Privacy Policy

Last updated: October 27, 2026

CPRToday! Inc. ("CPRToday!", "we", "us") operates the online CPR, BLS, First Aid, ACLS, PALS and related training courses available at cprtoday.com and firstaidweb.com. This Privacy Policy explains what personal information we collect, why we collect it, who we share it with, how long we keep it, and the choices and rights you have over it. It applies to our websites, our student and group-administrator dashboards, and the Google Sign-In integration described below.

This policy is incorporated into our Terms of Use. If you do not agree with it, please do not use our websites or services.

1. Information We Collect

Information you give us

  • Account information. Your first and last name, email address and password when you register for a free account. Registration is required to take a course and to have a certificate issued in your name.
  • Order and billing information. When you purchase a certificate, we collect your billing name, billing address and the details needed to complete the transaction. Card numbers are submitted to our payment processor and are not stored on our servers.
  • Course and certification records. The courses you enroll in, your progress, exam attempts and scores, completion dates, and the name and details printed on any certificate issued to you. These records support certificate verification by employers and licensing bodies.
  • Group and employer information. If your employer or school enrolls you through a group or corporate account, we receive the information they supply (typically your name, email address and assigned courses) and we report your completion status back to the administrator of that account.
  • Communications. Messages you send us through contact forms, email or support requests, including anything you choose to include in them.

Information we receive from Google Sign-In

You can create an account or sign in using your Google Account instead of a password. This is optional; an email-and-password option is always available. See section 3 for full details of how this data is handled.

Information collected automatically

  • Device and connection data. IP address, browser type and version, operating system, device type and screen size, and referring URL.
  • Usage data. Pages viewed, links and buttons clicked, time spent on course material, and the dates and times of your visits.
  • Cookies and similar technologies. Described in section 5.

We do not ask for, and ask that you do not send us, government identification numbers, health or medical records, or other sensitive categories of personal information. We are not a healthcare provider, and our course and certification records are not medical records.

2. How We Use Information

We use the information described above to:

  • Create, authenticate and maintain your account;
  • Deliver course material, track your progress and administer exams;
  • Issue, deliver and verify certificates, and respond to verification requests about a certificate you hold;
  • Process payments, issue receipts and handle refunds under our money-back guarantee;
  • Provide customer support and respond to your questions;
  • Send service messages such as password resets, receipts, course completion notices and certificate expiration reminders;
  • Send marketing messages about our courses, where permitted and subject to your right to opt out at any time;
  • Report completion status to the group or corporate administrator who enrolled you, where applicable;
  • Monitor, secure, troubleshoot and improve our websites and courses;
  • Detect and prevent fraud, abuse of promotions, and unauthorized access; and
  • Comply with legal obligations and enforce our Terms of Use.

3. Google Sign-In and Limited Use of Google User Data

If you choose "Sign in with Google", we use Google Identity Services to authenticate you. We request only the following non-sensitive scopes:

  • openid — a unique identifier for your Google Account;
  • email — your Google Account email address and whether it is verified;
  • profile — your basic profile information, such as your name and profile picture.

We use this information for one purpose only: to create your CPRToday! account and to sign you in to it. Your name and email address populate your account and the certificate issued to you; the Google account identifier is stored so that we can recognize you on your next sign-in.

We do not request access to your Gmail, Google Drive, Contacts, Calendar or any other Google service, and we cannot read, modify or delete any of your Google data.

CPRToday!'s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Specifically, data received from Google APIs is:

  • used only to provide and improve the sign-in and account features described above;
  • never transferred to others except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition;
  • never used for advertising, ad targeting, ad personalization or retargeting;
  • never sold; and
  • never read by a human, except with your explicit consent for a specific support request, where required for security or abuse investigations, or where required by law.

You can disconnect CPRToday! from your Google Account at any time at myaccount.google.com/permissions. Doing so stops future Google sign-ins; it does not delete your CPRToday! account, your course history or any certificate already issued. To delete those, see section 8.

4. How We Share Information

We do not sell your personal information, and we do not share it with third parties for their own marketing. We share it only as follows:

  • Payment processors. Authorize.net processes card payments on our behalf. They receive the billing and card details needed to complete the transaction and handle them under their own privacy policy.
  • Service providers. Hosting, email delivery, customer support, analytics and security vendors who process information on our instructions and only to perform services for us.
  • Group and corporate administrators. If you were enrolled through a group or employer account, that administrator can see your enrollment, progress and completion status.
  • Certificate verification. When you or a third party uses our certification verification tool, we confirm the validity, holder name, course and dates of the certificate presented. This is the purpose for which certificates exist.
  • Legal and safety. Where we reasonably believe disclosure is required by law, subpoena or court order, or is necessary to protect the rights, property or safety of CPRToday!, our users or the public, or to investigate fraud or abuse.
  • Business transfers. In connection with a merger, acquisition, financing or sale of assets, subject to this policy continuing to apply to the transferred information.

