Privacy Policy

1. Who controls the information

Pshichenko Enterprises Inc. operates Pass The CSLB. This policy applies to passthecslb.com, customer accounts, Practice Mix, episode quizzes, support, and membership administration.

2. Information collected

• Account: Firebase UID, email, verified-email status, display name, authentication provider, and sign-in timestamps.
• Study activity: episode progress, assigned Practice questions, answers, attempts, scores, missed-question and mastery history, resume position, and manual “Mark as studied” state.
• Billing projection: Stripe customer and subscription identifiers, subscription state, access dates, invoices or charge references, refund state, and policy-consent evidence. Complete card numbers are handled by Stripe, not Pass The CSLB.
• Feedback and support: category, message, reply preference, email when supplied, and related account ID when signed in.
• Service analytics and security: page and feature events, coarse device/browser information, random visitor/session identifiers, truncated user agent, and protected hashes used for abuse prevention.

3. Uses

Information is used to authenticate customers, maintain membership access, save and synchronize study progress, prevent repeated Practice assignments, process billing events, send transactional notices, provide support, improve the product, prevent abuse, reconcile systems, and comply with legal obligations.

Account creation does not opt anyone into marketing. Marketing email is off at launch.

4. Service providers

Firebase provides authentication, database, and storage services; Stripe provides hosted payments, invoices, receipts, and billing management; SendGrid provides application transactional email; Vercel hosts the website; and YouTube hosts public episode videos. Each provider processes information under its own terms and privacy commitments.

5. Cookies and browser storage

Firebase local authentication persistence keeps customers signed in on the same browser profile until they sign out or browser data is cleared. A secure, HttpOnly server session cookie authorizes protected website requests. Local and session storage may retain free-demo progress, playback position, analytics identifiers, and the email address used to finish a passwordless sign-in on the same device.

6. Retention

Pass The CSLB limits retention by record purpose. The following periods are operational targets and may be extended when law, a dispute, fraud prevention, security investigation, accounting duty, or preservation obligation requires it:

• Account profile and saved study data: while the account is active, then deleted with an eligible verified deletion request.
• Recurring-billing consent and policy evidence: at least three years after consent or one year after the related agreement ends, whichever is longer.
• Invoices, payments, refunds, tax, billing notices, and related audit evidence: generally seven years after the transaction or the period required by applicable accounting and tax rules.
• Security, rate-limit, sign-in, and operational logs: generally up to 24 months unless an incident or legal claim requires longer preservation.
• Support and feedback: while needed to resolve the request and improve or defend the service; identity fields are removed when an eligible account-deletion request is completed unless retention is required.
• Transactional email activity: according to the configured SendGrid retention period and longer only when delivery evidence is required for billing or legal notices. Pass The CSLB disables SendGrid open and click tracking for these messages.

7. Browser privacy signals and third-party collection

Pass The CSLB does not sell personal information, share it for cross-context behavioral advertising, or track a person's activity over time across unrelated websites. Because the service does not perform that cross-site tracking, legacy browser "Do Not Track" signals do not change its first-party operational analytics. Where legally required and technically applicable, recognized opt-out preference signals are honored.

Firebase or a selected sign-in provider receives information during authentication; Stripe receives information when a customer opens Checkout or the billing portal; and YouTube may receive device, network, playback, and account information when its player loads or a customer follows a YouTube link. Those providers control their own processing under their published terms and privacy policies.

8. Security and customer controls

Pass The CSLB uses server-side authorization, restricted database rules, verified Stripe webhooks, encrypted transport, secure cookies, least-privilege administrative access, rate limits, and audit records. No online service can promise absolute security.

Customers may request access, correction, deletion, or a portable copy of applicable personal information from the Account page or by contacting support. The internal target is to complete eligible account and study-data deletion within 30 days. A paid account may remain available until its already-paid period ends, and some billing, consent, fraud-prevention, security, audit, and legal records may be retained or require a longer lawful response period. Completion is confirmed by email.

9. California privacy rights

California residents may have rights to know the categories, sources, purposes, and recipients of personal information; access specific information; correct inaccurate information; delete eligible information; obtain a portable copy; limit certain uses of sensitive information; opt out of sale or sharing; and receive equal service when exercising those rights. Pass The CSLB does not sell personal information, does not share it for cross-context behavioral advertising, and does not use sensitive personal information to infer characteristics.

Requests may be submitted through the signed-in Account page or to support@passthecslb.com. Pass The CSLB verifies requests in proportion to their sensitivity and may ask for additional information when necessary. An authorized agent may submit a request where permitted by law, subject to proof of authority and identity verification. Customers may appeal a denied request by replying to the decision email.

10. Policy changes

The effective date of this policy is July 17, 2026. A material change will be posted here with a new effective date and communicated directly when required by law. Prior versions and their source hashes are retained with the related membership-consent evidence.

11. Children

The service is intended for adults preparing for California contractor licensing. It is not directed to children under thirteen, and Pass The CSLB does not knowingly collect their personal information.

12. Contact