Stepful Privacy Notice

Stepful, Inc. and its affiliates and subsidiaries (collectively, “Stepful”) respect your concerns about privacy. This Privacy Notice describes the types of personal information we may obtain about you, including when you interact with our websites and mobile applications (collectively, “Online Services”), how we use the information, with whom we may share it, and the rights that may be available to you regarding your information. We also describe the measures we take to safeguard personal information and how you can contact us about our privacy practices.

Effective: January 13, 2025

If an organization with which you are associated (an “Organization”) signs up to use one of our products or services, we may receive personal information about you in connection with our provision of such products or services to your Organization. To the extent we process that information solely pursuant to the instructions of your Organization, we will act as a data processor on behalf of your Organization with respect to that information, which means your Organization’s privacy statement (and not this Privacy Notice) will apply to the processing of that information. Please refer to your Organization’s privacy statement for details about their privacy practices.

Information We Obtain

The personal information that we obtain depends on the context of your interactions with us and our products and services. The types of personal information we may obtain about you include:

• Contact information, such as name, telephone number, and postal and email address. To the extent you consent to receive SMS (text messages) on behalf of Stepful, we also collect and retain that consent (“Opt-In Information”). We do not share SMS (text messaging) Opt-in Information with third parties;
• Login credentials, such as username and password;
• Professional and employment-related information, such as your resume, previous work experience, certifications and professional associations, language skills, legal work eligibility status, and whether your employer or another entity is responsible for your tuition; 
• Demographic information and similar details, such as date of birth, gender, income level, and military and veteran status;
• Government-issued identification information, such as Social Security number and driver’s license data, and proof of identity documents; 
• Education details (e.g., schools attended, level of education, transcripts, diplomas); 
• Information about your participation in our training programs, such as grades, attendance records, education details, work history, legal work eligibility status, background check information, and vaccination status;
• Payment card information (which is collected and stored by our payment processor on our behalf);
• Your communication and account preferences;
• Information provided in connection with a career opportunity at Stepful, such as your resume, education details, work history, legal work eligibility status, background check information, and information collected for diversity monitoring purposes (e.g., race and ethnicity); and
• Other information you choose to provide, such as through emails or other communications, surveys, registration sign-up forms and referrals.

Information We Obtain By Automated Means

When you visit our Online Services, we may obtain certain information by automated means, such as cookies, web beacons, web server or device logs and other technologies. A “cookie” is a text file that websites send to a visitor’s computer or other internet-connected device to uniquely identify the visitor’s browser or to store information or settings in the browser. A “web beacon,” also known as an internet tag, pixel tag or clear GIF, links web pages to web servers and cookies and may be used to transmit information collected through cookies back to a web server. The information we collect in this manner may include your device IP address, unique device identifier, general location information, web browser characteristics, device characteristics, operating system, WiFi network identifiers and signals, battery and signal strength, language preferences, referring URLs or other services, clickstream data, usage information (e.g., actions taken) and statistics, and dates and times of visits.

We may use these automated technologies on our Online Services to collect information about your equipment, browsing actions, and usage patterns. These technologies help us (1) remember your information so you do not have to re-enter it; (2) track and understand how you use and interact with our Online Services; (3) tailor the Online Services around your preferences; (4) measure the usability of our Online Services and the effectiveness of our communications; (5) protect the safety and security of our Online Services; and (6) otherwise manage and enhance our products and services, and help ensure they are working properly.

In addition, we may use third-party analytics services on our Online Services, such as Google Analytics. The information we obtain through the Online Services may be disclosed to or collected directly by these services. To learn more about Google Analytics, please visit https://www.google.com/policies/privacy/partners/.

Your browser may tell you how to be notified about certain types of automated collection technologies and how to restrict or disable them. Please note, however, that without these technologies, you may not be able to use all of the features of our Online Services. For mobile devices, you can manage how your device and browser share certain device data by adjusting the privacy and security settings on your mobile device.

How We Use the Information We Obtain

We may use the personal information we obtain to:

• Provide our products and services;
• Process and fulfill transactions in connection with our products and services;
• Communicate with you (including providing you with offers and other communications about our products and services), respond to inquiries and offer customer support;
• Establish and manage accounts;
• Verify your identity;
• Personalize your experience with our products and services;
• Advertise and market our products and services;
• Administer participation in surveys, promotions or other programs;
• Establish and manage our business relationships;
• Manage career opportunities at Stepful;
• Perform analytics (including, but not limited to, market research, trend analysis, financial analysis, and analysis of our customer base), and deidentification or aggregation of personal information;
• Operate, evaluate and improve our business (including developing new products and services; enhancing, improving and analyzing our products and services; managing our communications; and performing accounting, auditing and other internal functions);
• Maintain and enhance the safety and security of our products and services and prevent misuse;
• Exercise our rights and remedies and defend against legal claims;
• Protect against, identify and prevent fraud and other criminal activity, claims and other liabilities; and
• Comply with and enforce applicable legal requirements, relevant industry standards and Stepful terms and policies.

