Privacy Policy

GRC Eng Club, Inc., a Delaware C corporation doing business as GRC Engineering Club, is the data controller for the personal information described in this policy. You can reach us at hello@grcengclub.com.

This policy covers grcengclub.com, cert.grcengclub.com (the Training Academy), directory.grcengclub.com, our chapter program, our events, and the emails we send. Our merch store at shop.grcengclub.com has its own store privacy policy, and communities hosted on Patreon and Slack are also governed by those platforms' policies.

Information you give us.

• Membership and Academy accounts: name, email address, password (stored hashed by our authentication provider, never readable by us), course progress, lab and exam results, and the GitHub repository URLs you submit for capstones and challenges.
• Academy tool inputs and outputs: what you type into Academy tools such as the AI documentation tool, the files and text you submit through them, and what they produce for you.
• Chapter join and leader applications: name, email, LinkedIn URL, city, and anything you write in the form.
• Team and university inquiries: company name, contact name, email, seat count, and notes.
• Directory profiles: whatever you choose to publish, such as name, headline, specializations, certifications, links, and photo. Directory profiles are public by design.
• Member stories, testimonials, headshots, and quotes you submit for chapter pages, announcements, or marketing.
• Event registrations, handled through Eventbrite: name, email, and ticket details.
• Anything you send us by email or in a Club community.

Payment information. Payments are processed by Stripe (direct purchases), Patreon (monthly membership), and Shopify (merch). We never see or store your full card number. We receive your name, email, the amount, the last four digits of the card, billing country, and any promotion code used, so we can grant access, issue receipts, and handle refunds.

Membership status from Patreon. To unlock member benefits, we periodically pull the list of active patrons from Patreon: name, email, tier, and status. This is how the Academy, chapter portals, and member-only content know you are a member.

Information collected automatically. Our sites use Google Analytics 4, which sets cookies and records pages viewed, approximate location, device and browser type, referring site, and interactions such as clicks on join buttons. Our hosting provider (Amazon Web Services) keeps standard server logs including IP address and request details for security and debugging.

• To provide the Services: create your account, unlock content, grade exams, issue and verify certificates, list you in the directory or on a chapter page, and run events.
• To process payments, send receipts, manage renewals, and handle refunds.
• To communicate with you: welcome and access emails, receipts, answers to your questions, and Club news. Every marketing email has an unsubscribe link; transactional emails (like an access link you asked for) are sent regardless.
• To run the chapter program, including sharing a chapter's member roster with that chapter's leaders.
• To understand how the sites are used and improve them, using aggregated analytics.
• To market the Club: promoting the Academy, chapters, events, and sponsored programs, sending marketing email, publishing aggregated results such as pass rates, and featuring content you submitted with the credit you asked for.
• To develop, train, fine-tune, evaluate, and improve AI and machine learning models and AI-powered features, built by us or by vendors working for us, using your content and your usage data (course and lab activity, exam responses and results, capstone and challenge submissions, Academy tool inputs and outputs, questions you send us, and community activity).
• To build datasets from your content and usage data and license them to third parties that build, train, or evaluate AI models. See "AI and data partners" below for what we remove first and how to opt out.
• To keep the Services secure, prevent fraud and seat sharing, and enforce our Terms of Service.
• To meet legal obligations such as tax records and responding to lawful requests.

If you are in the EEA or UK, our legal bases are: performance of our contract with you (accounts, purchases, access), our legitimate interests (analytics, security, running the community, marketing to existing members, developing and improving AI features), your agreement to our Terms and your consent where we ask for it (publishing a testimonial or headshot, marketing to non-members, licensing data to AI partners), and compliance with legal obligations. You can object to or withdraw from the AI uses at any time; see "Your rights" below.

We do not share your personal information for cross-context behavioral advertising. We do license data to AI and data partners as described below, which may count as a "sale" under some state privacy laws, and you can opt out. Otherwise we share it only as described here.

AI and data partners. We may license, sell, or otherwise provide datasets built from your content and usage data to third parties that build, train, or evaluate AI models, including AI companies, data partners, and research organizations. Before we do, we remove direct identifiers such as your name and email address, except for content you chose to make public or asked to be credited for. Passwords and payment card details are never included; we do not hold them. To opt out, email hello@grcengclub.com from the address on your account. We stop including your data in new datasets within 30 days, but we cannot recall datasets already delivered.

Service providers who process data on our behalf under contract: Amazon Web Services (hosting, databases, authentication), Stripe (payments), Patreon (monthly billing and community), Shopify (merch), Eventbrite (event registration), Resend (transactional and campaign email), Google (analytics, email and documents), Slack (community chat), GitHub (capstone hosting and open-source projects), YouTube (video), and LinkedIn (company page and social sharing).

Chapter leaders. When you join a chapter, that chapter's officers can see your name, email, and membership status through the chapter portal so they can run meetings and communicate with you. Chapter leaders agree to use that information only for chapter activities.

Event sponsors. Some live events are run with a sponsor. When an event's registration page says so, registering for and attending that event means you agree that we share your name and email address with its sponsor. We do not share them for events that carry no such notice.

Public information. Your directory profile, your name and role on a chapter page if you are an officer, member stories you agreed to publish, and the verification status of any certificate you hold are public.

Legal and safety. We may disclose information to comply with law, to respond to lawful requests, to protect the rights and safety of members, or in connection with a merger or sale of the Club, in which case this policy will continue to apply.

We use Google Analytics 4 cookies to measure traffic and understand which pages and guides are useful. The Academy also uses browser storage to keep you signed in and to remember your progress. We do not use advertising cookies.

You can block or delete cookies in your browser settings, and you can opt out of Google Analytics across all sites with the Google Analytics opt-out browser add-on. Blocking cookies may sign you out of the Academy.

Do Not Track. There is no industry standard for responding to browser "Do Not Track" signals, so our sites do not currently change their behavior when they receive one. We honor Global Privacy Control signals where the law requires it.

We keep account and membership data while your account is active and for up to three years after it lapses, so returning members keep their history and so certificates stay verifiable. Certificate records are kept for as long as the credential can be verified. Payment records are kept for seven years to meet tax and accounting rules. Analytics data is retained by Google Analytics for 14 months. Emails and support conversations are kept for as long as they are useful to answer follow-up questions. You can ask us to delete your data sooner; see your rights below.

We are a GRC engineering community, so we take this seriously. Data is encrypted in transit and at rest, access to production systems is limited to the people who run the Club, and we rely on established providers (AWS, Stripe, Patreon) rather than storing sensitive data ourselves. No system is perfectly secure, and if we learn of a breach affecting your data we will notify you as the law requires.

We are based in the United States and our providers process data primarily in the US. If you are outside the US, your information will be transferred to and processed in the US. For transfers from the EEA, UK, or Switzerland, we rely on our providers' standard contractual clauses or other recognized transfer mechanisms.

Wherever you live, you can ask us to access, correct, or delete your personal information, to stop sending you marketing, to stop using your data for AI training and AI data licensing, or to remove your directory profile or chapter listing. Email hello@grcengclub.com from the address on your account. We respond within 30 days and may ask you to verify your identity first. We will never treat you differently for exercising a right.

EEA, UK, and Switzerland. You also have the rights to restrict or object to processing, to data portability, and to withdraw consent at any time without affecting earlier processing. You can lodge a complaint with your local data protection authority; in the UK that is the Information Commissioner's Office.

California. Under the CCPA you have the right to know what personal information we collect, use, and disclose; to delete it; to correct it; and to opt out of sale or sharing. Licensing datasets to AI partners, described above, may be a "sale" under the CCPA. To opt out, email hello@grcengclub.com with the subject "Do Not Sell or Share My Personal Information". We do not share personal information for cross-context behavioral advertising. You may designate an authorized agent to make a request on your behalf.

Other US states. Residents of states with comprehensive privacy laws have similar rights and can exercise them the same way. If we decline a request, we will tell you why and how to appeal.

The Services are for adults and are not directed to anyone under 18. We do not knowingly collect personal information from children under 16. If you believe a child has given us personal information, email us and we will delete it.

We may update this policy as the Club grows or as the law changes. We will post the updated version here with a new date. Continuing to use the Services after a change means you accept the updated policy.

GRC Eng Club, Inc., a Delaware C corporation
hello@grcengclub.com