itcaptain — Privacy Policy
itcaptain is a service of OSA Technology Partners LLC, Columbus, Ohio.
OSA Technology Partners LLC (“OSA”, “we”, “us”, or “our”) runs itcaptain (the “Service”), the training service on itcaptain.ai, compliancecaptain.ai and hrcaptain.ai. Your employer (the “Customer”) uses it to assign you training videos and to keep a record that you watched them. This policy explains what the Service records about you, who sees it, and how long it is kept.
We act as a service provider to your employer and process personal information on its behalf. Your employer decides what training you are given and what happens with your training record. Your use of the Service is also governed by our Terms of Service.
1. Your personal link
You do not sign in. Each email we send you carries a link made for you alone, and opening it identifies you as the person it was sent to. Anyone who has your link can open your training as you, so do not forward it. We store only a fingerprint of each link, not the link itself, so a copy of our database cannot be used to open anyone’s training. Links stop working 30 days after the training is due, and an administrator can replace yours at any time, which stops the old one.
2. Information We Collect
- From your employer: your name, work email address, job title, department, and the company, division or team you belong to. It comes from your employer’s staff directory, a roster file your employer provides, or OSA staff entering it.
- Your answer at the cookie page: whether you accepted or declined, when, the version of the notice you were shown, your network (IP) address and your browser’s description of itself (user agent).
- What you watched: each time you open a training page; when the video starts, pauses, stops, jumps to another point, changes speed, ends, or fails to play; the position in the video every five seconds while it plays, and whether the page was in view at the time; which links on a training page you click; and, where the training asks for it, that you confirmed you watched it, with the name shown. From these we work out how much of each video you watched and whether you completed it.
- Your browser and device: for each visit, your IP address, user agent and a random identifier for the browser (see Cookies below). We use them to count how many devices took the training on your link.
- Email: the address each message went to, and whether it was sent, delivered, delayed, bounced, refused, reported as spam or unsubscribed from. We do not track whether you open an email or click a link in it.
- Requests for a new link: when you asked, from which IP address and browser.
- Server logs: standard records of requests to the Service, used to keep it running and secure.
The Service does not ask for, and you should not give it, sensitive personal information as defined under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), such as government-issued IDs, financial account details, precise geolocation, health information or biometric data. If you believe such information has reached us, contact privacy@osa.io.
3. Cookies
Nothing is set when you open your link. The Service sets three cookies only when you press Accept and start training, and none if you decline:
| Cookie | What it does | How long it lasts |
|---|---|---|
__Host-itc_sid | Identifies you to the training site after you accept, so what you watch is recorded against your name. | 12 hours |
__Host-itc_did | A random identifier for this browser, so you keep your place in a video and so the record shows how many devices were used. | 1 year |
__Host-itc_consent | Remembers that you accepted, and when, so this browser is not shown the full notice again. If the notice changes, you are asked again. | 1 year |
Each cookie belongs only to the site that set it (for example compliancecaptain.ai) and is never sent to any other site, including the other itcaptain sites. They are sent only over encrypted connections and cannot be read by scripts on the page. They are not advertising or analytics cookies, and the Service loads no third-party tracking scripts. If your browser refuses them, the video cannot play and the page tells you so. Staff who sign in to the administration site, admin.itcaptain.ai, get a sign-in cookie there; learners never do.
4. How We Use Information
- To record your training against your name and report it to your employer.
- To let you pick up a video where you left off.
- To send you training email (section 6).
- To notice a link used on several devices or by more than one person.
- To keep the Service working and secure, and to find and fix errors.
- To comply with legal obligations, resolve disputes, or protect rights and safety.
We do not use personal information for marketing or advertising, and we do not sell it or share it for cross-context behavioral advertising. We have not done so in the past 12 months.
5. Who Sees It
- Your employer’s training administrators see your training record: whether you accepted or declined the cookies, what you watched and how much, whether you completed each module, how many devices you used, and whether mail to you was delivered.
- OSA staff who run itcaptain see the same record, to run the training for your employer and to support it.
- Service providers who handle it only to deliver the Service and are contractually bound to protect it: Twilio SendGrid, which delivers our email, and Amazon Web Services, which hosts the Service.
- Others when the law requires it, for example in response to a valid legal request.
6. Email
We send training email through SendGrid: an invitation with your personal link, reminders around the due date while your training is not complete, a new link when you ask for one, and a receipt when you complete a module. Messages come from an itcaptain address.
Invitations and reminders for training your employer requires, and a new link you asked for, are transactional messages about that training. They are sent even if you have unsubscribed. The unsubscribe link in each message stops optional mail, such as completion receipts; it does not stop required training mail and does not stop your link working. If you do not want required training email, speak to your training administrator.
If mail to your address bounces or is reported as spam, we stop sending to it, and your employer’s report shows the mail was not delivered.
7. Retention
We keep personal information for as long as it is needed to provide the Service to your employer, fulfill legal obligations, resolve disputes, or enforce agreements. Retention periods for your training record, viewing record and email record are set by your employer’s agreement with OSA, unless a shorter or longer period is required by law. On written request, we will make commercially reasonable efforts to delete or anonymize personal information sooner where your employer’s agreement and the law allow.
8. Your Rights
Depending on where you live, you may have the right to know what personal information we hold about you, to correct it, to have it deleted, and not to be treated differently for asking. California residents have these rights under the CCPA as amended by the CPRA, including the right to know the categories and specific pieces of personal information collected (up to twice in 12 months). We do not sell or share personal information and do not use sensitive personal information, so there is nothing to opt out of or limit, but you may ask us to confirm it.
Because your employer controls your training record, we may pass your request to your employer or need its instruction, for example before deleting a record it must keep. To make a request, email privacy@osa.io with your name, work email and employer. We may confirm your identity by email. An authorized agent may ask on your behalf with proof of authorization. We respond within 45 days (extendable by another 45 days where needed), free of charge.
9. Security
We use reasonable technical, administrative and physical safeguards: encryption in transit and at rest, personal links and cookies stored only as fingerprints, and staff access through single sign-on. No system is completely secure. If a breach affects your personal information, we will notify affected parties as the law and our agreements require.
10. Children
The Service is for employees and contractors of our customers and is not directed to anyone under 16. If you believe a minor’s information has reached us, contact privacy@osa.io.
11. Governing Law and Dispute Resolution
This Privacy Policy is governed by the laws of the State of Ohio, without regard to conflict of laws principles. Disputes are subject to the dispute resolution provisions of our Terms of Service and will be resolved exclusively in the state or federal courts located in Columbus, Ohio.
12. Accessibility
If you need this policy or any privacy record in an accessible format, contact privacy@osa.io and we will make reasonable efforts to provide it.
13. Changes to This Policy
We may update this policy. Material changes will be announced in the Service at least 14 days before they take effect where reasonably practicable. A change to the cookies means you are shown the cookie notice again before your training plays. The current version is always on this page.
14. Contact Us
- Email: privacy@osa.io
- OSA Technology Partners LLC, Columbus, Ohio, USA
Last updated November 14, 2026.