Trust
Privacy notice
Last updated October 1, 2026
Who we are
JurisCred operates juriscred.org. For institutional accounts, your school or company is the data controller and JurisCred processes data on its behalf; for independent learners at open.juriscred.org, JurisCred is the controller.
What we collect
- Account: name, email addresses, identity-provider identifiers (for example, your Microsoft directory and object IDs). If you sign in through an institution we also require one personal email address of your own, used only so you can sign in after your institutional account closes; your institution does not see it.
- Learning: enrollments, lesson progress including video watch time, exam attempts, answers, scores, grader feedback, completions.
- Credentials: issued credentials with your name as issued, dates, status, and the evidence behind them.
- Technical: IP address, browser, request identifiers, and sign-in events, kept in the activity log for security.
Why
To run courses and exams, issue and verify credentials, secure accounts, notify you about expirations and renewals, and support institutions. We do not sell personal data or use it for advertising.
Who sees it
- Staff at your institution with Admin, Manager, or Author roles, according to their role.
- Anyone with your credential's verification link sees the credential and, unless you hide it, your name. You control that per credential.
- Publishers of Library courses see aggregate counts per institution, plus, when their course contains written exam questions, the answer text they grade — shown under a pseudonym, never with your name, email, or institution.
- Our subprocessors: AWS (hosting), Cloudflare (network edge and email: DNS, load balancing and web application firewall, and delivering the email we send you — your requests and our emails to you pass through it in transit), Mux (video), Google (Gmail) and Slack (if you write to support@ or security@: your message reaches our Gmail mailbox, and a notice with your address and, for support, the subject reaches our Slack), IONOS (our older support mailboxes), Microsoft (sign-in for institutions that use it). See the security page.
- Google Fonts: JurisCred's public marketing pages (the juriscred.org home page, the security, privacy, terms, accessibility and copyright pages, the Library review board and public author profiles) load their typeface, Manrope, from Google's servers (fonts.googleapis.com and fonts.gstatic.com). Your browser fetches it, so Google receives your network address and the address of the site you're on, as with any request; it receives nothing from your account, your learning or your credentials. Google's privacy policy covers what it does with them. Sign-in, your courses, lessons, exams and credentials, and the public verification pages load nothing from Google Fonts: they use a copy of Manrope served from JurisCred's own servers.
Retention
Learning records are retained while your institution uses JurisCred and per its configured retention. Issued credentials remain verifiable indefinitely unless the institution instructs otherwise. Activity logs are kept for the institution's configured window, at least 90 days.
Your choices
From your Account page you can add or remove sign-in emails, download everything we hold about you, hide your name on verification pages, and delete your personal data. Deletion removes your name and sign-in methods; credentials remain verifiable as issued and learning records are kept anonymously for the institution.
Automated decisions
Objective exam questions are scored automatically against answer keys written by the course author, and credentials issue automatically when the author's completion rules are met. Written answers are graded by a person. Your institution can review any attempt, regrade, or issue a credential manually; contact your institution first and us second if you believe a result is wrong.
Legal requests
We disclose personal data to law enforcement or other third parties only when required by a valid subpoena, court order, or warrant, or to prevent imminent harm. Unless legally prohibited, we notify the institution before responding so it can object. We do not sell data or grant voluntary bulk access.