5. Cookies and Similar Technologies

We use the following categories of cookies and similar technologies:

  • Strictly necessary. Session cookies that keep you signed in, protect against cross-site request forgery, and remember your language preference. The site will not function correctly without these.
  • Security. Google reCAPTCHA, which helps us tell human visitors from automated abuse. reCAPTCHA collects device and behavioral signals and is governed by the Google Privacy Policy and Terms of Service.
  • Analytics and advertising. Described in section 6.

Most browsers let you refuse or delete cookies through their settings. If you block strictly necessary cookies, you will not be able to sign in or complete a course.

6. Analytics and Advertising

We use the following third-party services to understand how our site is used and to measure our advertising:

As stated in section 3, information received through Google Sign-In is never used for advertising or ad targeting.

We honor Global Privacy Control (GPC) signals where required by law. Because tracking technologies are not yet uniformly standardized, we do not respond to browser "Do Not Track" headers.

7. Data Retention

We keep personal information only as long as we need it:

  • Account and course records are kept while your account is active. Registration is free for life, so accounts remain open until you ask us to close one.
  • Certification records are kept for at least the lifetime of the certificate plus seven years, so that employers and licensing bodies can verify a certificate after it has expired. This is the one category we may retain after an account is closed.
  • Transaction records are kept for as long as required by tax, accounting and anti-fraud obligations, typically seven years.
  • Support correspondence is kept for up to three years.
  • Server and security logs are kept for up to twelve months.

8. Security

We protect your information with HTTPS encryption in transit, hashed password storage, access controls limiting staff access to what their role requires, and a payment flow that keeps card numbers off our servers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Use a strong, unique password, and tell us promptly at support@cprtoday.com if you believe your account has been accessed without your permission.

9. Your Choices and Rights

You may, at any time:

  • Access and correct the information in your account from your student dashboard, or by writing to us;
  • Request a copy of the personal information we hold about you;
  • Request deletion of your account and personal information, subject to the certification and transaction records we are required to retain under section 7;
  • Opt out of marketing email using the unsubscribe link in any marketing message, or by writing to us. You will continue to receive service messages about your account, purchases and certificates;
  • Disconnect Google Sign-In as described in section 3.

To exercise any of these rights, email support@cprtoday.com from the address on your account, or use our contact form. We will respond within 45 days. We will not discriminate against you for exercising any of these rights.

10. California Privacy Rights

CPRToday! Inc. is based in California. If you are a California resident, the California Consumer Privacy Act, as amended by the CPRA, gives you the rights to know what personal information we collect and how we use and disclose it, to request access to and deletion of that information, to correct inaccurate information, and to opt out of the sale or sharing of personal information and of targeted advertising.

We do not sell personal information, and we have not sold personal information in the preceding twelve months. We do not knowingly sell or share the personal information of anyone under 16. Our use of advertising cookies described in section 6 may constitute "sharing" for cross-context behavioral advertising under California law; you can opt out by rejecting advertising cookies in your browser or by sending a GPC signal.

The categories of personal information we have collected in the preceding twelve months are identifiers, customer records, commercial information, internet activity, and inferences drawn from them, each as described in section 1, used for the purposes in section 2 and disclosed to the categories of recipients in section 4. You may use an authorized agent to make a request on your behalf; we may ask for proof of authorization.

11. Children's Privacy

Our services are intended for adults and for students old enough to meet the requirements of an employer, school or licensing body. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has given us personal information, contact us at support@cprtoday.com and we will delete it.

12. International Users

Our services are operated from the United States and our certifications are intended for use in the United States. If you access our services from outside the United States, your information will be transferred to, stored in and processed in the United States, where data protection law may differ from the law of your country.

Our websites link to sites we do not control. We are not responsible for the content or data practices of those sites. Review the privacy policy of any site before providing it with personal information.

14. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of the page reflects the most recent revision. If we make a material change to how we handle personal information, we will provide notice on this site, and by email where required by law, before the change takes effect.

15. Contact Us

For any question about this Privacy Policy, or to exercise any right described in it, contact:

CPRToday! Inc.
Email: support@cprtoday.com
Web: cprtoday.com/contact-us