We also may use the information in other ways for which we provide specific notice at the time of collection.

Information We Share

We may share the categories of personal information we obtain about you (as described in the “Information We Obtain” section of this Privacy Notice) with our affiliates and subsidiaries. We also may share the information we obtain about you with professional advisers (e.g., auditors, consultants and law firms) and third-party vendors and other entities that perform services on our behalf, such as website hosting, data analytics, marketing, payment processing, fraud prevention, and other services. In addition, we may share your information with (1) potential employers who partner with us to find candidates matching your qualifications; (2) background check providers; and (3) business partners to offer you certain products, services or promotions.

We also may disclose personal information (1) if we are required to do so by law or legal process (such as a court order or subpoena); (2) in response to requests by government agencies, such as law enforcement authorities, or self-regulatory organizations; (3) to establish, exercise or defend our legal rights and those of our affiliates, subsidiaries or business partners; (4) when we believe disclosure is necessary or appropriate to prevent physical or other harm or financial loss; (5) in connection with an investigation of suspected or actual illegal activity; or (6) otherwise with your consent or as directed by your representative.

We reserve the right to transfer any personal information we have about you in the event of an actual or prospective sale or transfer of all or a portion of our business or assets (including in the event of an actual or prospective merger, acquisition, joint venture, reorganization, divestiture, dissolution or liquidation).

Personal Information You Make Available to Others

In addition, by using public areas of our Online Services, you may make certain of your personal information available to others. For example, when you post comments, contributions or other content to our Online Services, other users may see such information. Similarly, other users will be able to view descriptions of your activity, communicate with you within our Online Services, and view your public profile. Please be aware that whenever you share information on any public area of the Online Services, that information may be accessed by others.

Sale of Personal Information and Targeted Advertising

We do not sell your personal information in exchange for monetary consideration. We may disclose your personal information by allowing online advertising services and social networks to collect personal information via automated technologies on our Online Services for targeted advertising purposes. This section of our Privacy Notice provides details and explains how to exercise certain rights and choices.

You may see our ads on other websites and apps because we use third-party online advertising services and social networks to tailor our messaging to users based on their inferred interests. These services track your online activities over time and across multiple websites and apps by collecting information through automated means, such as cookies and web beacons or pixels. The information that these services may collect includes data about your visits to websites and apps that serve our ads, such as the pages or ads you view and the actions you take. This data collection takes place both on our Online Services and on third-party websites and apps that participate in these services. These services use this information to show you ads that may be tailored to your individual interests. This process also helps us track the effectiveness of our marketing efforts.  

Depending on your state of residence, this activity may be considered a sale of personal information or processing of personal information for targeted advertising purposes under applicable law. You may have the right to opt out of the sale of your personal information and the processing of your personal information for targeted advertising purposes. Please refer to the U.S. State Privacy Rights section of this Privacy Notice for more information on the rights that may be available to you. If you are a California consumer, please instead refer to our California Consumer Privacy Statement for a description of your right to opt out of the sale of your personal information and the sharing of your personal information for cross-context behavioral advertising purposes. 

You also may use the following resources to opt out of interest-based advertising: www.aboutads.info/choices or http://www.networkadvertising.org/choices/. Our Online Services are not designed to respond to “do not track” signals from browsers.

U.S. State Privacy Rights

Depending on your state of residence, if you interact with us in an individual or household capacity (and not in a commercial or employment context), you may have certain rights regarding your personal information, as described below. If you are a California consumer, for information about your privacy rights, please instead refer to the section of this Privacy Notice called California Consumer Privacy Statement.  

You may have the right to request (1) confirmation of whether we process your personal information; (2) access to the personal information we maintain about you, including a copy provided in a portable format; (3) correction of your personal information; and (4) deletion of your personal information. You can exercise these rights by emailing us at privacy@stepful.com or calling (855) 730-7993. To help protect your privacy and maintain security, we will take steps to verify your identity before complying with your request. If you have an account with us, we may verify your identity by requiring you to sign in to your account. If you do not have an account with us, we may require you to verify your email address or certain of your information in our records, such as your name, email address, phone number, postal address and other information about you in our records.  

