How Openbox handles your information.

Openbox Learn LLC operates the Openbox platform and is referred to in this policy as "Openbox," "we," "us," or "our." This policy covers Openbox websites, accounts, consumer purchases and memberships, course activity, support, and organization-sponsored learning features that link to it.

For direct consumer accounts, Openbox decides how information is used to provide the service. When an employer or other organization sponsors learning, Openbox also processes certain information for that organization under its instructions. The organization may have its own privacy notice and responsibilities.

A signed order form, data processing agreement, services agreement, or other addendum may apply to organization-sponsored data. If signed organization terms conflict with this public policy, those terms control Openbox's obligations to the organization for the services they cover, subject to applicable law. This policy still explains how Openbox handles information about individual users.

You may provide your name, email address, account preferences, support messages, privacy requests, and information entered into learning activities.

When you use Openbox, we record information needed to operate and protect the service, such as session and login activity, device or request information used for security, course enrollments, lesson progress, assessment attempts and scores, completion dates, attendance or sign-off evidence, certificate IDs, and membership status.

Stripe and other service providers may send transaction identifiers, payment or subscription status, and technical delivery information. An organization may provide work identity and organization attributes needed for assignments, reporting, permissions, teams, manager relationships, and external training records.

We receive information from you, your use of Openbox, a sponsoring organization, and the service providers used to run the platform.

We use information to create and secure accounts, provide course access, process purchases and memberships, remember organization context, track learning progress, administer assessments, produce completion records and certificates, and provide support.

We also use information to prevent abuse, maintain and troubleshoot the service, communicate transaction, account, security, and service updates, and improve course and product experiences.

When organization features are enabled, work identity, assignments, training evidence, projects, tasks, and work or learning-operations time entries are used to provide and support the selected workplace learning and operations features. Openbox Pulse is not payroll, tax, accounting, or invoicing software.

Payments are processed by Stripe. Openbox does not store full payment card numbers in the application.

Openbox stores payment-related identifiers such as Stripe customer, checkout session, price, subscription, and payment-status identifiers so we can provision access, honor billing choices, send confirmations, and reconcile refunds or disputes. For memberships, transaction records may also include the selected plan, billing interval, and subscription status.

A sponsoring organization and its authorized administrators may see work identity, organization membership, assigned learning, activity and attendance, due dates, scores, completion records, certificates, evidence attachments, and related audit history for its own program. Records may also be exported or delivered to a system that the organization configures.

Roles, teams, manager relationships, employee profiles, and permissions are organization-specific. Openbox does not combine or share one organization's learning records with another by default, even when one account belongs to more than one organization.

Organizations must not use Openbox to store Social Security numbers, medical records, banking data, benefits or payroll records, immigration documents, or unrelated sensitive HR data. The organization's HR system remains the source of truth.

When your organization enables Google Calendar import in Openbox Pulse, connecting is optional. Openbox requests read-only access to calendar events only when you choose to connect and review meetings for import.

The short-lived Google access token stays in your browser session and is not stored in the Openbox database. Openbox saves only the title, start time, and end time of meetings you explicitly select, together with an irreversible event-key hash used to prevent duplicate imports. Openbox does not import attendees, meeting descriptions, locations, attachments, or conferencing links.

You can disconnect from the Pulse calendar panel. Disconnecting revokes the current browser token but does not delete time entries you previously chose to import; those entries remain governed by the same organization, audit, retention, and deletion controls as other Pulse entries.

We disclose information to providers that support authentication, database and application hosting, payments, video and file delivery, email, security, malware scanning, and other operations when those services are enabled. They receive information needed for their work and are expected to handle it under applicable contracts and law.

We may also disclose information to a sponsoring organization as described above; when required by law or valid legal process; to protect users, rights, security, and the service; or as part of a business transaction subject to appropriate safeguards.

Openbox is designed to provide learning services, not advertising profiles. We do not use course activity to target third-party behavioral advertising. We will update this policy and provide legally required choices before materially changing that practice.

Openbox uses session cookies and similar technology needed to sign you in, remember essential settings, protect forms, prevent abuse, and operate checkout. Optional analytics are disabled by default unless they are separately enabled after privacy review and any legally required choice.

Openbox may use video and cloud-storage providers to deliver course media and authorized downloads. Time-limited links or tokens and request limits may be used to protect paid or private content.

When private-file or organization-upload scanning is enabled, a file may be held in restricted quarantine while malware checks run. We disclose the minimum file and security-event information needed to infrastructure and scanning providers.

Openbox uses account controls, server-side authorization, organization boundaries, database policies, protected content delivery, and operational monitoring designed to reduce risk. No online service can promise absolute security.

We retain account and learning records while needed to provide access and completion history; transaction, security, and audit records while needed for reconciliation, fraud prevention, legal duties, and dispute handling; and organization records according to the applicable customer arrangement and approved retention rules.

Retention may be extended by a legal hold or mandatory record requirement. An organization can disable a sponsored learner's access separately from deletion. Automatic destructive disposition of governed account, learning, and organization records is not enabled; Openbox reviews scope, export and recovery needs, legal holds, and records that must be preserved before any such disposition. Exact retention periods remain subject to approved legal and records policies.

Depending on where you live and the context, you may have rights to access, correct, export, delete, restrict, or object to certain processing. Signed-in account holders can use the Privacy Requests workspace to request review. Openbox verifies identity, scope, organization responsibilities, legal holds, and records that must be preserved before acting.

A deletion request does not automatically remove completion, certificate, transaction, security, employment, or other records that an organization or Openbox must preserve. Any exception is reviewed and recorded with the request. You may also contact the sponsoring organization about records it controls.

Learners can use the preference link included in Openbox emails or the Email Preferences page to disable optional assignment, reminder, completion, and certificate notifications. Essential purchase, account-security, and service messages may still be sent.

Openbox will not discriminate against you for making a privacy request where applicable law prohibits it. Some requests may be limited or denied when the law permits; if so, the response will explain the outcome available through the request process.

Openbox may update this policy as the service, providers, and legal requirements change. The current version and date appear on this page.

When a material change requires new notice or acknowledgment, Openbox will provide it through the account experience or another appropriate channel.