Privacy Policy

1. Who we are

QMS Learning LLC ("QMS Learning," "we," "us," or "our") provides team training for quality, compliance, safety, operations and related subjects, an AI learning coach, AI-assisted workflows, and a quality management platform, together with related professional services (together, the "Services"). We are based in California, United States.

This Privacy Policy explains how we collect, use, share and protect personal information when you visit qmslearning.com, use academy.qmslearning.com or our platform, book a meeting with us, buy from us, or otherwise interact with us. It also explains your choices and the rights you may have.

Questions or requests: will@qmslearning.com, (949) 734-8165, or QMS Learning LLC, 20639 Lycoming Street STE B9, Walnut, CA 91789.

2. When your employer controls your information

Our Services are sold to organizations. When a company (a "Customer") gives its employees or contractors access to the Services, the Customer decides what content is uploaded and how its learners' records are used. For that information, which includes the documents a Customer uploads and the training and competency records of its people, we act as the Customer's service provider or processor and handle it under our agreement with the Customer.

If you use the Services through your employer and want to access, correct or delete information in your employer's environment, please contact your employer first. If you contact us, we will pass your request to the Customer and help it respond.

Everything else in this policy, such as website visits, demo bookings, sales conversations and billing contacts, is information we handle for our own business purposes.

3. Information we collect

Information you give us

• Contact and business details: name, job title, company, business email address, phone number and business address.
• Account details: the name, email address, role and sign-in credentials used to access the academy or platform.
• Communications: emails, messages, meeting requests, call notes and anything else you send us.
• Purchase and billing details: billing contact, order and invoice records, and payment status. Card payments are processed by our payment processor. We do not receive or store full payment card numbers.
• Scheduling details: the information you enter when you book a meeting through our scheduling provider.

Information in the Services

• Customer content: documents and files uploaded by a Customer or its users, such as procedures, manuals, forms, records, trace packages, certificates, job descriptions and customer requirements.
• Learning and competency records: enrollments, lesson progress, practice attempts, quiz and exam results, completion certificates, study plans, document acknowledgments, training records and competency status.
• AI interactions: questions and instructions you give the AI coach or AI workflows, and the drafts, explanations and feedback they produce.
• Workflow records: reviews, approvals, dispositions, signatures (recorded as your named sign-in and a timestamp) and the audit trail of changes. These records are kept in an append-only history so that earlier entries are not overwritten. This protects the integrity of quality records and affects how corrections are made, as explained in section 9.

Information collected automatically

• Device and usage information: IP address, browser and device type, pages viewed, links clicked, referring pages, dates and times.
• Cookies and similar technologies: described in section 7.
• Security and service logs: sign-in events, errors and other records we need to keep the Services secure and working.

Information from other sources

• Your employer, when it creates your account or enrolls you in training.
• Business information providers and public sources, such as company and certification directories, government registries and databases, company websites and professional networking profiles. We use this business contact information to reach people whose organizations may benefit from our Services.
• Partners and referral sources who introduce you to us.
• Advertising and analytics providers, which give us reports about how our advertising performs.

Information we ask you not to send

We do not ask for, and you should not upload, government identification numbers, health or medical information, financial account or payment card numbers, biometric data, or information about children. If a Customer's content contains this kind of information anyway, we handle it as Customer content under our agreement with that Customer. Our Terms of Service also restrict uploading export-controlled, classified and other restricted information.

4. How we use information

• To provide, operate, maintain and support the Services, including building training around a Customer's own procedures.
• To power AI features, as described in section 5.
• To create and manage accounts, verify identity and keep the Services secure.
• To process orders, payments, invoices and refunds.
• To communicate with you about the Services, security, billing, and changes to our terms and policies.
• To send business marketing about our Services to people at organizations that may be interested. You can opt out at any time.
• To understand how our website and Services are used, and to improve them, using aggregated or de-identified information where we can.
• To detect, prevent and respond to fraud, abuse, security incidents and violations of our terms.
• To meet legal, regulatory, tax and accounting obligations, and to support audits of our own management systems, such as our ISO/IEC 27001 certification audits.
• To establish, exercise or defend legal claims and to enforce our agreements.
• For any other purpose we describe when we collect the information, or with your consent.

