Privacy Policy

This Privacy Policy explains how WEKID™, LLC (“WEKID,” “we,” “our,” or “us”) collects, uses, shares, and protects information about visitors and customers of wekid.org and related WEKID services (collectively, the “Services”). WEKID, LLC is a North Carolina limited liability company.

By using the Services, you agree to the practices described in this Policy. If you do not agree, please do not use the Services.

1. Who we are

WEKID, LLC operates the WEKID certification program at wekid.org. We provide professional credentials in AI governance and related areas, including study materials, exams, certificates, and digital badges. The data controller for purposes of this Policy is:

2. Age requirement

The Services are intended for adults 18 years of age or older. We do not knowingly collect personal information from anyone under 18. If you are under 18, please do not use the Services or submit any information to us. If we learn we have collected information from someone under 18, we will delete it promptly.

3. Information we collect

3.1 Information you give us directly

• Account and exam information. Name, email address, and other details you provide when you register, purchase a credential, or take an exam.
• Purchase information. Billing details processed through our payment processor (see §5). We do not store full credit card numbers on our servers; payment cards are handled directly by Stripe.
• Exam responses. Multiple-choice answers and open-text scenario responses you submit during an exam, along with metadata such as start and end times, attempt status, and proctor events (e.g., loss of focus on the exam window).
• Whitepaper and contact forms. When you download a whitepaper or fill out a contact form, you provide your name, email, and any message you choose to include.
• Marketing opt-in. If you check the “send me WEKID updates” box on a form, we record that affirmative consent along with the date and time it was given.

3.2 Information collected automatically

• Server logs. Our hosting provider records IP address, user-agent string, requested URL, referrer, and timestamp for every request. These logs are used for security, troubleshooting, and abuse prevention.
• Session cookies. We set secure, HTTP-only cookies to maintain your login session and to protect against cross-site request forgery (CSRF). These cookies are essential for the Services to function.

3.3 Information we do not collect

We do not run advertising trackers, third-party analytics scripts, or social-media tracking pixels on wekid.org. We do not buy lists of email addresses. We do not collect biometric data, precise geolocation, or government identifiers.

4. How we use information

We use the information we collect to:

• Deliver the Services you request — including issuing exam tokens, scoring exams, generating certificates, and issuing digital badges.
• Process payments and prevent fraud.
• Communicate with you about your account, your purchases, and your exam results.
• Send you marketing emails about new WEKID content, courses, or offers, only if you have opted in to receive them. You can unsubscribe at any time via the link in every marketing email.
• Improve and secure the Services, including detecting and responding to abuse, fraud, and technical problems.
• Comply with applicable legal obligations.

5. Who we share information with

We share information only with service providers that help us run the Services, and only to the extent necessary for them to do their job. Each provider is bound by its own privacy and security obligations. Our current service providers include:

• Stripe — payment processing. When you make a purchase, your card details are submitted directly to Stripe; we receive only a confirmation of payment and limited metadata (e.g., last four digits of the card, billing country).
• GoDaddy — web hosting and email infrastructure.
• Brevo — transactional email delivery (e.g., exam tokens, certificates, password reset links).
• Anthropic and Google (Gemini) — AI grading services for open-text scenario responses (see §6).
• Credly — digital badge issuance, if you choose to claim a badge for a passed credential.

We may also disclose information when required by law (subpoena, court order, regulatory request), to protect our rights or the safety of others, or in connection with a business transfer (such as a merger or acquisition), in which case you would be notified before your information becomes subject to a different privacy policy.

We do not sell personal information.

6. AI-assisted grading

Open-text scenario answers may be evaluated by AI services (currently Google Gemini and/or Anthropic Claude) before final scoring. When we submit a response for AI evaluation:

• The response is sent without your name, email address, or any other identifier that would link it to you in the AI provider’s logs. We use only a server-side reference ID.
• AI-suggested scores are reviewed against rubric criteria. A human reviewer may adjust the final score for any response, and you may request human re-review.
• AI providers’ own data-use policies apply. Anthropic and Google have committed (per their published API policies) not to train their models on your submitted content. We do not have a separate enterprise agreement that changes those defaults.

