CRA3D Privacy Notice — v2.0

CRA3D (Career Repath Assessment: Three Directions) is a brand founded by Mark Dean.

What we collect

• Account fields: your email, a password (stored as a bcrypt

hash, never in the clear), an optional display name, your role (participant or admin), and timestamps.

• Consent records: which policies you consented to and when,

plus a hash of your IP at the time of consent (the raw IP is not stored).

• Assessment / portfolio content: the narratives and responses

you enter into CRA3D.

• Session tokens: short-lived JWTs; you can invalidate all

outstanding sessions at any time from Settings.

• LLM usage records: provider, model, token counts, estimated

cost, latency, and whether the call succeeded. We do not store your raw prompts or the narratives you submit in these usage logs.

What we do NOT collect

• We do not use tracking pixels, third-party analytics, or

advertising trackers.

• Certain transactional emails, such as password reset requests,

are sent from support@cra3d.com via our email provider. We do not send marketing email. If a send fails, an administrator can retrieve the reset link and share it out of band.

• We do not sell your data.

How AI is used

When you use AI features, your input is sent to a large-language-model provider (currently an OpenAI-class model, via a provider-independent layer that lets us swap providers). AI outputs are best-effort suggestions and may be wrong. We do not send your data anywhere else.

Your rights

• Export: you can download a JSON export of your account data

at any time from Settings.

• Delete: you can permanently delete your account and all

associated data from Settings. Deletion is not reversible.

• Revoke sessions: you can log out of every device at once from

Settings.

Data retention

Data is retained until you delete your account. Anonymized deletion audit entries (a timestamp and an irreversible hash of the account id) are kept so we can answer "did this account exist and when was it deleted?" without exposing your identity.

Aggregate cost accounting after account deletion

After you delete your account, CRA3D retains a limited set of de-identified aggregate usage records for cost accounting — timestamp, provider, model, token counts, estimated cost, latency, task category, and whether the call succeeded. These rows contain no personal content and no link to your account: any prior user identifier is replaced with an irreversible tombstone identifier during the deletion sweep, and we never store your raw prompts, assessment answers, generated content, email, or any other account-linked field on these rows. They cannot be re-linked to you.

Where we sell

CRA3D currently sells to customers in the United States only.

Please do not enter confidential information

Do not enter information that is confidential, subject to non-disclosure, protected health information, or otherwise sensitive.

Changes

We may update this notice. When we do, we will bump the version number and record the effective date.

Contact

Email support@cra3d.com for privacy questions. Our response target is two business days.