Privacy Policy

This policy explains what Draco Staff Development, LLC, doing business as Draco BLS ("we," "us," or "our"), collects when you use dracobls.com, why we collect it, who else sees it, and what you can ask us to do with it. It applies to this website and to the certification classes booked through it.

1. What We Collect

1.1 Information You Give Us

When you enroll in a class, the form asks for:

• Your name — first name, last name and middle initial. This is printed on your certification card, so it has to match the name you want on it.
• Contact details — email address and phone number, used to send your confirmation, class reminders and certificate, and to reach you if a class changes.
• Mailing address — street, city, state and ZIP code, required by the American Heart Association for certification records.
• A password, which is stored only as a one-way hash. We cannot read it, and neither can anyone who obtains a copy of our database.
• A discount code, if you were given one.

If you contact us through the site, we keep the message and the address you sent it from so we can reply.

1.2 Payment Information

We never see or store your card details. Payment is handled entirely by Stripe on Stripe's own checkout page. Your card number does not pass through this website and is not stored on our servers. What we receive back from Stripe is a payment confirmation, the amount, and a reference we can use to look the transaction up.

1.3 Information Created by Your Use of the Site

• Your enrollment and certification history — which classes you booked, attended and passed, the certificates issued to you, and their expiry dates.
• Online course progress — which sections you have completed and your quiz results, if you are taking a hybrid course.
• Sign-in records — the time and IP address of sign-in attempts. We keep these to lock an account after repeated failed attempts, and they are deleted automatically after 24 hours.
• A session cookie, which keeps you signed in. It is strictly necessary for the site to work and carries no advertising or tracking identifier.

2. Why We Collect It

We use your information to:

• Register you for the class you booked and hold your seat.
• Take payment for that class.
• Send your confirmation, class reminders, roster details and certificate.
• Issue and verify your certification, and maintain the records the American Heart Association requires us to keep as an authorized training site.
• Answer your questions and handle rescheduling.
• Keep the site secure — for example, blocking automated sign-in attempts.

We do not sell your personal information, and we do not share it for advertising. We do not send marketing email unless you ask us to; the mail you receive from us relates to a class you booked or a certificate you hold.

3. Who Else Sees It

Only the parties below, and only for the purpose named:

• The American Heart Association and our AHA Training Center — the details needed to issue and register your certification card. This is a condition of the certification itself.
• Stripe — processes your payment. Your card details go to Stripe directly, under Stripe's own privacy policy.
• SendGrid — delivers our email. It handles your name and email address in order to send the message.
• Google reCAPTCHA — runs on our sign-in and enrollment forms to tell people from bots, and is subject to Google's privacy policy.
• Your employer or facility — only where that facility arranged and is paying for your training, and only the fact of your attendance and completion.

We will also disclose information where the law requires it, or where it is necessary to establish or defend a legal claim.

4. Certificate Verification

Each certificate we issue carries a verification link. Anyone holding that link — typically an employer checking your card is genuine — can confirm the certificate is valid and see the name on it, the course, and the issue and expiry dates. The verification page shows nothing else: no address, no phone number, no email. The link cannot be used to look up a person; it only confirms a specific certificate you have chosen to show someone.

5. How Long We Keep It

Certification records are kept for as long as the American Heart Association requires an authorized training site to retain them, and afterwards for as long as we may need them to re-issue a card or answer a verification request. Sign-in attempt records are deleted after 24 hours. If you ask us to delete your account, we will do so except where a certification record must be retained — in which case we keep only that record and remove the rest.

6. How It Is Protected

• The whole site is served over HTTPS.
• Passwords are stored as one-way hashes, never in a readable form.
• Card details never reach our servers.
• Access to student records requires a sign-in, and administrative functions are restricted to authorized staff.
• Repeated failed sign-in attempts lock the account temporarily.

No system is perfectly secure, and we will not pretend otherwise. If a breach affects your personal information, we will notify you as required by California law.

7. Your Rights

If you live in California, the California Consumer Privacy Act gives you the right to know what personal information we hold about you, to request a copy of it, to ask us to correct or delete it, and not to be treated differently for exercising those rights. Because we do not sell personal information or share it for advertising, there is nothing for you to opt out of on that front.

To make any of these requests, email support@dracobls.com from the address on your enrollment. We will respond within 45 days. You can also see and update most of your own details at any time from your student dashboard.

8. Children

Our classes and this website are intended for adults and working healthcare professionals. We do not knowingly collect personal information from children under 13. If you believe a child has given us information, contact us and we will delete it.

9. Changes to This Policy

If we change how we handle your information, we will update this page and change the "Last Updated" date above. Material changes affecting existing students will be sent by email.

10. Contact Us

Draco Staff Development, LLC, doing business as Draco BLS
Email: support@dracobls.com

See also our Terms and Conditions, which cover enrollment, payment, rescheduling and refunds.