Last updated: September 26, 2026 · Effective: September 26, 2026
C.O.R.E. (Cyber Operational Risk Education) is a cybersecurity training platform operated by Core Cybersecurity, LLC, an Ohio limited liability company (91 S. 30th Street, Newark, OH 43055, USA). We are committed to protecting the privacy and security of your personal information. This Privacy Policy explains how we collect, use, disclose, retain, and safeguard your information when you use the C.O.R.E. platform.
By accessing or using the Platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the Platform.
| Category | Data | Purpose |
|---|---|---|
| Account Information | Full name, email address, password (hashed) | Account creation and authentication |
| Organization Data | Company name, organization ID | Employer-sponsored enrollment |
| Training Progress | Lesson completion, quiz scores, activity results, final test scores, streak and daily-goal preferences | Track learning progress and issue certificates |
| AI Interactions | Questions you type or dictate to the AI Tutor; your written answers to AI Learning Checks and the resulting feedback | Tutoring and personalised feedback on your learning |
| Department | Department or team assigned to you by your organization’s administrator | Risk reporting by department |
| Notification Subscription | Browser push endpoint, only if you enable study reminders | Send the reminders you asked for |
| Category | Data | Purpose |
|---|---|---|
| Device Information | Browser type, operating system, screen resolution | Platform compatibility |
| Usage Data | Pages visited, time spent, features used | Service improvement |
| Log Data | IP address, access timestamps, referring URL | Security monitoring |
| Phishing Simulation Results | Whether and when you clicked a link in a simulated phishing email sent as part of your organization’s training | Measure and improve security awareness |
The AI Tutor, the AI Learning Checks, the lesson summaries and the administrator reports are generated with large language models provided by OpenAI. Your questions and answers are sent to OpenAI to produce a response and are processed under API terms that prohibit OpenAI from using them to train its models. AI Tutor conversations are not stored by us as a chat history; Learning Check feedback is saved with your training progress. If you use the voice mode, speech recognition is performed by your browser.
We do not use your personal information for targeted advertising or for automated decision-making that produces legal or similarly significant effects. AI-generated feedback is a learning aid and never the sole basis for a decision about you.
We do not sell, rent, or trade your personal information to third parties.
If enrolled through your employer, your organization’s administrator may access your training progress, completion status, scores, AI Learning Check reports, hands-on activity results, phishing simulation results, department assignment and certificate status. Administrators cannot access your password or your AI Tutor conversations.
We rely on a small number of providers that process data only on our instructions, under contracts that require confidentiality and appropriate security:
| Provider | Role | Location |
|---|---|---|
| Supabase | Database, authentication and server-side functions | United States |
| Netlify | Web hosting and content delivery | United States (global CDN) |
| OpenAI | AI Tutor, Learning Checks, reports and phishing-simulation text generation | United States |
| Resend | Transactional email (invitations, password resets, notifications, simulations) | United States |
| Google Fonts | Web fonts — your IP address is sent to Google when a page loads | United States |
We may disclose your information if required by law, court order, or governmental regulation.
We keep personal information only for as long as it is needed for the purposes described in this Policy:
| Data | Retention |
|---|---|
| Account and profile information | For as long as your account is active. Deleted or anonymised within 90 days after the account is closed by you or your organization. |
| Training progress, scores and Learning Check reports | For the life of the account; completion and certificate records may be kept up to 5 years after completion so that certificates can be verified and your organization can evidence its training obligations. |
| Phishing simulation results | 24 months from the simulation, then deleted or aggregated. |
| Security and access logs | Up to 12 months. |
| Push notification subscriptions | Until you disable reminders or the browser revokes the subscription. |
| AI Tutor conversations | Not retained by us beyond the session; processed transiently by our AI provider. |
Residual copies may persist in encrypted backups for up to 30 days before being overwritten. We may retain information longer where required by law or to resolve disputes.
