Privacy Policy

This Privacy Policy describes how Yassin Family Foundation, a nonprofit organization ("we," "us," or "our"), collects, uses, and protects your personal information when you use the HuntTheThreat cybersecurity training platform (the "Platform").

Operator: Yassin Family Foundation
Address: [ORGANIZATION_ADDRESS]
Contact: [CONTACT_EMAIL]

We collect the following types of personal information:

• Account Information: Name, email address, and password (hashed) when you create an account directly.
• Google Account Information: If you sign in with Google, we receive your name, email address, and profile picture from your Google account.
• Training Progress Data: Your progress through training modules, quiz scores, lab completions, badges earned, and other activity on the Platform.
• Usage Data: Information about how you interact with the Platform, including pages visited and features used.

We collect information through:

• Account Registration: When you create an account using email/password.
• Google Sign-In: When you authenticate using Google OAuth.
• Platform Usage: Automatically as you use the training features.

We use your information to:

• Provide and operate the training Platform
• Track your learning progress and display achievements
• Generate certificates upon completion of training tracks
• Improve the Platform and develop new features
• Communicate with you about your account or the Platform
• Ensure the security and integrity of the Platform

Your data is stored securely in our database infrastructure. We implement appropriate technical and organizational measures to protect your personal information, including:

• Passwords are hashed using industry-standard algorithms
• Data is transmitted over encrypted connections (HTTPS)
• Access to personal data is restricted to authorized personnel

We do not sell your personal data.

We use the following third-party services:

• Google: For OAuth authentication (Google Sign-In). Google's privacy policy applies to information they collect.
• Hosting and Database Providers: Our infrastructure providers process data on our behalf under data processing agreements.

We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

How AI Features Work

We use third-party AI services provided by Anthropic (Claude API) to deliver AI-powered features. When you interact with AI features on the Platform:

• Your inputs (typed messages, responses to interview questions, exam answers) are sent to and processed by Anthropic's AI services
• This processing is necessary to provide the AI-powered features of the Platform
• AI responses are generated based on your inputs and returned to you through the Platform

AI Training and Data Use

Under Anthropic's API terms, your inputs to AI features are not used to train AI models. However, Anthropic may retain data for safety monitoring and abuse prevention in accordance with their policies.

Anthropic's handling of data is governed by their own privacy policy and terms of service. We are not responsible for Anthropic's data practices beyond our contractual relationship with them.

Important: What NOT to Share with AI Features

Do not enter the following into AI-powered features:

• Classified or sensitive government information
• Personal health information (PHI)
• Real personally identifiable information (PII) of others
• Confidential business information
• Passwords, API keys, or security credentials
• Any information you would not want processed by a third party

AI features are designed for educational scenarios using fictional or anonymized information only.

If you are located in the European Union, European Economic Area, United Kingdom, or other regions with data protection laws, you have certain rights regarding your personal data.

Lawful Basis for Processing

We process your personal data based on:

• Contract: Processing necessary to provide you with the Platform services.
• Legitimate Interests: To improve our Platform and ensure security.
• Consent: Where you have provided explicit consent.

Your Data Subject Rights

You have the right to:

• Access: Request a copy of your personal data
• Rectification: Request correction of inaccurate data
• Erasure: Request deletion of your personal data
• Portability: Request your data in a portable format
• Restriction: Request restriction of processing
• Objection: Object to certain types of processing

To exercise these rights, contact us at [CONTACT_EMAIL]. We will respond within 30 days.

We retain your personal data for as long as your account is active or as needed to provide you with the Platform services. If you request deletion of your account, we will delete your personal data within 30 days, except where we are required to retain it for legal or legitimate business purposes.

To request account deletion: Contact us at [CONTACT_EMAIL] with the subject line "Account Deletion Request."

The Platform is not intended for users under the age of [MIN_AGE_OPTION_13_OR_16]. We do not knowingly collect personal information from children under this age. If we become aware that we have collected personal information from a child under the applicable age, we will take steps to delete such information.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us at [CONTACT_EMAIL].

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by:

• Posting the updated policy on this page with a new "Last Updated" date
• Sending an email notification to registered users (for significant changes)

Your continued use of the Platform after changes are posted constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or our data practices, contact us at:

Yassin Family Foundation
[ORGANIZATION_ADDRESS]
Email: [CONTACT_EMAIL]