TCI / LEGAL 01
Privacy Policy
Last updated September 30, 2026Effective date
This policy is effective September 30, 2026.
What this policy covers
This policy explains how The Contractor Institute collects, uses, stores, and shares information when you use our public website, readiness assessment, practice exam, member portal, and administrative services.
Information we collect
We collect information you submit, including your name, email address, optional phone number, contractor classification, experience history, assessment answers, communication choices, workbook responses, support and privacy requests, uploaded documents, program progress, and records of accepted agreements. We receive payment status, amount, transaction identifiers, refunds, and disputes from Stripe, but the Institute does not store full card numbers.
How we use information
We use information to evaluate program fit, respond to applications, provide educational and implementation support, activate and operate member accounts, process payments, deliver program communications, improve the service, prevent misuse, and satisfy legal obligations.
Cookies, local storage, and analytics
Essential cookies protect authenticated member and administrator sessions. Local storage preserves an unfinished assessment and your privacy choice. With optional analytics consent, first-party browser and session identifiers measure public-page visits, referral domains, campaign labels, device category, coarse country, link destinations, scroll depth, active-tab time, and form interaction counts. Analytics does not capture form answers, full referral URLs, query strings, private portal content, or IP addresses in traffic records. Consented campaign attribution may be linked to an application to measure enrollment conversion. Optional tracking is disabled when you choose Essential only or when the browser sends Global Privacy Control. Application submission, transaction, security, sign-in, lesson-completion, and support records may still be created because they are necessary to provide and secure the service. We do not currently use cross-site advertising trackers or sell or share personal information for cross-context behavioral advertising.
Service providers and professional referrals
We may share only the information reasonably needed with hosting, authentication, storage, payment, email, security, and scheduling providers that help operate the service. When independent malware scanning is enabled, Private Desk uploads are sent over encrypted connections to Cloudmersive for transient malware and active-content inspection before storage or release. Cloudmersive states that its API processes payloads in memory and does not retain copies after the transaction completes. We do not sell personal information. If you choose to engage an independent attorney, CPA, insurance professional, bookkeeper, or other provider, information is shared with that provider only with your direction or consent.
Client-directed AI workflow services
If an implementation client asks us to configure an AI workflow, the accepted Statement of Work identifies the client-owned provider account, approved data category, purpose, access, human approval, and retention boundary. We do not place restricted client information into an AI service merely to demonstrate a feature. The selected provider's terms, settings, and privacy practices also apply, and the client must authorize any production connection or transfer.
Sensitive information
Do not submit passwords, complete payment-card or bank-account numbers, government identification numbers, medical records, or unrelated health information. When a service requires financial or licensing evidence, provide only the minimum requested and redact unrelated identifiers. Uploaded documents are access-controlled and checked for unsafe content before release.
Retention and security
We keep application, payment, consent, member, and support records only as long as reasonably needed to operate the program, maintain tax and compliance records, resolve disputes, enforce agreements, and protect security. Login codes expire after 10 minutes; member and administrator sessions expire or may be revoked. Administrator passwords are stored as salted, memory-hard hashes, not plaintext. Administrator sessions last 12 hours by default; choosing to stay signed in on a private device extends the session to 30 days. Password resets revoke older administrator sessions. We use scoped access permissions, encrypted transport, hashed session tokens, private document storage, upload restrictions, rate limits, and activity logging. No online system can be guaranteed completely secure.
Your choices and requests
Use Privacy Choices to opt out of promotional email or text messages and to request access, correction, export, deletion, or an appeal. We verify identity before disclosing or changing records and may retain information needed for transactions, security, disputes, or law. Essential account, payment, requested-support, and security messages continue even after a marketing opt-out.
Children and age
The assessment, program, and services are intended only for adults age 18 or older. The application prevents a person who answers that they are under 18 from submitting contact information. We do not knowingly provide the program to children or knowingly collect their personal information.
Changes and contact
For privacy questions or requests, use Privacy Choices or email admissions@thecontractorinstitute.com. Material changes will be posted here and, when they materially affect enrolled members, sent to the current account email before taking effect when required.