Privacy Policy

Veritas Lessons, LLC ("Veritas Lessons," "we," "us," or "our") operates a California Department of Real Estate (DRE) approved continuing education platform. Our platform teaches California real estate licensees to use AI tools in their professional practice.

For privacy inquiries, contact us at: [email protected]

We collect information in three ways: information you provide directly, information generated by your use of the course, and information collected automatically.

At registration, you provide:

• Full legal name (as it appears on your DRE license)
• Email address
• California DRE license number
• Password (stored as a one-way bcrypt hash; we never store your plaintext password)

During your course, we automatically record:

We do not collect: payment card information, Social Security numbers, or biometric data.

• Course delivery — to authenticate you, track lesson progress, enforce seat-time gates, and serve course content.
• DRE compliance — to validate your DRE license at registration, administer your final exam, enforce the 96-hour completion gate, and issue a certificate of completion that meets DRE record-keeping requirements.
• AI practice sessions — to forward your in-lesson questions to the Anthropic API and return responses. See Section 4 for details on this third-party transfer.
• Security and fraud prevention — to detect abnormal activity, enforce attempt limits, and maintain an audit trail for regulators.
• Internal reporting — administrators and DRE regulators may generate audit reports that include your name, email, DRE license, enrollment date, time-on-course, and exam results.
• DRE Oversight — We may provide temporary, read-only access to your progress logs and exam records to DRE representatives during an official course audit.

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

We share data with the following service providers only to the extent necessary to operate the platform:

Important: When you use the AI assistant during a lesson, your typed message is sent to Anthropic's servers for processing. Anthropic does not use your inputs to train its models. Inputs and outputs may be retained by Anthropic for up to 30 days for trust and safety review. Do not include sensitive personal information in your AI practice questions.

DRE-required records (enrollment, seat time, exam results, certificates) are retained for a minimum of five (5) years as required by California Business and Professions Code § 10153.6 and DRE regulations. These records cannot be deleted on request during the retention period.

AI chat logs (your messages and AI responses via Anthropic) are not required by the DRE. Anthropic may retain inputs and outputs for up to 30 days for trust and safety review, then deletes them. We retain our own application-level logs of AI interactions for up to 12 months to support quality review, then delete them.

Session activity logs (IP addresses, activity signals) are retained for up to 12 months, then deleted.

Account data (name, email, password hash) is retained for the duration of your account plus the 5-year DRE retention period after your last course completion.

Backups: Cloudflare R2 backups are overwritten with each new snapshot. Only the most recent backup is retained at any given time.

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

Right to Know. You may request a copy of the personal information we hold about you, the categories of information collected, the purposes for which it is used, and the categories of third parties with whom it is shared.

Right to Delete. You have the right to request that we delete the personal information we have collected from you. To exercise this right, please email [email protected].

Exemptions for Regulatory Compliance: Please note that pursuant to CCPA/CPRA § 1798.105(d) and California Business and Professions Code § 10153.6, Veritas Lessons is legally required to maintain records of course enrollments, seat-time logs, exam results, and certificates for a period of five (5) years. Consequently, these specific records cannot be deleted upon request during this mandatory retention period.

Upon a verified request, we will delete all other non-regulatory data, including AI practice logs, session activity metadata, and your account profile information not required for DRE audit purposes.

Right to Correct. You may request correction of inaccurate personal information we hold about you — including your name, email address, or DRE license number — by emailing [email protected].

Right to Opt Out of Sale or Sharing. We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising.

Right to Limit Use of Sensitive Personal Information. Your DRE license number and IP address qualify as sensitive personal information under CPRA. We use this information only for the purposes described in this policy (license validation and session tracking). You may request that we limit further use of your sensitive personal information beyond these purposes.

Right to Non-Discrimination. We will not deny you service, charge you a different price, or provide a different level of service because you exercised any of the rights described above.

To exercise any of these rights, contact us at [email protected]. We will respond within 45 days. We may ask you to verify your identity before fulfilling a request.

California residents may also designate an authorized agent to submit requests on their behalf. Authorized agents must provide written permission signed by you.

We use the following measures to protect your information:

• Passwords are hashed with bcrypt before storage — we cannot recover your plaintext password.
• Encryption at Rest — All student record databases utilize AES-256 encryption at rest within our Cloudflare R2 and Fly.io environments.
• Database backups stored in Cloudflare R2 are encrypted at rest.
• All traffic between your browser and our servers is encrypted in transit via HTTPS (TLS).
• Authentication tokens expire after 24 hours.
• DRE license numbers are validated against a local index — they are not transmitted to third-party validation services.

No system is perfectly secure. If you believe your account has been compromised, contact us immediately at [email protected].

We use the following browser storage mechanisms:

• localStorage (lms_token): Your signed authentication token stored in your browser's local storage to support client-side state. Cleared on sign-out.
• localStorage (lms_session): Your name and student ID stored in your browser's local storage for display purposes. Cleared on sign-out.

We do not use advertising cookies, tracking pixels, or third-party analytics.

This platform is intended exclusively for licensed California real estate professionals. A valid, active California DRE license is required to register. We do not knowingly collect personal information from individuals under 18 years of age. If you believe a minor has created an account, please contact us at [email protected] so we can remove the account.

We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top of this page and, for material changes, notify you by displaying a notice on the course landing page or sending an email to the address on your account.

Continued use of the platform after a policy update constitutes acceptance of the revised policy.

For privacy questions, requests to exercise your rights, or to report a security concern:

• Email: [email protected]
• Company: Veritas Lessons, LLC

We will acknowledge receipt of your request within 10 business days and respond fully within 45 days.