Privacy Policy

Last updated: October 15, 2026. This policy explains what personal data Good Standing Courses collects when you use goodstandingcourses.com, why, how long we keep it, who else handles it, and what you can do about it. We wrote it in plain English. If anything is unclear, email privacy@goodstandingcourses.com.

• We collect only what we need to sell you a course, count your study time and issue a certificate: your email, your full legal name, an optional US state, your course progress, quiz results and a study-time log.
• We never collect your case number, court or date of birth. If your court needs them on your certificate or enrollment letter, you type them into your own copy of the PDF, in your browser. They are never sent to us.
• Your journal and exercise answers stay on your device. We only record that you completed an exercise.
• Card details go to Stripe, our payment processor. We never see your full card number.
• Our database is stored in the European Union. We do not sell your data, we do not use Google Analytics, and no Google tag or other advertising script runs on our pages. We count page visits with Cloudflare Web Analytics, which sets no cookies and does not track you across sites. If you reach us by clicking one of our Google ads, we keep the ad's click ID in a cookie so that, if you buy, we can tell Google the ad led to a purchase (sections 4 and 10).
• You can ask for a copy of your data or ask us to delete it at any time.

The controller of your personal data is Dzmitry Pliachko, a sole proprietor registered in Poland and doing business as Good Standing Courses (NIP PL8992909337, REGON 520256406), ul. Stanisława Drabika 63/19, 52-131 Wrocław, Poland. In this policy, "we", "us" and "our" mean this business.

Privacy questions and requests: privacy@goodstandingcourses.com. General support: support@goodstandingcourses.com.

Because we are established in the European Union, the EU General Data Protection Regulation (GDPR) and Polish data protection law apply to everything we do with your data, even though our students live in the United States. That gives you the rights described in section 9 below, wherever you live.

We have not appointed a data protection officer, because the law does not require one for a business of our size and type. You can reach the person responsible for data protection at the privacy address above.

• Your case number, docket number, court, judge or county.
• Your date of birth, Social Security number or any government ID number.
• What you were charged with, convicted of or ordered to do, or why you are taking the course. We never ask.
• Your probation officer's or attorney's name or contact details.
• Your journal entries and written answers to exercises. They are saved only in your browser, on your device, in your private workbook. You can download your workbook as a PDF; that file is created in your browser too.

The certificate, enrollment letter and progress report have optional fields for case number, court and date of birth. When you fill them in on our site, the form works entirely inside your browser: the details are written into your copy of the PDF and are not sent to us, saved by us, or stored in your browser after you leave the page. You can also leave them blank and fill them in later with any PDF reader.

Some of our students take a course because a court, probation officer or employer asked them to. We designed the service so that we do not need to know that, and so that we do not hold information about criminal proceedings or health.

• Criminal-offense data (GDPR article 10). We do not collect case numbers, courts, charges or the reason you enrolled. Our courses are sold to anyone who wants them, including for personal growth or workplace requirements. Buying a course is not a statement that you did anything wrong, and we do not treat it as one.
• Health data (GDPR article 9). Our courses are educational, not therapy. We do not ask about your mental or physical health. The only places where you might write about personal situations, your journal and exercises, never leave your device. Some US states may still treat the course you bought as health-related data; see section 13.
• Course name on documents. Your certificate, your enrollment letter and the public verification page show the course title (for example, "8-Hour Anger Management Course"). These documents exist so that you can show them to whoever asked you to take the course. We never send them to anyone; you decide who sees them.

Under the GDPR we need a legal reason ("legal basis") for each use of your data. "Contract" means we need the data to provide the course you bought (article 6(1)(b)). "Legal obligation" means a law requires it (article 6(1)(c)). "Legitimate interests" means we have a fair business reason that does not override your rights (article 6(1)(f)); you can object to these uses (section 9).

We do not send marketing emails today. If we start, we will ask for your separate consent first, and you will be able to withdraw it at any time with one click.