5. AI features and your data

Our AI coach and AI workflows use a large language model provided by a third party, Anthropic, through its commercial service. Under the commercial terms we operate on, the content we send to the model and the results it returns are not used to train AI models. The provider may keep that content for a limited period to monitor for misuse, as its terms allow.

We do not use Customer content to train AI models, whether ours or anyone else's.

AI output is a draft. It can be wrong or incomplete. Our workflows are designed so that a named person reviews and approves anything that becomes a record. We do not use AI to make decisions that produce legal or similarly significant effects on an individual without human review. Customers that use the Services in decisions about their own employees, such as qualification, assignment or discipline, are responsible for meaningful human review of those decisions and for following employment and anti-discrimination law.

6. How we share information

We share personal information only as described here.

• Service providers, who process information for us under contract and only as needed to provide their services. These include providers of hosting and infrastructure in the United States, AI model services, payment processing, email and productivity software, customer relationship management, meeting scheduling, website delivery and security, analytics and advertising measurement, and sales outreach and business data tools. We can provide a current list of the providers that process Customer content on request.
• Your organization. If you use the Services through a Customer, that Customer's authorized administrators and managers can see your progress, results, certificates, acknowledgments, competency records and the work you do in the Customer's environment.
• Professional advisors and auditors, such as lawyers, accountants, insurers, and certification body auditors who review our own management systems, under duties of confidentiality.
• Legal and safety reasons. When we believe in good faith that disclosure is required by law, subpoena or other legal process, or is needed to protect the rights, property or safety of QMS Learning, our Customers or others.
• Business transfers. In connection with a merger, acquisition, financing, reorganization or sale of assets, subject to this policy or protections at least as strong.
• With your consent or at your direction.

We do not sell personal information for money. We do not share personal information with third parties for their own direct marketing purposes. The advertising tags on our public websites, described in section 7, may be treated as "sharing" personal information for cross-context behavioral advertising under California law. Section 8 explains how to limit them.

7. Cookies and similar technologies

We and our providers use cookies, pixels, scripts and similar technologies.

We do not place advertising tags on course lessons inside the academy, and we do not share which course videos or lessons a person views with advertising platforms.

The Insights section of our website (qmslearning.com/feeds) is produced with a content partner and may use its own technologies.

Do Not Track. Browsers offer a "Do Not Track" setting. There is no common standard for responding to it, and our website does not currently respond to Do Not Track signals.

Global Privacy Control. The academy, including its landing pages, treats a Global Privacy Control signal from your browser as a request to opt out of the sharing described above. When your browser sends it, the Google Ads tag and the Meta Pixel do not load on the academy.

8. Your choices

• Marketing email. Use the unsubscribe link in any marketing email, or email will@qmslearning.com. We keep a record of your request so we do not contact you again. We may still send messages about an account or order you have with us.
• Cookies and advertising. You can block or delete cookies in your browser settings. You can also manage ads through Google My Ad Center and LinkedIn advertising settings, and through industry opt-out pages such as optout.aboutads.info and optout.networkadvertising.org. Opting out does not stop all ads; it limits ads based on your activity.
• Opting out on the academy. On the academy's public pages, use the "Do Not Sell or Share My Personal Information" link, or turn on Global Privacy Control in your browser. We remember the opt-out on that browser for at least 12 months and don't ask you to opt back in. You can change your choice any time with the "Cookie choices" link. On our landing pages, use "Cookie choices" in the footer.
• Advertising audiences. If you do not want your business contact information used to build advertising audiences, email will@qmslearning.com and we will exclude it.
• Calls. If we want to record or transcribe a call, we will tell you at the start and ask for your agreement. You can say no and the call will continue without a recording.

9. Your privacy rights

Depending on where you live and the laws that apply to us, you may have the right to:

• know what personal information we hold about you and how we use and share it, and get a copy;
• correct inaccurate information;
• delete your information;
• receive your information in a portable format;
• opt out of the sale of personal information, the sharing of it for cross-context behavioral advertising, and targeted advertising;
• limit the use of sensitive personal information;
• appeal our decision on your request, where your state provides that right; and
• not be treated differently for using these rights.