No method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.
| Technology | Purpose | Duration |
|---|---|---|
| Supabase auth token (localStorage) | Maintain authenticated session | Session duration |
| Progress data (localStorage) | Track lesson and activity completion | Until cleared by user |
| Preferences (localStorage) | Theme, streak and daily-goal settings, installed-app hints | Until cleared by user |
| Push subscription (browser) | Deliver study reminders you enabled | Until you disable notifications |
| Service worker cache | Faster loading and offline access to pages you visited | Refreshed on each new release |
We do not use third-party tracking cookies, advertising cookies, or analytics cookies.
Contact support@core-aiowl.org. We will respond within 45 days.
Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states with privacy laws may have similar rights. Contact us to exercise any applicable rights.
The Platform is operated from the United States. If you access it from outside the US, your information may be transferred to and processed in the United States. For EEA/UK/Switzerland users, transfers comply with applicable requirements including Standard Contractual Clauses.
We may update this Privacy Policy from time to time. The “Last updated” date at the top shows the current version. For material changes we will notify you by email or with a notice on the Platform before the change takes effect. Continued use after that date means you accept the updated Policy.
Questions, requests or complaints about this Policy or your personal information:
If you are enrolled through your employer, you may also direct requests about your training data to your organization’s administrator, who controls that data.
Last updated: September 26, 2026 · Effective: September 26, 2026
By accessing or using the C.O.R.E. platform, a cybersecurity training platform operated by Core Cybersecurity, LLC, you agree to be bound by these Terms of Service. If you do not agree, you may not use the Platform.
If you are using the Platform on behalf of an organization, you represent that you have the authority to bind that organization to these Terms.
You agree not to:
All content on the Platform — including lessons, videos, quizzes, activities, graphics, text, software, and design — is the exclusive property of Core Cybersecurity, LLC or its licensors and is protected by United States and international intellectual property laws.
You may access content solely for personal educational purposes. You may not reproduce, modify, distribute, sell, or create derivative works without express written permission.
"C.O.R.E.," "Cyber Operational Risk Education," and associated logos are trademarks of Core Cybersecurity, LLC.
You agree to indemnify and hold harmless Core Cybersecurity, LLC from any claims, liabilities, damages, and expenses arising from your use of the Platform, violation of these Terms, or violation of any law or third-party rights.
The Platform and all content are provided “as is” and “as available”, without warranties of any kind, express or implied, including implied warranties of merchantability, fitness for a particular purpose, accuracy and non-infringement. We do not warrant that the Platform will be uninterrupted or error-free, that defects will be corrected, or that completing the training will prevent any security incident. Security-awareness training reduces risk; it does not eliminate it.
To the fullest extent permitted by law, Core Cybersecurity, LLC and its members, officers, employees and contractors will not be liable for any indirect, incidental, special, consequential or punitive damages, or for any loss of profits, revenue, data or business opportunity, arising out of or related to your use of the Platform, even if advised of the possibility of such damages.
Our total aggregate liability for all claims relating to the Platform will not exceed the greater of (a) the amount paid to us for your access in the twelve months preceding the claim, or (b) one hundred US dollars (USD 100). Some jurisdictions do not allow certain limitations; in those jurisdictions our liability is limited to the extent permitted by law.
These Terms are governed by the laws of the State of Ohio and the federal laws of the United States, without regard to conflict-of-law rules. Before starting any formal proceeding you agree to contact us at support@core-aiowl.org and to try in good faith to resolve the dispute informally for 30 days. Any dispute that is not resolved informally will be brought exclusively in the state or federal courts located in Licking County, Ohio, and you consent to their jurisdiction. Nothing in this section prevents either party from seeking injunctive relief to protect intellectual property or confidential information.
We may revise these Terms. The “Last updated” date shows the current version; material changes will be announced by email or on the Platform before they take effect. Continued use after that date means you accept the revised Terms. If any provision is held unenforceable, the remaining provisions stay in force. These Terms, together with the Privacy Policy and any agreement between your organization and Core Cybersecurity, LLC, are the entire agreement regarding the Platform.