You also may have the right to opt out of the sale of your personal information and the processing of your personal information for purposes of targeted advertising. You may exercise these rights by clicking Your Privacy Choices or by using the Global Privacy Control signal (“GPC”). Requests to opt out will apply to the device and browser from which they are submitted. After opting out, if you clear your cookies in your browser or device, you will need to submit a new request to re-apply your opt-out choice to that browser or device. For more information about the GPC, please visit https://globalprivacycontrol.org.  

To submit a request as an authorized agent where permitted by applicable law, please email us at privacy@stepful.com with the subject line “Authorized Agent Request.”  

Subject to applicable law, you may have the right to appeal our decision with respect to a request you have submitted by emailing us privacy@stepful.com.  

How We Protect Personal Information

We maintain administrative, technical and physical safeguards designed to protect the personal information you provide against accidental, unlawful or unauthorized access, destruction, loss, alteration, disclosure, disposal or use.

‍Children’s Privacy

Our Online Services are designed for a general audience and are not directed to children. We do not knowingly collect personal information online from children under the age of 13.

Third-Party Links and Features

For your convenience and information, our Online Services may provide links to other online services, and may include third-party features such as apps, tools, widgets and plug-ins. These online services and third-party features may operate independently from us. The privacy practices of the relevant third parties, including details on the information they may collect about you, are subject to the privacy statements of these parties, which we strongly suggest you review. To the extent any linked online services or third-party features are not owned or controlled by us, we are not responsible for these third parties’ information practices.

Updates to Our Online Privacy Notice

This Privacy Notice may be updated periodically and without prior notice to you to reflect changes in our personal information practices. We will indicate at the top of the Privacy Notice when it was most recently updated. If we make a significant change to this Privacy Notice, we will notify individuals as appropriate, such as by posting a notice on our Online Services.

How to Contact Us

You can submit a request or ask us questions about this Privacy Notice by contacting privacy@stepful.com.

‍

‍Effective: January 13, 2025

California Consumer Privacy Statement

This California Consumer Privacy Statement (“Statement”) supplements the Stepful Privacy Notice and applies solely to California consumers. This Statement does not apply to Stepful personnel.  

This Statement uses certain terms that have the meaning given to them in the California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act of 2020) and its implementing regulations (the “CCPA”). 

Notice of Collection and Use of Personal Information 

We may collect (and may have collected during the 12-month period prior to the effective date of this Statement) the following categories of personal information about you: 

• Identifiers: identifiers such as a real name, alias, postal address, unique personal identifier (such as a device identifier; cookies, beacons, pixel tags, mobile ad identifiers and similar technology; customer number, unique pseudonym, or user alias; telephone number and other forms of persistent or probabilistic identifiers), online identifier, internet protocol address, email address, account name, Social Security number, driver’s license number, passport number, and other similar identifiers
• Additional Data Subject to Cal. Civ. Code § 1798.80: signature, physical characteristics or description, state identification card number, education, credit card number, debit card number, and other financial information
• Protected Classifications: characteristics of protected classifications under California or federal law, such as race, color, national origin, age, sex, gender, gender expression, pregnancy, citizenship status, and military and veteran status
• Commercial Information: commercial information, including products or services purchased, obtained, or considered, and other purchasing or consuming histories or tendencies
• Online Activity: Internet and other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding your interaction with websites, applications or advertisements
• Sensory Information: audio, electronic, visual, and similar information
• Employment Information: professional or employment-related information, such as information relating to your job position (e.g., job title, job description and office location), resume occupation details, education details, certifications and professional associations, previous employment details, and pre-employment screening and background check information, including criminal records information
• Inferences: inferences drawn from any of the information identified above to create a profile about you reflecting your preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

We may use (and may have used during the 12-month period prior to the effective date of this Statement) your personal information for the purposes described in our Privacy Notice and for the following business purposes specified in the CCPA: 

• Performing services, including without limitation, maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytics services, providing storage, or providing similar services;
• Providing advertising and marketing services;
• Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance;
• Short-term, transient use, including, but not limited to, non-personalized advertising shown as part of your current interaction with us;
• Helping to ensure security and integrity to the extent the use of your personal information is reasonably necessary and proportionate for these purposes;
• Debugging to identify and repair errors that impair existing intended functionality;
• Undertaking internal research for technological development and demonstration;
• Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by us, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by us.

