Privacy

Privacy Policy.

How DracoEMS collects, uses, shares, and protects personal information for students, instructors, and schools. Last updated: September 13, 2026.

Last updated: September 13, 2026

This Privacy Policy (the "Policy") describes how Draco Publishers and Draco Learning (collectively, "Draco", "we", "us", or "our"), a business located in the State of California, United States of America, collect, use, disclose, and protect personal information in connection with DracoEMS, the website at dracoems.com, the DracoEMS mobile application, the companion DracoEMTPrep service, and the sale of printed textbooks and workbooks (together, the "Service"). Capitalized terms not defined in this Policy have the meanings given in our Terms of Service.

Scope
Information We Collect
How We Use Information
Legal Bases for Processing
How We Share Information
Cookies
Analytics Without Third-Party Trackers
Student Records and FERPA
Children and Minors
Data Retention
Security
Your Rights and Choices
California Privacy Rights
International Users
Third-Party Links and Services
Changes to This Policy
How to Contact Us

1. Scope

This Policy applies to personal information we collect when you visit the public website, create or use an Account as a student, instructor, lead instructor, staff member, school admin, or system admin, use the mobile application or DracoEMTPrep, purchase a subscription, seat pool, or printed goods, or contact us. It applies to every School tenant on the Service. It does not apply to the practices of your School, your state EMS authority, the National Registry of Emergency Medical Technicians, or any third-party service that we link to, each of which has its own privacy practices.

"Personal information" means information that identifies, relates to, describes, or could reasonably be linked with a particular individual or household. Information that has been de-identified or aggregated so that it can no longer reasonably be linked to an individual is not personal information.

2. Information We Collect

2.1 Information you provide

Account information. Your name, email address, and a password (stored only as a cryptographic hash), or the identifier and email address supplied by Google or Apple if you sign in with a Sign-In Provider. If you enable two-factor authentication we also store the data needed to verify your second factor, such as an authenticator secret, passkey public key, or the fact that email codes are enabled.
Profile information. Optional details you add to your profile, such as a display name or photo, and your theme preference.
School and role information. The School you belong to, your role, the cohorts you are assigned to, the invitation you accepted, and the seat consumed by your subscription.
Messages and support requests. Messages you send through the Service's messaging features to instructors or students, and messages you send to us through the contact form, together with any attachments.
Purchase and shipping information. When you buy a subscription, seat pool, or printed goods, Stripe collects your payment card details directly; we receive only a payment confirmation, the last four digits and brand of the card, the billing name and postal code, and, for printed goods, the shipping name and address you enter. We never receive or store your full card number.

2.2 Learning data generated as you use the Service

Reading progress. Which chapters, sections, and lessons you have opened and completed, your position in the textbook, and time spent.
Audio and video activity. Which narration tracks and lesson videos you have played and how far you progressed.
Practice and test data. Every practice question and chapter test attempt, the answers you selected, the time taken, your scores, and the resulting performance analytics, including DracoEMTPrep activity.
Workbook entries. The answers, notes, and free-text responses you enter in the digital workbook.
Skills check-offs. Records of psychomotor skills evaluations entered by your instructors, including the skill, date, evaluator, result, and any comments.
Gradebook data. Grades, completion status, and instructor comments recorded by your School.

2.3 Device and technical data

When you use the Service we automatically collect the IP address of your device, browser type and version, operating system, device identifiers for the mobile application, screen size, language, the pages and features you access, the referring page, and the date and time of each request.

2.4 First-party analytics

We keep our own record of page views for the purpose of understanding how the Service is used. Each record contains the page viewed, an anonymized IP address (truncated so that it does not identify a particular device), the user agent, the referrer, and the date. We do not use any third-party analytics or advertising service to collect this information. See Section 7.

2.5 Security and activity logs

We maintain an activity log that records sign-ins, failed sign-in attempts, the IP address and user agent of each attempt, two-factor events, password changes, and administrative actions taken by school admins, instructors, and system admins, such as inviting a student, changing a role, or recording a check-off. We also maintain an error log that may contain the request path, the Account involved, and diagnostic details when the Service encounters a fault. These logs are used for security, troubleshooting, and support.

2.6 Information from your School

When a School invites you, the School provides us with your name, email address, cohort, and, where applicable, confirmation that you are eligible to participate and that any required parental or guardian consent has been obtained. Schools may also record grades, attendance-related notes, and check-off results about you.

