Privacy Policy
Stepping Stone Training, LLC (“Stepping Stone,” “we,” “our,” or “us”) provides a behavioral assessment, fidelity measurement, and training platform. This Privacy Policy explains how we collect, use, and share information from people who use our platform at app.steppingstonetraining.org, who participate in a survey, assessment, or live training session hosted on it, or who contact us (collectively, the “Services”).
This Privacy Policy does not apply to information collected by third-party websites or services that you may reach through the Services.
By using the Services, you agree to this Privacy Policy. Our Terms of Service govern your use of the Services. If we change this Privacy Policy, we will post the updated version on this page and revise the Last Updated date above.
1. WHO CONTROLS YOUR INFORMATION
Most people use Stepping Stone because an organization — typically an employer or a training provider — purchased access and invited them. Where that is the case, that organization decides what information is collected about you through the Services, how it is used, and who within the organization may see it. We process that information on the organization’s behalf and under its instructions, as a service provider.
This has two practical consequences worth stating plainly:
Your organization can see your results. Administrators, supervisors, and other authorized people at your organization can see the assessments, surveys, and training activity associated with you, subject to the permissions your organization configures.
Requests about your information usually go to them first. If you want to access, correct, or delete information your organization collected about you through the Services, contact your organization. If you contact us directly, we will refer your request to them, except where applicable law requires us to act.
Where we collect information for our own purposes — for example, when you contact us about purchasing the Services, or when we monitor the platform for errors and security — we act on our own behalf and this Privacy Policy governs directly.
2. INFORMATION WE COLLECT
A. Information you or your organization provide
Account information. When an account is created for you, we collect your name, email address, the organization you belong to, and your role within it. Your organization may also add attributes it uses to group or filter people, such as office, region, or cohort.
Participant information. You can join a survey, assessment, or live session without an account, using a link, a join code, or a QR code. In that case we do not require your email address or phone number. Depending on how your organization configures the session, you may be identified only by a participant code, or you may be asked to supply a name or other identifier. See Section 6.
Assessment and training content. We collect what you submit through the Services: survey responses, assessment and fidelity ratings, behavior coding, competency and progress records, course activity, and any notes or free-text you enter. This is the core of what the Services exist to collect.
Feedback and support. A feedback control is available throughout the platform. If you use it, we receive the message you write and, if you choose to attach one, a screenshot of your screen at that moment. Screenshots are optional and are only captured when you explicitly attach one. If you email or otherwise contact us for support, we receive the contents of that correspondence.
Sales and marketing inquiries. If you ask us about purchasing the Services, we collect your name, work email address, and what you tell us about your interest, along with your IP address, browser user agent, and the page or source that referred you.
B. Information we collect automatically
Cookies and local storage. We use cookies that are necessary to operate the Services — principally to keep you signed in. We also store preferences in your browser’s local storage, such as which organization you have selected and your display theme.We do not use advertising cookies, tracking pixels, or third-party product-analytics cookies. If you block or delete the cookies we use, you may not be able to sign in or use parts of the Services.
Device and connection information. Our servers receive your IP address, browser type and version, operating system, and referring page, as any web server does.
Error and performance monitoring. We use Sentry, an error monitoring service, to find and fix problems. This means:
When an error occurs, we receive a report describing it, which can include the page you were on, your browser and operating system, and technical details about what the application was doing.
We collect performance timings for a sample of requests.
When an error occurs, we may receive a replay of your session leading up to it. These replays are configured so that all text is masked and all images and media are blocked — the replay shows the shape and sequence of your interaction, not the words on the screen. We do not record replays of sessions in which no error occurs.
Our servers are configured not to attach personal information to error reports by default.
C. Information we receive from your organization
Your organization may upload or enter information about you, such as a roster of names and email addresses, cohort membership, or attributes describing your role or location, in order to set up training and reporting.
3. HOW WE USE INFORMATION
We use the information we collect to:
provide, operate, and maintain the Services, including authenticating you and delivering surveys, assessments, live sessions, and courses;
produce the results, reports, dashboards, and progress records that the Services exist to produce, and make them available to your organization according to the permissions it configures;
diagnose errors, monitor performance, and maintain the security and integrity of the Services;
respond to your feedback, questions, and support requests;
communicate with you about the Services, including administrative and service messages;
respond to sales inquiries you initiate;
produce aggregated and de-identified statistics that do not identify you or your organization, for improving and describing the Services; and
comply with law, enforce our Terms of Service, and protect the rights, safety, and property of users, the public, and us.
We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We do not use assessment or training content for advertising of any kind.
4. HOW WE SHARE INFORMATION
With your organization. Information you submit through the Services is available to your organization, including its administrators and any supervisors or observers it authorizes, according to the permissions it configures.
Service providers. We share information with vendors who perform services for us and are bound to use it only for that purpose, including our cloud hosting provider and our error-monitoring provider. We require these vendors to store and process information in the United States.
Legal and safety. We may disclose information if we believe it is reasonably necessary to comply with a law, regulation, subpoena, court order, or other legal process, or to protect the rights, property, or safety of any person.
Business transfers. If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, information may be transferred as part of that transaction. We will seek to ensure the recipient honors this Privacy Policy or provides notice of any material change.
Aggregated and de-identified information. We may create and use information that has been aggregated or de-identified so that it does not identify you, your organization, or any individual, and is not reasonably capable of re-identification.
With your permission. We may share information in other ways with your consent or at your direction.
5. YOUR CHOICES AND RIGHTS
As described in Section 1, if your access comes through an organization, direct requests about your information to that organization in the first instance.
Access, correction, and deletion. Subject to the above and to applicable law, you may ask us to access, correct, or delete personal information we hold about you using the contact details in Section 13. We may ask for information to verify your identity before acting. Some information may be retained where we have a legal obligation, a legitimate business need, or where deletion is technically infeasible, such as in backups.
Email. You can unsubscribe from marketing email using the link in those messages. You will continue to receive administrative and service-related messages about your account.
Cookies. Your browser can be configured to refuse or delete cookies. Because the cookies we use are necessary to operate the Services, blocking them will prevent you from signing in.
Do Not Track. We do not currently respond to “Do Not Track” browser signals. We also do not engage in the cross-site tracking those signals are designed to limit.
6. PARTICIPANT CODES AND CONFIDENTIALITY
The Services are designed so that a training participant can be identified by a participant code rather than by name, so that responses shown to a room, or aggregated into results, do not identify the individual who gave them.
Whether that option is used is your organization’s decision, not ours, and your organization may hold the mapping between a code and a person. We therefore cannot promise that your individual responses are anonymous to your organization. If that matters to you, ask your organization how it has configured the session before you respond.
7. THIRD-PARTY SITES
The Services may link to websites, products, or services we do not operate. We are not responsible for their privacy practices, and this Privacy Policy does not apply to them. We encourage you to read their privacy policies before providing information to them.
8. SECURITY AND RETENTION
We use administrative, technical, and physical safeguards designed to protect information we hold. No method of transmission or storage is completely secure, however, and we cannot guarantee the security of information you transmit to us.
We retain information for as long as needed to provide the Services to your organization, and afterward as needed to comply with our legal obligations, resolve disputes, and enforce our agreements. Where we process information on behalf of an organization, retention and deletion follow that organization’s instructions and our agreement with it.
9. UNITED STATES
The Services are hosted in and intended for use within the United States, and we require our vendors to store and process information here. If you access the Services from outside the United States, you understand that your information will be transferred to and processed in the United States.
10. CHILDREN’S PRIVACY
The Services are intended for use by adults in a professional training setting. Consistent with our Terms of Service, users must be at least 18 years old. We do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has provided us personal information, contact us using the details in Section 13 and we will delete it.
11. EDUCATION RECORDS
Where we process information that constitutes an “education record” under the Family Educational Rights and Privacy Act on behalf of an institution, we act as a school official with a legitimate educational interest, use those records only to provide the Services, and do not redisclose them except as the institution authorizes or the law requires. Requests to inspect or amend an education record should be directed to the institution.
12. CHANGES TO THIS POLICY
We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the Last Updated date. If we make a material change, we will provide additional notice as required by law. Your continued use of the Services after an update takes effect constitutes acceptance of the updated Privacy Policy.
13. CONTACT US
If you have questions, comments, or concerns about this Privacy Policy or how we handle information, contact us at:
Stepping Stone Training, LLC
[Insert Address]
[Insert Email]