We do not collect or process sensitive personal information with the purpose of inferring characteristics about California consumers covered by this Statement.

To the extent we process deidentified information, we will maintain and use the information in deidentified form and will not attempt to reidentify the information unless permitted by applicable law.

Retention of Personal Information

We will retain your personal information for the period reasonably necessary to achieve the purposes described in our Privacy Notice and this Statement, or any other notice provided at the time of collection, taking into account applicable statutes of limitation and records retention requirements under applicable law.

Sources of Personal Information 

During the 12-month period prior to the effective date of this Statement, we may have obtained personal information about you from the following categories of sources: 

• Directly from you, such as when you provide us information in connection with our products and services;
• Your devices, such as when you visit our Online Services;
• Our affiliates and subsidiaries;
• Vendors who provide services on our behalf; 
• Online advertising services;
• Data analytics providers;
• Social networks; 
• Government entities;
• Operating systems and platforms; 
• Your employer;
• Educational institutions you attended;
• Recruiting and talent agencies;
• Referrals and references; and
• Data brokers, such as background check services.

Sale or Sharing of Personal Information

We do not sell personal information in exchange for monetary consideration.  We may disclose your personal information by allowing online advertising services and social networks to collect your personal information via automated technologies on our Services for cross-context behavioral advertising purposes. You have the right to opt out of these types of disclosures of your information, as detailed in the “California Consumer Privacy Rights” section.

We may sell or share for cross-context behavioral advertising purposes (and may have sold or shared during the 12-month period prior to the effective date of this Statement) the following categories of personal information about you to online advertising services and social networks:

• Identifiers
• Online Activity

‍We do not have actual knowledge that we sell or share the personal information of minors under 16 years of age.

Disclosure of Personal Information 

During the 12-month period prior to the effective date of this Statement, we may have disclosed the following categories of personal information about you for the business purposes listed above to service providers and contractors:  

• Identifiers
• Additional Data Subject to Cal. Civ. Code § 1798.80 Law
• Protected Classifications
• Commercial Information
• Online Activity
• Sensory Information
• Employment Information
• Inferences

Please see the ”Information We Share” section of our Privacy Notice for more information about how we disclose personal information.  

California Consumer Privacy Rights 

You have certain choices regarding your personal information, as described below.

• Access: You have the right to request, twice in a 12-month period, that we disclose to you the personal information we have collected, used, disclosed and sold or shared about you, including the categories of personal information collected, the categories of sources from which the personal information is collected, the business or commercial purpose for collecting, selling, or sharing personal information, the categories of third parties to whom we disclose personal information, and the specific pieces of personal information we have collected about you.  
• Correction: You have the right to request that we correct the personal information we maintain about you, if that information is inaccurate.
• Deletion: You have the right to request that we delete certain personal information we have collected from you. 
• Opt-Out of Sale or Sharing: You have the right to opt-out of the sale of your personal information and the sharing of your personal information for cross-context behavioral advertising purposes.

How to Submit a Request.  To submit an access, correction or deletion request, please email us at privacy@stepful.com or call (855) 730-7993.  To opt out of the sale or sharing of your personal information, please click the Your Privacy Choices link or use the Global Privacy Control signal (“GPC”). Requests to opt out will apply to the device and browser from which they are submitted. After opting out, if you clear your cookies in your browser or device, you will need to submit a new request to re-apply your opt-out choice to that browser or device.  For more information about the Global Privacy Control, please visit https://globalprivacycontrol.org/.

To submit a request as an authorized agent, please email us at privacy@stepful.com with the subject line “Authorized Agent Request.” For questions or concerns about our privacy policies and practices, please contact us as described in the “Contact Us” section of our Privacy Notice.

Verifying Requests.  To help protect your privacy and maintain security, we will take steps to verify your identity before granting you access to your personal information or complying with your request.  If you have an account with us, we may verify your identity by requiring you to sign in to your account.  If you do not have an account with us and you request access to or deletion of your personal information, we may require you to verify your email address or certain of your information in our records, such as your name, email address, phone number, postal address and other information about you in our records.  In addition, if you do not have an account and you ask us to provide you with specific pieces of personal information, we may require you to sign a declaration under penalty of perjury that you are the consumer whose personal information is the subject of the request.  

Additional Information.  You have the right to not be retaliated against if you choose to exercise any of your rights under the CCPA.  To the extent permitted by applicable law, we may charge a reasonable fee to comply with your request.