7. Cookies and similar technologies

We use only the cookies necessary to operate the Services:

• wekid_exam_sid — exam-taking session.
• wekid_admin_sid — admin console session.
• wekid_buyer_sid — buyer account session.
• CSRF protection tokens, set per-session.

We do not currently use third-party analytics or advertising cookies. If we add them in the future, we will update this Policy and (where required) request your consent.

8. How long we keep information

• Account and exam records: for as long as your WEKID credential remains active, plus seven (7) years after expiration, for credential-verification and audit purposes.
• Purchase records: retained as required by applicable tax and accounting law, typically seven (7) years.
• Whitepaper / contact leads: retained until you request deletion or unsubscribe.
• Marketing list members: retained until you unsubscribe; bounce and unsubscribe records are retained to honor your preference.
• Server logs: typically 30–90 days, unless retained longer for an active security investigation.
• Open-text exam responses: retained alongside the attempt record. AI grading job records (suggested scores, rationale) are retained alongside the response.

9. Security

We take reasonable measures to protect personal information against loss, theft, and unauthorized access — including HTTPS encryption in transit, password hashing with bcrypt, restricted database access, role-based admin permissions, audit logging of administrative actions, rate limiting, CSRF protection, and secure session cookies.

No system is perfectly secure. If a data breach affects your information, we will notify you and applicable regulators as required by law.

10. Your rights

Regardless of where you live, you may contact us at privacy@wekid.org to:

• Access — ask for a copy of the personal information we hold about you.
• Correct — ask us to fix information that is wrong.
• Delete — ask us to delete your information, subject to our retention obligations (we may need to keep certain records to verify issued credentials or comply with tax law).
• Export — receive your information in a portable, machine-readable format.
• Object / restrict — ask us to stop or limit certain uses of your information.
• Unsubscribe — opt out of marketing emails at any time, using the link in every marketing message.
• Withdraw consent — withdraw any consent you previously gave for marketing or other consent-based processing.

We will respond to verifiable requests within 30 days, or sooner where required by law.

11. International users

WEKID, LLC is based in the United States. If you access the Services from outside the U.S., your information will be transferred to and processed in the U.S., which may have different data-protection laws than your home country. By using the Services, you consent to this transfer.

If you are in the European Economic Area, the United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR) and equivalent laws — including the right to lodge a complaint with your local data protection authority. Our legal bases for processing are: contract (delivering the credential you purchased), legitimate interest (running and securing the Services), consent (marketing emails, optional features), and legal obligation (tax records, regulatory compliance).

12. California residents

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) gives you specific rights, including the right to know what personal information we collect about you, the right to delete that information, the right to correct inaccurate information, the right to opt out of any “sale” or “sharing” of your personal information, and the right not to be discriminated against for exercising those rights.

We do not sell or share personal information as those terms are defined in the CCPA. To exercise any other right, contact us at privacy@wekid.org. We may need to verify your identity before fulfilling a request.

13. Do Not Track

Some browsers send a “Do Not Track” (DNT) signal. We do not use third-party tracking cookies, so DNT signals don’t materially change our behavior. If we add analytics in the future, we will honor reasonable DNT signals where feasible.

14. Third-party links

The Services may contain links to third-party sites (for example, to a Credly badge page or a partner site). We are not responsible for the privacy practices of those sites; please review their own policies before submitting information to them.

15. Changes to this Policy

We may update this Policy from time to time. When we do, we will revise the “Last updated” date at the top. If the changes are material, we will provide additional notice (such as a banner on the Services or an email to active customers) before the changes take effect. Your continued use of the Services after the changes take effect means you accept the updated Policy.

16. Contact us

If you have questions about this Policy or how we handle your information, please contact: