Privacy Policy

GRC Eng Club, Inc., doing business as GRC Engineering Club, is the data controller for the personal information described in this policy. We are located at 2204 Calle McLeary, San Juan, PR 00913, United States. You can reach us at hello@grcengclub.com.

This policy covers grcengclub.com, cert.grcengclub.com (the Training Academy), directory.grcengclub.com, our chapter program, our events, and the emails we send. Our merch store at shop.grcengclub.com has its own store privacy policy, and communities hosted on Patreon and Slack are also governed by those platforms' policies.

Information you give us.

• Membership and Academy accounts: name, email address, password (stored hashed by our authentication provider, never readable by us), course progress, lab and exam results, and the GitHub repository URLs you submit for capstones and challenges.
• Chapter join and leader applications: name, email, LinkedIn URL, city, and anything you write in the form.
• Team and university inquiries: company name, contact name, email, seat count, and notes.
• Directory profiles: whatever you choose to publish, such as name, headline, specializations, certifications, links, and photo. Directory profiles are public by design.
• Member stories, testimonials, headshots, and quotes you submit for chapter pages, announcements, or marketing.
• Event registrations, handled through Eventbrite: name, email, and ticket details.
• Anything you send us by email or in a Club community.

Payment information. Payments are processed by Stripe (direct purchases), Patreon (monthly membership), and Shopify (merch). We never see or store your full card number. We receive your name, email, the amount, the last four digits of the card, billing country, and any promotion code used, so we can grant access, issue receipts, and handle refunds.

Membership status from Patreon. To unlock member benefits, we periodically pull the list of active patrons from Patreon: name, email, tier, and status. This is how the Academy, chapter portals, and member-only content know you are a member.

Information collected automatically. Our sites use Google Analytics 4, which sets cookies and records pages viewed, approximate location, device and browser type, referring site, and interactions such as clicks on join buttons. Our hosting provider (Amazon Web Services) keeps standard server logs including IP address and request details for security and debugging.

• To provide the Services: create your account, unlock content, grade exams, issue and verify certificates, list you in the directory or on a chapter page, and run events.
• To process payments, send receipts, manage renewals, and handle refunds.
• To communicate with you: welcome and access emails, receipts, answers to your questions, and Club news. Every marketing email has an unsubscribe link; transactional emails (like an access link you asked for) are sent regardless.
• To run the chapter program, including sharing a chapter's member roster with that chapter's leaders.
• To understand how the sites are used and improve them, using aggregated analytics.
• To keep the Services secure, prevent fraud and seat sharing, and enforce our Terms of Service.
• To meet legal obligations such as tax records and responding to lawful requests.

If you are in the EEA or UK, our legal bases are: performance of our contract with you (accounts, purchases, access), our legitimate interests (analytics, security, running the community, marketing to existing members), your consent where we ask for it (publishing a testimonial or headshot, marketing to non-members), and compliance with legal obligations.

We do not sell your personal information and we do not share it for cross-context behavioral advertising. We share it only as described here.

Service providers who process data on our behalf under contract: Amazon Web Services (hosting, databases, authentication), Stripe (payments), Patreon (monthly billing and community), Shopify (merch), Eventbrite (event registration), Resend (transactional and campaign email), Google (analytics, email and documents), Slack (community chat), GitHub (capstone hosting and open-source projects), YouTube (video), and LinkedIn (company page and social sharing).

Chapter leaders. When you join a chapter, that chapter's officers can see your name, email, and membership status through the chapter portal so they can run meetings and communicate with you. Chapter leaders agree to use that information only for chapter activities.

Public information. Your directory profile, your name and role on a chapter page if you are an officer, member stories you agreed to publish, and the verification status of any certificate you hold are public.

Legal and safety. We may disclose information to comply with law, to respond to lawful requests, to protect the rights and safety of members, or in connection with a merger or sale of the Club, in which case this policy will continue to apply.

We use Google Analytics 4 cookies to measure traffic and understand which pages and guides are useful. The Academy also uses browser storage to keep you signed in and to remember your progress. We do not use advertising cookies.

You can block or delete cookies in your browser settings, and you can opt out of Google Analytics across all sites with the Google Analytics opt-out browser add-on. Blocking cookies may sign you out of the Academy.

Do Not Track. There is no industry standard for responding to browser "Do Not Track" signals, so our sites do not currently change their behavior when they receive one. We honor Global Privacy Control signals where the law requires it.

We keep account and membership data while your account is active and for up to three years after it lapses, so returning members keep their history and so certificates stay verifiable. Certificate records are kept for as long as the credential can be verified. Payment records are kept for seven years to meet tax and accounting rules. Analytics data is retained by Google Analytics for 14 months. Emails and support conversations are kept for as long as they are useful to answer follow-up questions. You can ask us to delete your data sooner; see your rights below.

We are a GRC engineering community, so we take this seriously. Data is encrypted in transit and at rest, access to production systems is limited to the people who run the Club, and we rely on established providers (AWS, Stripe, Patreon) rather than storing sensitive data ourselves. No system is perfectly secure, and if we learn of a breach affecting your data we will notify you as the law requires.

We are based in the United States and our providers process data primarily in the US. If you are outside the US, your information will be transferred to and processed in the US. For transfers from the EEA, UK, or Switzerland, we rely on our providers' standard contractual clauses or other recognized transfer mechanisms.

Wherever you live, you can ask us to access, correct, or delete your personal information, to stop sending you marketing, or to remove your directory profile or chapter listing. Email hello@grcengclub.com from the address on your account. We respond within 30 days and may ask you to verify your identity first. We will never treat you differently for exercising a right.

EEA, UK, and Switzerland. You also have the rights to restrict or object to processing, to data portability, and to withdraw consent at any time without affecting earlier processing. You can lodge a complaint with your local data protection authority; in the UK that is the Information Commissioner's Office.

California. Under the CCPA you have the right to know what personal information we collect, use, and disclose; to delete it; to correct it; and to opt out of sale or sharing. We do not sell or share personal information as those terms are defined in the CCPA, and we have not done so in the preceding 12 months. You may designate an authorized agent to make a request on your behalf.

Other US states. Residents of states with comprehensive privacy laws have similar rights and can exercise them the same way. If we decline a request, we will tell you why and how to appeal.

The Services are for adults and are not directed to anyone under 18. We do not knowingly collect personal information from children under 16. If you believe a child has given us personal information, email us and we will delete it.

We may update this policy as the Club grows or as the law changes. We will post the updated version here with a new date and, for material changes, tell members by email or in the community.

GRC Eng Club, Inc.
2204 Calle McLeary
San Juan, PR 00913
United States
hello@grcengclub.com