Ethics Builder Privacy Policy

Who uses Ethics Builder

• Students take the Business Ethics and Society course, usually as part of a class taught at a college, university, or employer.
• Instructors run class sessions, grade work, and see their students' progress.
• Organization administrators manage their institution's classes and licenses.
• Merit Leadership staff operate the platform and support users.

When your school or employer provides Ethics Builder, it decides which classes you join and may have its own agreement with us. Where that agreement says something different from this policy about student records, the agreement controls.

What we collect

Account information. Your name, email address, role, and account status. Optionally a phone number, a student or employee ID, and a profile photo, if you or your institution provide them. We record when you last signed in.

Sign-in information. We sign you in with a link or a six-digit code sent to your email. We never ask for or store a password. We store only scrambled (hashed) versions of sign-in links and codes, which expire after 10 minutes. A signed-in session lasts up to 7 days.

Course work. Your activity responses, assignment submissions, scores, instructor feedback, reading progress in the book, and notes or highlights you make in the book.

AI Ethics Advisor conversations. The messages you send the Advisor, its replies, and a daily count of how many messages you sent and how much text was processed. The count is used to apply a daily limit and to track cost.

Enrollment and payment records. The classes you are enrolled in, and for paid enrollments the amount, date, status, discount or promo code used, and Stripe's reference number. Card details are entered on Stripe's checkout page. We never see or store your card number.

Instructor access requests. If you request an instructor account, the details you submit (name, school email, institution, course, term, expected class size, and any message) and the IP address the request came from.

Organization inquiries. If you ask about the program for organizations, the details you submit (name, work email, job title, company, company size, whether you want the book and agree to be contacted, and, if you give them, your country, a mailing address for the book, and any notes) and the IP address the request came from. We email you a confirmation. Merit Leadership staff receive a copy by email, track its progress, and may add notes to it. We use these details to answer your inquiry and to spot repeat or automated requests, and we keep them until you ask us to delete them.

Technical information. Our hosting provider records standard request logs, including IP address, browser type, and the pages requested. To protect sign-in and registration from abuse, we keep counters keyed by email address and by IP address, and delete them after one day. When something fails in production (for example an email that could not be sent), we log the failure with the email's domain, not the full address, and delete those logs after 90 days.

Cookies. We use one cookie, eb_auth, to keep you signed in. It is sent only over encrypted connections and cannot be read by scripts on the page. We do not use advertising cookies, analytics cookies, or tracking pixels.

How we use it

• To run the course: show you your classes, save your work, score activities, and let your instructor grade and give feedback.
• To sign you in and keep your account secure.
• To send the emails the service needs: sign-in links and codes, invitations, and messages about your classes. We do not send marketing email from Ethics Builder.
• To answer your questions in the AI Ethics Advisor.
• To process payments and refunds.
• To support users, fix problems, prevent abuse, and keep the service reliable.
• To produce course and class statistics for instructors, institution administrators, and Merit Leadership, such as completion rates and grade distributions.

We do not sell personal information. We do not use it for advertising. We do not use student course work to train AI models.

Who can see your information

• Your instructor for a class can see your work, scores, and progress in that class.
• Administrators at your institution can see enrollment, progress, and grades for their institution's classes.
• Merit Leadership staff can see account and course information to operate and support the platform.
• Content developers who help write course activities do not see student accounts or student work.

Certificates. If you earn a certificate, it has its own page so that anyone you share it with, such as an employer, can confirm it is genuine. Anyone with the link can see that page without signing in. It shows your name, the certificate's title, the date it was issued, its serial number, and, where they apply, the hours and your organization, and, if the certificate has been revoked, when and the reason given. The link contains a random code that cannot practically be guessed, and we ask search engines not to list these pages. If your account is anonymized at your request, your name is removed from the page. The certificate itself, including any revocation notice, is kept.

We use these service providers (sub-processors) to run Ethics Builder. Each receives only what it needs for its part of the service:

This list reflects the providers the code actually calls as of the date at the top of this policy.

We may also disclose information if the law requires it, to protect the safety of users or the public, or as part of a sale or reorganization of Merit Leadership, in which case this policy continues to apply to the information transferred.

California and other state privacy rights (CCPA/CPRA)

When a U.S. school or employer provides Ethics Builder to its students or employees, Merit Leadership acts as a “service provider” for that institution's personal information, as that term is used in the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA): we process the information only to provide Ethics Builder on the institution's behalf and for no other purpose, and we do not sell or share it. Our sub-processors, listed above, are bound the same way.

A data processing addendum describing these commitments in more detail is available on request: write to hello@meritleadership.com.

The AI Ethics Advisor

When you use the Advisor, your conversation is sent to Anthropic to generate replies. Under Anthropic's commercial terms, it does not use this content to train its models.

Please do not share sensitive personal information, such as health or financial details, with the Advisor. You can delete a conversation at any time from the Advisor page.

Student records and FERPA

When a U.S. school provides Ethics Builder to its students, student course records are education records under the Family Educational Rights and Privacy Act (FERPA). In that case:

• We act as a “school official” with a legitimate educational interest, under the school's direct control over how those records are used and kept.
• We use the records only to provide Ethics Builder to the school and its students, and we do not disclose them to anyone else except the service providers above, as the school directs, or as the law requires.
• Requests to see, correct, or delete education records should go through the school, and we will help the school respond.
• When a school's agreement with us ends, we will delete or return its students' records on the school's written request, except where the law requires us to keep them.

How long we keep information

• Account and course records are kept while your account is open and for as long as your institution needs them for its records, unless you or your institution ask us to delete them.
• Sign-in links and codes expire after 10 minutes. Sessions end after 7 days.
• Abuse-prevention counters are deleted after one day. Failure logs are deleted after 90 days.
• Advisor conversations are kept until you delete them or your account is deleted.
• Backups of the database are kept for 30 days and then deleted. They are stored on encrypted disks, and access is limited to Merit Leadership administrators.
• Payment records are kept as long as tax and accounting law requires.

Your choices and rights

You can:

• See and update your name and profile photo on your profile page.
• Ask for a copy of your information, a correction, or deletion of your account by writing to hello@meritleadership.com. If your account was provided by a school or employer, we may need to confirm the request with them first. We will respond within 30 days.
• Delete your Advisor conversations yourself at any time.

Depending on where you live, you may have additional rights under state law. We will honor requests made under those laws.

Children

Ethics Builder is designed for college students and working adults. It is not directed to children under 13, and we do not knowingly collect information from them. If you believe a child under 13 has created an account, contact us and we will delete it.

Security

We protect information with encrypted connections, sign-in without passwords, hashed sign-in tokens, role-based access so each person sees only what their role allows, and regular backups. No system is perfectly secure. If we learn of a breach that affects your information, we will notify you and your institution as the law requires.

Where information is stored

Ethics Builder is operated from the United States, and our service providers store information in the United States.

Changes to this policy

We will post any changes here and update the effective date. If a change materially affects how we use information we already hold, we will notify account holders by email before it takes effect.