3. How We Use Information

We use personal information for the following purposes:

To provide the Service. To create and maintain your Account, authenticate you, deliver the textbook, workbook, narration, videos, practice questions, and tests, save your progress, and synchronize it across the website and mobile application.
To grade and report to your program. To calculate scores, compile progress analytics, maintain the gradebook and skills check-offs, and make those records available to the instructors and school admins of the School in which you are enrolled.
To operate School administration. To manage cohorts, seat pools, invitations, roles, and messaging between instructors and students.
To process purchases. To complete transactions through Stripe, calculate shipping and sales tax, ship printed goods, issue receipts, and handle return, refund, and chargeback matters.
To send transactional email. To send verification codes, password resets, invitations, receipts, shipping notices, security alerts, and service announcements through SendGrid. These messages are necessary to operate the Service and are not marketing.
To secure the Service. To detect and prevent unauthorized access, fraud, abuse, cheating, and attacks; to enforce seat limits and role permissions; and to investigate security incidents.
To provide support. To respond to your messages, diagnose problems, and resolve disputes.
To comply with law. To satisfy legal obligations, respond to lawful requests, and enforce our Terms of Service.
To improve the Service. To analyze usage patterns, question performance, and error reports so that we can correct content, improve features, and plan capacity. Wherever practicable we use aggregated or de-identified data for this purpose.

We do not sell personal information, we do not use it for targeted advertising, and we do not send marketing email to Students or Instructors without consent.

4. Legal Bases for Processing

Where a legal basis is required, we process personal information on the following bases: performance of our contract with you or your School, including the Terms of Service and any agreement with a School; our legitimate interests in operating, securing, and improving the Service, in preventing fraud and abuse, and in enforcing our rights, balanced against your interests and rights; compliance with legal obligations; your consent, where we ask for it, which you may withdraw at any time; and, for Students enrolled through an educational institution, the School's instruction and legitimate educational interest under applicable education-records law.

5. How We Share Information

We share personal information only as described below.

5.1 With your School and instructors

The core function of the Service is to deliver a course on behalf of your School. Your name, email address, reading progress, test attempts and answers, scores, analytics, workbook entries, skills check-offs, gradebook entries, and messages are available to the instructors, lead instructors, staff, and school admins of the School in which you are enrolled, to the extent of their roles. Your School's use of that information is governed by its own policies and by applicable education-records law. Data is never shared between different Schools.

5.2 With service providers

We rely on a small number of vendors who process personal information on our behalf under contracts that restrict their use of it to providing services to us:

Stripe — payment processing and checkout, including card details, billing name and postal code, and shipping address for printed goods.
SendGrid (Twilio) — delivery of transactional email, which involves your email address and the content of each message.
Google and Apple — authentication when you choose to sign in with a Google or Apple account.
Google reCAPTCHA — bot protection on the contact form, which may collect device and interaction data subject to Google's privacy policy.
Font Awesome and Google Fonts — delivery of icon and font assets, which involves your browser requesting those files and thereby disclosing your IP address and user agent to those providers.
Hosting provider — the United States data-center infrastructure on which the Service and its database run.

5.3 For legal reasons

We may disclose personal information if we believe in good faith that disclosure is necessary to comply with a law, regulation, subpoena, court order, or other legal process; to enforce our Terms of Service; to detect, prevent, or address fraud, security, or technical issues; or to protect the rights, property, or safety of Draco, our users, or the public. Where permitted, we will notify the affected School before responding to a request for education records.

5.4 Business transfers

If Draco is involved in a merger, acquisition, financing, reorganization, or sale of all or part of its assets, personal information may be transferred to the successor as part of that transaction, subject to this Policy and to any agreement with the affected Schools. We will provide notice through the Service or by email before your information becomes subject to a materially different privacy policy.

5.5 With your consent

We may share personal information for any other purpose with your consent or at your direction.

5.6 We do not sell or share for advertising

We do not sell personal information, and we do not share it with third parties for cross-context behavioral advertising, as those terms are defined under California law.

6. Cookies

The Service uses a minimal set of cookies, all of which are set by dracoems.com and none of which are used for advertising or cross-site tracking:

Session cookie — identifies your signed-in session so that you do not have to authenticate on every page. Deleted when you sign out or close your browser, depending on your browser settings.
CSRF token — a security token that protects forms against cross-site request forgery.
Theme preference — remembers whether you have chosen the light or dark interface.
"Remember me" — set only if you tick the "remember me" option at sign-in, so that you stay signed in on that device for a limited period. You can clear it by signing out.