How to make a request. Email will@qmslearning.com with the subject line "Privacy Request," or call (949) 734-8165. Tell us what you are asking for. We will verify your request by matching information you give us against information we hold, and we may ask for more information to do that. An authorized agent may make a request for you if we can verify both the agent's authority and your identity. We respond within the time the applicable law requires, which for California is 45 days, extendable where the law allows.

Limits. We may keep information where the law allows or requires it, for example to complete a transaction, keep business and tax records, protect security, or comply with a legal obligation. Quality records in the Services are append-only: we correct them by adding a dated correcting entry rather than erasing the original, unless the Customer that controls the record instructs otherwise and the law allows it. If your request concerns information a Customer controls, we will refer it to that Customer and support its response.

California residents

This section applies to the extent the California Consumer Privacy Act, as amended, applies to us. In the past 12 months we have collected these categories of personal information: identifiers (such as name, email, IP address and account name); customer records (such as billing contact details); commercial information (such as orders and payments); internet or other electronic activity (such as website use and interactions with our ads); professional or employment-related information (such as job title, employer, and training and competency records); inferences we draw about business interest in our Services; and account sign-in credentials, which California treats as sensitive personal information and which we use only to provide and secure your account.

We collect these categories from the sources in section 3, for the purposes in sections 4 and 5, and disclose them for business purposes to the categories of recipients in section 6. We keep them for the periods described in section 10. We have not sold personal information. We may have shared identifiers and internet activity with advertising providers through the tags described in section 7. We do not use sensitive personal information to infer characteristics about you. We have no actual knowledge of selling or sharing the personal information of anyone under 16.

California Civil Code section 1798.83 lets California residents ask about disclosures to third parties for their direct marketing purposes. We do not make those disclosures.

Other United States residents

Residents of other states with consumer privacy laws may have similar rights where those laws apply to us. Use the same request process. If we deny your request, you may appeal by replying to our decision, and we will respond within the time your state's law requires.

European Economic Area, United Kingdom and Switzerland

If these laws apply, we rely on these legal bases: performance of a contract, our legitimate interests in running and marketing a business-to-business service, compliance with legal obligations, and consent where we ask for it. Your information is processed in the United States, where data protection laws may differ from those where you live; where required, we use appropriate safeguards for transfers. You may also have the right to object to processing and to complain to your local data protection authority.

10. How long we keep information

• Account and Customer content: for the life of the Customer's account, then for the export period described in our Terms of Service, after which we delete it in the ordinary course. Backup copies are overwritten on our normal backup cycle.
• Training and competency records: as the Customer instructs, since many Customers must keep these records for years under their own quality, safety or contract requirements.
• Business, billing and tax records: as long as the law requires, which is often up to seven years.
• Marketing contacts: until you opt out, after which we keep a minimal record so we honor your choice.
• Security and service logs: for a limited period needed to protect and operate the Services.

We may keep information longer where required by law or to resolve disputes and enforce our agreements.

11. How we protect information

We operate an information security management system certified to ISO/IEC 27001. Our safeguards include access controls limited to authorized people, separation of each Customer's environment, encrypted connections to our websites, logging and monitoring, and append-only audit trails for quality records.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a security incident that affects your personal information, we will notify you and others as the law requires.

To report a security concern, email will@qmslearning.com with the subject line "Security."

12. Where information is processed

We are based in the United States. Our platform is hosted in the United States. Some of our service providers may process information in other locations under their own safeguards. By using the Services from outside the United States, you understand that your information will be processed in the United States.

13. Children

Our Services are for businesses and working adults. They are not directed to children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, contact us and we will delete it.

14. Third-party sites and services

Our website links to and works with services we do not control, such as our scheduling provider, our payment processor, LinkedIn, and the Insights section operated with our content partner. Their privacy practices are governed by their own policies. Please review them.

15. Changes to this policy

We may update this policy. We will change the "Last updated" date at the top and, if the changes are material, we will give notice through the Services or by email before they take effect. Continued use of the Services after an update means the updated policy applies.

16. Contact us

QMS Learning LLC
20639 Lycoming Street STE B9, Walnut, CA 91789
will@qmslearning.com
(949) 734-8165