Allure Training OS Privacy Policy

Allure Training OS ("Training OS") is provided by Vig Solutions LLC, a Florida limited liability company ("Allure", "we", "us"). We are the controller of the personal data described here. This policy explains how we collect, use, disclose and protect your information when you use Training OS.

It sits alongside the Allure family Privacy Policy at allureplatform.com/legal/privacy (opens in a new tab). If they differ, this policy wins for Training OS.

Personal Information

We collect information that you provide directly to us, including:

• Name and email address
• Username and password
• Payment information (processed securely through Stripe)
• Profile information (avatar, bio, company name)
• Content you upload (SCORM files, videos, PDFs)
• Skills you declare on your profile or courses, with a self-rated level
• Text you paste into profile import or AI help (for example, a résumé)
• Messages visitors send you through your portfolio contact form
• Reviews, endorsements and recommendations others give you through your links
• Comments, and the name and email if they give them, from people you invite to review your work through a review link

Usage Information

We automatically collect certain information about your device and how you interact with our Service:

• Log data (IP address, browser type, pages visited)
• Device information (device type, operating system)
• Analytics data (page views, time spent, features used)
• Cookies and similar tracking technologies

Information We Derive

When you upload a course package, we derive the skills it teaches from its activity titles and types (see section 3A) unless you have turned skill indexing off in Settings → Privacy. This activity-title path does not read your videos, slides, files, portfolio, name or email. Section 3C separately covers bounded authored-content analysis and its notice period.

We use the information we collect to:

• Provide, maintain, and improve our Service
• Process your transactions and send related information
• Send you technical notices, updates, and support messages
• Respond to your comments and questions
• Monitor and analyze trends, usage, and activities
• Detect, prevent, and address technical issues and security threats
• Personalize your experience and provide content tailored to you
• Suggest the skills your courses teach, using AI (section 3A)
• Contribute pseudonymised skill data to the Allure Skill Graph (section 3B)

Legal bases (EU, EEA and UK): contract, for running your account, portfolio, share pages and subscription; legitimate interests, for security, product analytics, skill indexing and the Allure Skill Graph (you can object, section 7); consent, for marketing emails; and legal obligation, for tax and accounting records.

Activity-title skill indexing (authored-content analysis is separately covered by section 3C): when you upload a course package, Allure Connect (our sister product, which hosts and delivers your packages) sends its activity titles and types to the OpenAI API (OpenAI, L.L.C.). It does not send your files, profile, name or email. OpenAI excludes API data from training by default; training requires explicit opt-in. Abuse-monitoring records may be retained for up to 30 days, or longer when legally required or necessary to prevent harm. OpenAI is our only AI provider. If AI processing is unavailable, a keyword method on our own platform is used instead.

Skill indexing is on by default; you can turn it off for future uploads at any time in Settings → Privacy. For activity-title indexing, turning it off does not remove skill tags already generated for past uploads, but no new packages will be sent for indexing.

Unless you opt out, Training OS contributes to a shared Allure Skill Graph: course structure fingerprints, the skills your courses teach, the skills you claim (marked "claimed", never treated as verified), and a keyed code identifying you as the creator. For this activity-title contribution, your name, email, course titles, files and portfolio text are never included. Other users only ever see totals and benchmarks derived from the graph, never your identifiable data.

Purpose and basis. Vig Solutions LLC is the controller for this Training OS feature. We use legitimate interests, not consent, to suggest skills for the creator’s own eligible public authored content and maintain the Allure skills graph. Notice acknowledgment and a default preference are not GDPR consent. The linked Legitimate Interests Assessment explains purpose, necessity and balancing, including the opt-out and exclusion of learner data and sensitive content.

Information and processing. Training OS stores a private original-source copy and creator/workspace identifiers, verified destination tenant, notice version, email sent-at time and delivery status, dashboard delivery time, effective date, preference revision and decision time, source digests, bounded outlines, processing/audit records and proposed mappings. The preference applies only to the creator’s verified family tenant. Allure Connect sends bounded lesson text, headings, captions, image descriptions, quiz questions and objectives to the OpenAI API; it does not send learner activity or assessment results. Authored text may itself contain personal information. Sensitive content, learner exports and private, passphrase-protected, NDA, archived or unpublished material are excluded.

When the default applies. New creators must accept the updated Terms and Privacy Policy at signup and see the current product notice. Existing creators remain held until 30 full days after both the required email and dashboard notice are delivered, unless they explicitly turn analysis on early. The later delivery determines the effective date, which never moves earlier. Existing opt-outs, per-upload skips, tenant restrictions and operator holds remain authoritative. The separately authorized owner cohort is unchanged.

OpenAI processing. OpenAI’s published API policy says API data is not used to train or improve its models by default, unless the API customer explicitly opts in. By default its abuse-monitoring logs, which may include prompts and responses, are retained for up to 30 days, with longer retention where required by law or reasonably necessary to protect services or third parties from harm. Some API features also retain application state under endpoint-specific rules. We do not promise zero retention. See OpenAI API data controls for the current policy; section 11 below covers international transfers.

