Privacy and Security

MVP privacy and security statement for review prior to launch.

This page explains how the KSAWorks MVP handles identity, basic telemetry, and local configuration. It is written for MVP review and will be refined before production release.

Information we collect

  • Google account identifiers when you sign in: your email address and basic profile information provided by Google/Firebase.
  • Authentication metadata managed by Firebase Authentication (for example, session state and security tokens).
  • Limited client-side configuration stored in your browser (for example, link destinations configured on the Settings page).

Information we do not collect in this MVP

  • No learner transcripts, course history, or credential records are collected by the portal itself.
  • No payment information is collected.
  • No sensitive personal data is intentionally collected by the portal.

How information is used

  • Access control for secured pages (dashboard and settings) using an administrator allow-list.
  • Continuity of experience so sign-in status is consistent across the portal pages.
  • MVP validation of navigation flows and suite framing.

Browser storage

The portal stores a small amount of configuration in your browser using localStorage to remember link destinations for Composer, GuidEZ, and GuidEX. You can clear this at any time by clearing your browser site data.

Analytics

Firebase may be configured to provide basic analytics events depending on project settings. In this MVP, analytics is not used to profile users or sell data. If analytics is enabled, it is intended for aggregate product improvement.

Sharing and disclosure

This MVP does not sell personal information. Information may be processed by Google/Firebase as the identity provider and hosting platform. AcademyOne, Inc. may access authentication logs and configuration necessary to operate and secure the Service.

Security practices

  • Authentication is handled by Firebase Authentication using Google sign-in.
  • Restricted routes are enforced by client-side checks for the MVP and are intended to be reinforced server-side as the system matures.
  • Least data principle is applied: the portal is designed to avoid storing learner records and to keep the portal lightweight.

Your choices

  • You can sign out at any time from the portal header.
  • You can clear site storage in your browser to remove locally stored link settings.
  • If you believe your account should be added to or removed from the MVP allow-list, contact the MVP administrator.

The GoldSeam MCP service

GoldSeam (https://goldseam.ksaworks.com/mcp) is a free reference service that answers AI agents’ questions about public data — industry certifications and the KSA Dictionary’s shared vocabulary. It serves the same answer to every caller and holds no personal records.

  • What each tool call logs: a timestamp, the tool name, the query arguments as sent, a derived caller identifier (for anonymous callers, a one-way hash of the connecting address — raw IP addresses are never stored; for keyed callers, a hashed key identifier and the registered organization name), whether the answer was a hit or a miss, and the result count.
  • Retention: raw log entries are deleted after 90 days. Aggregates kept beyond that (calls per organization per month, miss counts, unmatched search phrases) carry no caller-linked detail.
  • Free keys: requesting a key asks for an email address and organization name, used only to issue the key, name the organization in the usage record, and follow up about service use. The end user an AI agent acts for is never visible to the service and is never contacted.
  • No sale or sharing: usage records are not sold and are not shared outside AcademyOne, Inc.; misses guide what public data is gathered next.

Changes to this statement

This statement may evolve as the MVP becomes a production service and as additional capabilities are introduced.

Contact

Questions about privacy and security — for the portal or the GoldSeam MCP service — may be directed to AcademyOne, Inc. at dmoldoff@ed-core.org.