Automated decisions. Our system counts study time and grades quizzes automatically, and those results decide when your certificate is issued. If you think the timer or a test result is wrong, email support@goodstandingcourses.com. A person will review your time log or test, explain the result and correct it if it is wrong. Any correction is recorded with its reason and shows in your time log.

Each certificate and enrollment letter has an ID and a QR code that lead to our verification page. To see anything, a person must enter both the ID and your last name. If either is wrong, they get the same "no match" answer, so the page does not reveal whether an ID exists or whose it is. The page is not listed by search engines, and checks are limited per network.

What a verifier sees for a certificate: whether it is valid, revoked or replaced (and the replacement ID); your full legal name; the course title; the number of hours; start and completion dates; that you passed the final exam and your score; the certificate ID and fingerprint; the issue date; and, only if you turned progress sharing on, a time-log summary (total time logged, number of study sessions, and the dates of the first and last session).

What a verifier sees for an enrollment letter: enrollment status; your full legal name; the course and hours; the enrollment date; your progress (time logged out of time required, percentage and last activity date), only if you turned progress sharing on; and your certificate ID once issued.

What a verifier never sees: your email, your state, your case number, court or date of birth (we do not have them), your quiz answers, your IP address or your journal.

You control what verifiers see. Your name, course, hours, dates and status are always shown, because confirming them is the purpose of verification. In your dashboard, for each course, you can:

• Show study progress on the public verification page. Off by default. Turn it on if your court or officer wants to follow your progress, and off again at any time.
• Hide this certificate from verification. While it is hidden, someone who enters the right ID and last name only sees that the holder hid the record, and nothing else. You can show it again at any time, for example when your court needs to check it.

If you want your certificate record revoked or deleted for good, email privacy@goodstandingcourses.com (see section 9). When someone verifies your document, we email you (at most once a day) so you always know.

We do not sell your personal data and we do not share it for advertising. We share it only with these service providers, each bound by a contract that limits what they can do with it:

Stripe also uses payment data for its own purposes, such as fraud prevention and meeting financial regulations. For those purposes Stripe is a separate controller, and its own privacy policy (stripe.com/privacy) applies.

We may also disclose data when the law requires it (for example, to tax authorities or under a valid court order that applies to us), or to protect our rights in a legal dispute. If we ever sell or transfer the business, your data would move to the new owner under this policy, and we would tell you first.

We do not send your data to your court, officer or employer. You choose whom to give your documents and IDs to. A US curriculum reviewer who checked our lessons has no access to student data. We do not use Google Analytics, advertising pixels or session recording. Our only visit statistics come from Cloudflare Web Analytics (section 10).

Our main database is stored in the European Union. Some of our providers are based in the United States or process data there, as described in section 6. When your data moves from the EU to the United States, we rely on the EU–U.S. Data Privacy Framework (our US providers are certified under it), and on the European Commission's Standard Contractual Clauses included in our providers' data processing agreements as an additional safeguard. You can ask us for more information about these safeguards at the privacy address.

Because you live in the United States, some data naturally travels there: for example, the emails we send you and the pages you load.

We keep data only as long as we need it for the purposes above. When a period ends, we delete the data or anonymize it so it can no longer be linked to you.

An automatic job runs every day and deletes or anonymizes everything in our database whose period has ended. Emails in our mailbox are deleted by hand.

If we need data longer to deal with a dispute or legal claim, we keep only what is needed, only until it is resolved.

Under the GDPR you have the right to:

• Access your data and get a copy of it.
• Correct inaccurate data. Your legal name on a certificate can be corrected once for free; we issue a new certificate and the old ID shows as replaced.
• Delete your data ("right to be forgotten"), subject to the exceptions below.
• Port your data: receive it in a common machine-readable format (JSON) to take elsewhere.
• Restrict our use of your data while a complaint about it is being resolved.
• Object to any use based on legitimate interests. We will stop unless we have compelling reasons or need the data for a legal claim.
• Withdraw consent at any time, where we rely on consent. This does not affect what we did before.
• Complain to a supervisory authority (section 12).