Third-party services embedded on specific pages, such as Stripe Checkout and reCAPTCHA on the contact form, may set their own cookies under their own policies. You can control cookies through your browser settings; disabling the session or CSRF cookie will prevent you from signing in or submitting forms.

7. Analytics Without Third-Party Trackers

We measure use of the Service with a first-party analytics system that we operate ourselves. It records page views with an anonymized IP address, the user agent, the referrer, and the date. It does not set a tracking cookie, does not build advertising profiles, does not fingerprint devices, and does not transmit data to any advertising network, social media platform, or third-party analytics provider. Because it does not track individuals across sites, we do not respond to browser "Do Not Track" signals in a way that differs from our default behavior, which already does not track you.

8. Student Records and FERPA

When a School that is an educational institution subject to the Family Educational Rights and Privacy Act ("FERPA") uses the Service, the learning records described in Section 2.2 may constitute education records of that School. In that case:

Draco acts as a "school official" with a legitimate educational interest, performing an institutional service or function for which the School would otherwise use its own employees, under the School's direct control with respect to the use and maintenance of education records;
Draco uses education records solely to provide the Service to the School and its Students and for no other purpose;
Draco does not disclose education records to any third party except to the service providers listed in Section 5.2 as needed to operate the Service, as directed by the School, or as required by law;
the School remains responsible for providing FERPA notices to its Students, for responding to Student requests to inspect and review education records, and for determining what may be disclosed; and
Draco will delete or return education records at the School's written request, subject to Section 10.

A student who wishes to inspect, review, or seek amendment of an education record should contact his or her School. We will assist the School in fulfilling such requests. Schools that require a written data agreement may request one through the contact form.

9. Children and Minors

The Service is not directed to children under thirteen (13) years of age, and we do not knowingly collect personal information from children under thirteen. If we learn that we have collected personal information from a child under thirteen, we will delete it and close the Account. Parents or guardians who believe a child under thirteen has provided personal information to us should contact us through the contact form.

Students are typically adults enrolled in an approved EMT program. Some Schools admit students who are sixteen (16) or seventeen (17) years of age. A minor may use the Service only when invited by a School that has authorized the minor's participation and has obtained any consent from the minor's parent or legal guardian that applicable law requires. We rely on the School's representation that such consent has been obtained. Instructors and school admins of the School have access to a minor's learning data as described in Section 5.1. A parent or guardian of a minor Student may exercise the rights described in Section 12 on the minor's behalf.

10. Data Retention

We retain personal information for as long as needed to fulfill the purposes described in this Policy, subject to the following guidelines:

Account data is retained for the duration of your subscription or role and for a reasonable period afterward so that you can renew, recover your work, or obtain records, after which it is deleted or de-identified.
Learning records — progress, test attempts, scores, workbook entries, check-offs, and gradebook entries — are retained for as long as your School needs them for its reporting, accreditation, and record-keeping obligations, or until the School instructs us to delete them, whichever comes first.
Messages are retained with the learning records of the cohort in which they were sent.
Purchase records are retained for as long as required by tax, accounting, and payment-network rules.
Activity and security logs are retained for twelve (12) months, or longer if needed to investigate an incident, resolve a dispute, or comply with a legal obligation.
Error logs are retained until the underlying fault has been resolved and then purged.
First-party analytics records are already anonymized and may be retained in aggregate indefinitely.

When personal information is no longer needed we delete it or de-identify it so that it can no longer be linked to you. Backups are overwritten on a rolling schedule.

11. Security

We use administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, alteration, disclosure, or destruction, including:

encryption of all traffic between your device and the Service using TLS;
passwords stored only as salted cryptographic hashes and never in plain text;
optional two-factor authentication by email code, authenticator application, or passkey, and sign-in with Google or Apple;
a multi-tenant architecture in which each School's data is isolated and every data access is scoped to the requesting user's School and role;
least-privilege access for Draco personnel, limited to what is necessary for support and operations;
CSRF protection, rate limiting, and reCAPTCHA on public forms;
activity logging of sign-ins, sign-in failures, and administrative actions to support detection and investigation; and
payment handling delegated entirely to Stripe so that card numbers never touch our systems.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your credentials confidential and for notifying us through the contact form if you suspect unauthorized access to your Account. If we become aware of a breach affecting your personal information, we will notify you and, where applicable, your School, as required by law.

