access, correction, deletion, and a list of disclosures via hello@deepvectorlabs.com. We do not "sell" or "share" personal information as defined by CPRA.
- Illinois: no BIPA-covered data is collected. Employee data access requests route through your employer (the data controller).
- New York: requests likewise via hello@deepvectorlabs.com, coordinated with the employer of record.
- Other states: as state privacy laws proliferate, we honor equivalent rights on request.
Cookies
Functional session cookies only (login state) plus umami analytics (no advertising cookies, no fingerprinting). No cookie banner is required for first-party analytics-only use in these jurisdictions, but we prefer to disclose rather than comply silently.
Children
The platform is not directed at children under 18; minors aged 16–17 in states permitting them to be employed may appear in employer rosters under employer authority.
Changes
Material changes are announced to account administrators by email 30 days before effect. Current version pinned at this URL.
Contact
Deep Vector Labs (ELM Group LLC), Crown Point, Indiana · hello@deepvectorlabs.com · train.deepvectorlabs.com