How to make a request. Email privacy@goodstandingcourses.com from the email address on your account and tell us what you want: a copy of your data, a correction, or deletion. If you write from another address, we will send a confirmation to your account email first, so that nobody else can get or delete your data. We answer within one month. If a request is complex, we may extend this by up to two more months and will tell you why. Requests are free.

What deletion means. When we delete your account, we erase your email and name from it, end all sign-in sessions, delete support notes, and reduce your study-time log to totals with no IP address or device information. Two things are kept:

• Order records, because Polish tax law requires us to keep them for 5 years. We remove the link to your Stripe customer profile.
• Your certificate record, so the court or agency you gave it to can still verify it. If you want this removed too, tell us. The certificate will then show as "revoked" on the verification page and can no longer be verified, so make sure your court no longer needs it.

We keep a short internal record that a request was handled, without the deleted details.

We use only what the site needs to work:

Cloudflare Turnstile checks that a real person is using our sign-in, checkout and verification forms. It does not use cookies to track you. Stripe's checkout page is run by Stripe on its own website and uses its own cookies under Stripe's policy.

Visit statistics. We use Cloudflare Web Analytics to count visits to our pages. It runs a small script from Cloudflare that reports which page was loaded, the referring page, browser and device type, country and how fast the page loaded. It sets no cookies, stores nothing on your device, does not use your IP address to identify you, and does not follow you across other websites. We see only totals, never individual visitors. We do not load it on the page where you fill in your certificate or enrollment letter, so nothing you type there can reach it, and we do not load it on our admin pages.

Apart from the ad click cookie, we do not use advertising or tracking cookies, and no Google tag, advertising pixel or other third-party advertising script runs on any of our pages. The ad click cookie is never used to follow you on other websites or to build a profile of you. You can object to it at any time (section 9): clear the cookie, or email us and we will delete the click ID from your order. If we ever add other advertising cookies, we will update this policy and ask for your consent first where the law requires it.

We protect your data with encryption in transit (HTTPS everywhere), hashed sign-in links and session identifiers, rate limits, bot checks, strict browser security settings, and an administrator area that only the business owner can access. Payment card data never touches our servers. No system is perfectly secure; if a breach affects your data and puts you at risk, we will tell you and the authorities as the law requires.

If you are unhappy with how we handle your data, please contact us first at privacy@goodstandingcourses.com so we can try to fix it. You also have the right to complain to the Polish data protection authority: President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl. If you live in the EU, you can also complain to the authority in your country.

Several US states have consumer privacy laws, such as the California Consumer Privacy Act. Most of them apply only to businesses above certain size thresholds, for example annual revenue above roughly 25 million US dollars or data on 100,000 or more residents of a state. Based on our current size, we believe these laws do not currently apply to us. We will review this as we grow.

Whether or not they apply, we treat every student the same way under this policy:

• We do not sell personal data and do not share it for cross-context behavioral (targeted) advertising.
• We do not use sensitive data to infer characteristics about you, and we do not collect health data.
• You can access, correct and delete your data and get a copy of it, as described in section 9, regardless of your state. We will not treat you differently for using these rights.

Consumer health data. Some states, including Washington and Nevada, protect "consumer health data" regardless of business size. We do not ask about your physical or mental health, and your journal and exercise answers stay on your device. But because the name of the course you buy could be read as information about your mental or behavioral health, we treat your enrollment as consumer health data under those laws. We never sell it and share it only with our service providers. Our Consumer Health Data Privacy Policy explains what we collect, who we share it with and how to access or delete it.

Our courses are for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, contact us and we will delete it.

We may update this policy when our service or the law changes. We will change the "Last updated" date at the top. If a change materially affects how we use data we already hold, we will email you before it takes effect.