Retention. Private analysis-source copies are deleted on opt-out or withdrawal, or 12 months after the item is deleted or unpublished, whichever comes first, through durable cleanup. Bounded outlines and mappings are kept while the content exists, subject to withdrawal and applicable rights. Audit and security records follow the existing retention schedule in section 6; this update does not extend it. Completed external processing cannot be undone.

Controls and rights. Skip an upload or turn analysis off at any time in Settings → Privacy, during or after the notice period. Turning it off stops new analysis, queues withdrawal of earlier mappings and deletes private analysis-source copies through durable cleanup. Contact info@trainingos.com for applicable access, correction, objection, restriction or deletion rights. Ordinary hosting and playback remain available.

Legitimate Interests Assessment · OpenAI API data controls (opens in a new tab)

We do not sell, trade, or rent your personal information to third parties. We may share your information in the following situations:

• Service Providers: With the providers listed in section 9, under contracts that limit their use of your data
• Allure Connect: Our sister product hosts and delivers your course packages, and indexes their skills (sections 3A/3B)
• Legal Requirements: When required by law or to protect our rights
• Business Transfers: In connection with any merger, sale of company assets, or acquisition
• With Your Consent: When you explicitly consent to sharing
• Other users: Only totals and benchmarks from the Allure Skill Graph, never identifiable data

We implement appropriate technical and organizational security measures to protect your personal information. These include:

• Encryption of data in transit (HTTPS/TLS)
• Encryption of data at rest
• Security monitoring and logging
• Access controls and authentication
• Secure payment processing through Stripe (PCI DSS compliant)

However, no method of transmission over the Internet is 100% secure. While we strive to protect your personal information, we cannot guarantee its absolute security.

We retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

When you delete your account, we will delete or anonymize your personal information within 30 days, except where we are required to retain it for legal purposes. Backups expire on their provider's schedule. Allure Skill Graph data contains no name or email; it is kept as the Allure family Privacy Policy describes.

Depending on your location, you may have the following rights:

• Access: Request access to your personal information
• Correction: Request correction of inaccurate information
• Deletion: Request deletion of your personal information
• Data Portability: Request a copy of your data in a portable format
• Opt-out: Opt-out of marketing communications
• Withdraw Consent: Withdraw consent where we rely on consent
• Object: Turn off skill indexing at any time in Settings → Privacy, or object to your data contributing to the Allure Skill Graph. We honor objections to the Skill Graph

To exercise these rights, email info@trainingos.com. We may need to confirm who you are. You can use an authorised agent. If we turn down your request, you can appeal by replying to our decision. You can also complain to your data protection authority.

US state rights. Residents of California and other US states with privacy laws can ask to know, get a copy of, correct and delete their personal information. We collect the categories in section 2 for the purposes in section 3, and disclose them only as section 4 describes. We do not sell personal information, share it for cross-context behavioural advertising, or use sensitive personal information to infer characteristics about you. We treat a Global Privacy Control signal as a request to opt out. We will not treat you differently for using your rights.

We use cookies and similar tracking technologies to track activity on our Service and hold certain information. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent.

We use the following types of cookies:

• Essential Cookies: Required for the Service to function
• Analytics Cookies: Help us understand how you use the Service
• Preference Cookies: Remember your settings and preferences

We do not use advertising cookies. Our web analytics (Vercel Web Analytics) count page views without cross-site tracking. Portfolio and share-page viewers who are not signed in get an anonymous id so views can be counted.

Our Service may contain links to third-party websites and services. We are not responsible for their privacy practices.

These service providers (subprocessors) process personal data for us, under contracts that limit their use of it:

• Clerk: Sign-in and accounts
• Convex: Database and backend
• Vercel: Hosting, web analytics, and file storage (Vercel Blob) for videos, PDFs and images
• Allure Connect (Allure): Course package hosting, delivery and skill indexing
• Cloudflare R2 (through Allure Connect): Course package storage
• OpenAI, L.L.C. (OpenAI API): AI skill indexing of activity titles and types and bounded authored-content outlines (via Allure Connect, section 3C), and AI profile help and profile import when you use them
• Resend: Account, notification and review emails
• Sentry: Error tracking, with personal data minimised
• Stripe: Payments and tax calculation; card details stay with Stripe
• Unsplash: Stock image search; receives your search terms, not your account details

Training OS is for adults. You must be at least 18 to use it. We do not knowingly collect personal data from anyone under 18. If you think a child has given us personal data, contact info@trainingos.com and we will delete it.

Our systems are in the United States. When we transfer personal data from the EU, EEA, UK or Switzerland, we use approved safeguards, such as Standard Contractual Clauses (with the UK Addendum) or a provider's certification under the EU-US Data Privacy Framework.

We will post changes here and update the date and version. For material changes, we will email you and show a notice in your dashboard at least 30 days before they apply.

Training OS is provided by Vig Solutions LLC, a Florida limited liability company, 3564 Avalon Park E Blvd Ste 1-A602, Orlando, FL 32828. Questions about this Privacy Policy, privacy requests, skill indexing or the Allure Skill Graph: info@trainingos.com.