12. Your Rights and Choices

Subject to applicable law and to the role of your School with respect to education records, you may:

Access the personal information we hold about you and receive a copy of it;
Correct inaccurate or incomplete personal information, much of which you can update directly in your Account settings;
Delete your personal information, subject to our need to retain certain records for your School, for legal compliance, or for security;
Port your personal information to yourself or another provider in a structured, commonly used, machine-readable format;
Object to or restrict certain processing, and withdraw consent where processing is based on consent; and
Opt out of any non-essential email by using the unsubscribe link in the message or by contacting us. Transactional and security messages cannot be disabled while your Account is active.

To exercise any of these rights, send a request through the contact form from the email address on your Account, or otherwise provide enough information for us to verify your identity. We will respond within the time required by applicable law and will not discriminate against you for exercising your rights. Where your request concerns education records controlled by your School, we may refer the request to the School or act on the School's instruction.

13. California Privacy Rights

If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA") gives you specific rights regarding your personal information.

13.1 Categories of personal information

In the preceding twelve months we have collected the following categories of personal information, as described in Section 2: identifiers (name, email address, IP address, Account identifiers); customer records (billing name and postal code, shipping address); commercial information (purchase history); internet and network activity (pages viewed, features used, device and browser data, security logs); education information (reading progress, test attempts and answers, scores, workbook entries, check-offs, grades); and inferences drawn from learning data for the purpose of progress analytics. We collect these categories from you directly, from your device, from your School, and from Stripe and Sign-In Providers, for the business purposes described in Section 3, and we disclose them for business purposes to the recipients described in Section 5.

13.2 Your CCPA rights

Right to know what personal information we collect, use, disclose, and the categories of sources and recipients;
Right to delete personal information we have collected from you, subject to statutory exceptions;
Right to correct inaccurate personal information;
Right to opt out of the sale or sharing of personal information;
Right to limit the use of sensitive personal information; and
Right to non-discrimination for exercising any of these rights.

13.3 Do Not Sell or Share

We do not sell personal information and we do not share it for cross-context behavioral advertising, and we have not done so in the preceding twelve months. We do not use or disclose sensitive personal information for purposes other than those permitted by the CCPA. Because we do not sell or share personal information, there is no opt-out to exercise; we honor this commitment for all users regardless of any signal sent by your browser.

13.4 How to exercise your rights

Submit a request through the contact form. We will verify your identity by matching the information you provide against the information on your Account and may ask you to confirm the request from the email address on file. You may designate an authorized agent to make a request on your behalf; we will require proof of the agent's authority and may still require you to verify your identity directly. We will respond within forty-five (45) days, extendable once by a further forty-five days where reasonably necessary, and will tell you if we need more time.

13.5 Education records

Where personal information is an education record held on behalf of a School, we process it as a service provider to the School. Requests concerning such records may be referred to the School, which controls them.

14. International Users

The Service is hosted and operated in the United States. If you access the Service from outside the United States, you understand that your personal information will be transferred to, stored, and processed in the United States, where privacy laws may differ from those of your country. By using the Service you consent to that transfer. Printed goods are shipped only to addresses within the United States.

15. Third-Party Links and Services

The Service may contain links to websites and services operated by third parties, including the National Registry of Emergency Medical Technicians, state EMS authorities, and the Sign-In Providers. We do not control those sites and are not responsible for their privacy practices. We encourage you to read the privacy policy of every site you visit.

16. Changes to This Policy

We may update this Policy from time to time. When we do, we will post the revised Policy on the Service with an updated "Last updated" date. If a change materially affects how we use personal information already collected, we will notify you through the Service or by email to the address on your Account, and, for Schools, through the school admin, before the change takes effect. Your continued use of the Service after a revised Policy takes effect constitutes acceptance of it.

17. How to Contact Us

Questions, requests, and complaints about this Policy or our handling of personal information should be sent through the contact form, which is our designated channel for privacy matters. Please include the email address on your Account so that we can locate your records and verify your identity. If you are not satisfied with our response, you may have the right to lodge a complaint with a supervisory authority in your jurisdiction, including the California Privacy Protection Agency or the California Attorney General.