User Data Management Policy

This User Data Management Policy ("Policy") explains how NRZTek ("NRZTek", "we", "our", or "us"), a division of NRZ Home Services, LLC, a Texas limited liability company with its principal office at 175 Alabama Ave., Lakehills, TX 78063, collects, uses, secures, retains, and deletes data relating to users of the NRZTek Courses learning management system (the "LMS" or "Courses"), available at www.nrztek.com/courses. It supplements, and should be read together with, our Privacy Policy, our Terms & Conditions, and the Courses & LMS Terms of Service. Where this Policy and the Privacy Policy address the same topic, this Policy controls for LMS user data.

By creating an account or otherwise using the LMS, you acknowledge that you have read and understood this Policy. If you do not agree with it, do not create an account or use the LMS.

1. Scope and Roles

This Policy governs personal data processed through the LMS, including data about students, instructors, administrators, and visitors who authenticate to the platform. With respect to account and learning data we collect to operate the LMS, NRZTek acts as the controller (the party that determines the purposes and means of processing). With respect to course content, answer keys, rubrics, rosters, or learner data that an organization, employer, or instructor uploads or directs us to process on their behalf, NRZTek acts as a processor / service provider and processes that data only on documented instructions from that organization under the applicable agreement.

2. Categories of Data We Process

• Identity and account data — your user identifier, name, email address, and role (student, instructor, or admin), managed through Netlify Identity and mirrored into a profile record so the platform can attribute your activity.
• Learning data — course enrollments, lesson progress, quiz and exam submissions and the answers you write, interactive code you run, and the AI-generated scores, feedback, and rationale produced for your submissions.
• Credential data — completion certificates issued to you, including the certificate serial, the course and score shown on it, and the cryptographic signature and tamper-evidence records used to verify it.
• Billing and subscription data — your subscription tier and status and, where applicable, an opaque payment-provider customer or subscription reference. We do not collect or store payment-card numbers; card data is handled by our payment provider.
• Activity and audit data — an append-only log of meaningful learning events (enrolled, lesson completed, attempt submitted and graded, certificate issued, data exported, account closed) used to issue and verify tamper-evident certificates and to secure the platform.
• Technical data — IP address, device and browser information, and server logs collected automatically to operate, secure, and troubleshoot the LMS.

3. Purposes and Legal Bases

We process LMS data to:

• create and operate your account and deliver the courses and features you use;
• grade your work, including AI-assisted grading grounded in instructor answer keys;
• issue, display, and publicly verify completion certificates;
• process subscriptions and maintain financial and tax records;
• secure the platform, prevent fraud and abuse, and enforce our agreements; and
• comply with our legal obligations.

Depending on your jurisdiction, our processing relies on your consent, the performance of our contract with you, our legitimate interests in operating and securing the LMS, and compliance with law. We do not sell your personal data, and we do not process it for targeted advertising or for profiling that produces legal or similarly significant effects about you.

4. Artificial-Intelligence Processing

Open-ended quiz and exam answers may be sent to a large-language-model grading service through the Netlify AI Gateway to produce a score, feedback, and rationale, grounded in instructor answer keys and rubrics. We use your submissions to grade your work and operate the platform. We do not authorize the use of your submissions to train third-party foundation models. AI-generated grades are decision-support tools; a human reviewer is available on request for any graded result you wish to dispute, and the LMS records when a grade was produced by AI versus a deterministic or manual process.

5. How We Secure Data

We apply administrative, technical, and physical safeguards designed to protect user data, including authentication through a managed identity provider, server-side authorization checks on every protected request, role-based access control, encryption of data in transit, an append-only audit trail, cryptographic signing of certificates, and input and rate limits on sensitive endpoints. Student-authored code runs only in an isolated in-browser sandbox. No system is perfectly secure, and we cannot guarantee absolute security; you are responsible for maintaining the confidentiality of your credentials.

6. Data Retention

We keep personal data only for as long as needed for the purposes described in this Policy or as required by law. As general guidance:

• Account and learning data is retained while your account is active and is erased or anonymized when you close your account, except as noted below.
• Issued certificates and the audit records that prove them are retained in non-identifying form after closure so that credentials you have earned remain verifiable by third parties and to support the integrity and fraud-resistance of the certification program.
• Billing, tax, and transaction records are retained for the periods required by applicable accounting, tax, and recordkeeping laws.
• Security, fraud-prevention, and legal-hold records are retained as long as necessary to address the matter and to establish, exercise, or defend legal claims.

