Privacy Policy

OSHA Operator is a private, US-based online training provider operating oshaoperator.com. We are not affiliated with, endorsed by, or operated by OSHA or the U.S. Department of Labor. For any privacy question or request, email support@oshaoperator.com.

• Account and identity: name, email address, password (stored only as a cryptographic hash), preferred language, and the legal name you ask us to print on your certificate.
• Order information: what you purchased, order number, amount paid, and — for wallet cards — the shipping name and mailing address you provide. Payment card details go directly to Shopify's checkout; we never see or store your full card number.
• Training records: course progress, lesson completion, quiz and exam answers and scores, time spent, certificates issued, and card printing and shipping status. Employers who enroll you can see the training records for the seats they purchased.
• Support communications: emails you send us, contact-form submissions, chat conversations with our support assistant (an automated AI assistant, not a human), and reviews or feedback you choose to send. Chat transcripts are stored with a session ID, the page you were on, your IP address, and browser type, and may be forwarded to our support team.
• Usage and device data: pages visited, links clicked, session duration, exit pages, approximate location derived from IP address, browser and device type, and referring page — collected through cookies and similar technologies, including a first-party analytics tool that stores an anonymous session ID on our own backend.
• Advertising identifiers: Google click identifiers (gclid, gbraid, wbraid) and campaign parameters (utm_source and similar) when you arrive from an ad, kept for up to 90 days so we can measure which ads lead to enrollments.

• Create and maintain your account and link purchases to it;
• Deliver the course, record progress, grade exams, and issue certificates and wallet cards;
• Print and mail your wallet card to the address you give us;
• Let employers verify certificates and see training records for seats they purchased;
• Respond to support requests in English or Spanish, 24/7;
• Send transactional emails (receipts, account access, certificate delivery) and, if you opt in, occasional follow-ups — every marketing email includes an unsubscribe link;
• Measure and improve the website, including understanding which pages and ads lead to enrollments;
• Detect fraud, cheating, and abuse, and meet legal or recordkeeping obligations.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising outside the measurement described below.

We share information only with the service providers needed to run the business, and only for the purposes above:

• Shopify — checkout, payment processing, and order records. Shopify's own privacy policy applies to its checkout.
• Shippo and shipping carriers — printing and mailing wallet cards; they receive the shipping name and address only.
• Google (Analytics and Ads) — site measurement and advertising attribution, delivered through Google Tag Manager, as described in the next section.
• OpenAI — an advertising measurement pixel that reports page views, sign-ups, checkouts, and purchases (with order amount and currency) so we can measure ads shown in ChatGPT.
• Reddit — the Reddit Pixel receives page visits, course views, buy/checkout clicks (item count, USD value), and account-created events with random conversion IDs for advertising measurement and optimization. Its requests include browser/device data, page/referrer URLs and IP address, and it may use advertising cookies. We do not send names, emails, addresses or customer matching identifiers to this pixel. Shopify checkout purchase reporting is handled separately.
• Our cloud hosting, database, and authentication provider — stores account, order, and training data on secured servers.
• Our email delivery provider — sends transactional and opt-in emails.
• Our AI chat provider — powers the automated support assistant; chat transcripts may be reviewed by our team to improve support quality.

We may also disclose information if required by law, to enforce our Terms, or to protect the rights and safety of our users. If the business is ever sold or merged, customer information may transfer as part of that transaction, subject to this policy.

We use cookies and similar technologies for these purposes: keeping you signed in and remembering your language choice; measuring site usage through Google Analytics 4 and our own first-party analytics; and measuring ad performance through Google Ads conversion tracking and an OpenAI advertising pixel. Our advertising measurement runs through Google Tag Manager, and conversion measurement extends across our domain and our Shopify checkout so a purchase can be attributed to the ad that brought you — this uses the click identifiers described above, not your payment details.

You can limit this tracking in several ways:

Reddit tracking is disabled in consent-required or unknown regions; this no-banner installation enables only visitors located in the United States. It honors Global Privacy Control, Do Not Track and saved advertising refusals. You can withdraw Reddit tracking for this browser at any time using the button below; the refusal is saved and applies to future events, including in other open tabs. We do not replay events blocked by your choice.

• Block or delete cookies in your browser settings (the site still works, but sign-in and language memory will not);
• Opt out of personalized ads at Google Ads Settings and through the Network Advertising Initiative opt-out;
• Install Google's Analytics opt-out browser add-on.

Where required by law, we treat a Global Privacy Control (GPC) signal from your browser as an opt-out request for that browser.

Training and certification records are kept for as long as your account is active and afterwards as needed so employers can verify certificates and we can meet recordkeeping obligations. Advertising identifiers are kept up to 90 days. Support conversations are kept as long as needed to handle your request and improve support. When information is no longer needed, we delete or de-identify it.

Regardless of where you live, you can ask us to:

• Confirm what personal information we hold about you and provide a copy;
• Correct inaccurate information (for example, the name on a certificate before the card is printed);
• Delete your account and personal information, subject to records we must keep for legal, fraud-prevention, or certificate-verification reasons;
• Opt out of marketing emails at any time via the unsubscribe link.

Email any request to support@oshaoperator.com from the address on your account. We may need to verify your identity before acting, and we will not discriminate against you for exercising these rights.

State privacy laws. If you live in a state with a comprehensive consumer privacy law — including California (CCPA/CPRA), Virginia, Colorado, Connecticut, Texas, and others — you have the rights listed above under those laws, including the right to know, correct, and delete personal information, and to opt out of its sale or sharing. As stated above, we do not sell personal information. Reddit advertising measurement and optimization involve the sharing described in section 4; you may opt out using the Reddit tracking button above or Global Privacy Control. California residents may also designate an authorized agent to make a request on their behalf.

Our training is for adults in the workplace. The website is not directed at children under 13, and we do not knowingly collect personal information from children under 13. Accounts and purchases are limited to users 18 and older. If you believe a child has provided us information, contact us and we will delete it.

We use encryption in transit, hashed password storage, access controls, and payment processing handled entirely by Shopify's PCI-compliant checkout. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security, but we work to protect your information and will notify affected users of a breach where the law requires it.

We are a US-based business serving US workers. Our servers and service providers are located in the United States, and by using the site you understand that your information will be processed in the United States under US law.

We may update this policy from time to time. The "Last updated" date at the top shows the current version, and material changes will be noted on this page. Continued use of the site after an update means you accept the revised policy.

Privacy questions and requests: support@oshaoperator.com, or our contact form. Our US-based team answers 24/7 in English and Spanish.