7. Your Rights and Self-Service Controls

Subject to applicable law — including the Texas Data Privacy and Security Act and similar U.S. state privacy laws — you may have the right to access, correct, delete, and obtain a portable copy of your personal data, and to appeal a decision we make about a privacy request. The LMS provides self-service tools so you can exercise the most common rights directly from your account dashboard:

• Download my data. Export a complete, machine-readable (JSON) copy of the account, learning, credential, billing-reference, and activity data we hold for you.
• Close my account. Permanently close your account. We erase your personal data, anonymize your profile, cancel any active subscription so you are not billed again, and delete your sign-in identity, retaining only the limited records described in Section 6. This action is irreversible; download your data first if you want a copy.

To make any other request, to ask a question, or to appeal a decision, contact us at admin@nrztek.com. We will verify your identity before acting on a request and will respond within the time required by applicable law. If we decline a request, you may appeal by replying to our decision; if your appeal is denied, applicable law may permit you to contact the Texas Attorney General.

8. Effect of Closing Your Account

When you close your account, your enrollments, attempts, answers, and subscription records are deleted and your profile identifiers (name and email) are redacted, so the data can no longer be associated with you. Your sign-in identity is removed and you will no longer be able to log in. As explained in Section 6, certificates you earned and the non-identifying audit record used to verify them are retained so issued credentials remain trustworthy. We are not able to restore a closed account or its deleted data.

9. Children's and Students' Data

The LMS is intended for use by adults and is not directed to children under 13, and we do not knowingly collect personal information from children under 13. The LMS is a professional, continuing-education product offered directly to learners and is not operated on behalf of a K-12 school; we do not act as an educational agency or institution and do not maintain "education records" under the Family Educational Rights and Privacy Act (FERPA) unless we have entered into a separate written agreement to provide the LMS to a covered institution, in which case we will act as a "school official" with a legitimate educational interest and process data only under that institution's instructions. If you believe a child under 13 has provided us data, contact us so we can delete it.

10. Service Providers and Data Sharing

We share user data only as needed to operate the LMS and only with providers bound by confidentiality and data-protection obligations — for example, our hosting and serverless platform, managed database, identity provider, AI gateway, and payment processor. We may also disclose data to comply with law or legal process, to protect rights, safety, and property, to prevent fraud or abuse, or in connection with a merger, acquisition, financing, or sale of assets, subject to customary protections. We do not sell user data.

11. Data Breach Notification

If we determine that a breach of system security has compromised user personal data, we will notify affected users and any regulators as and when required by applicable law, including the Texas Identity Theft Enforcement and Protection Act (Tex. Bus. & Com. Code Ch. 521) and other applicable U.S. state breach-notification laws.

12. International Users

We operate from the United States and store and process data in the United States. If you access the LMS from outside the United States, you consent to the transfer and processing of your data in the United States, which may have different data-protection laws than your country.

13. No Warranty; Limitation of Liability

To the fullest extent permitted by law, the LMS and its data-management features are provided on an "as is" and "as available" basis without warranties of any kind, and NRZTek's liability arising out of or relating to user data or this Policy is limited and disclaimed as set out in our Terms & Conditions and Courses & LMS Terms of Service, which are incorporated here by reference. Nothing in this Policy limits any right you cannot lawfully waive.

14. Governing Law

This Policy is governed by the laws of the State of Texas and applicable U.S. federal law, without regard to conflict-of-laws principles, and venue lies in the state and federal courts located in Bandera County, Texas, except as otherwise required by law.

15. Changes to this Policy

We may update this Policy from time to time. The updated version will be indicated by a revised "Effective date" and is effective upon posting. Material changes will be communicated as required by law.

16. Contact Us

For questions about this Policy or to exercise your rights, contact:

NRZTek
175 Alabama Ave.
Lakehills, TX 78063
Email: admin@nrztek.com
Phone: 512-537-4351