Training

Draft for review. Not yet in effect.

Privacy Notice

Updated October 28, 2026

NRLC Training is the National Railway Labor Conference’s site for its training programs. This notice explains what it knows about you, why, and who else sees it. It goes with the Terms of Use.

The short version

  • We collect what we need to run a training program: who you are, your registration and payment, and your feedback.
  • Your card number goes to Stripe, never to us.
  • Anonymous surveys keep no name, email, IP address or device with your answers.
  • We don’t sell anything, run ads or track you, and our emails don’t track opens or clicks.

What we collect

  • Your registration: your name, work email, mobile number, railroad and job title, any dietary or accessibility needs you tell us, and, if someone else pays, their email.
  • Payment: the amount, whether it was paid by card or check, any check number, and any refund. Stripe handles card payments; we never see or keep your card number.
  • Signing in: when you sign in, and how. When you enter your email, we check whether NRLC’s Microsoft directory has it, to send you to the right sign-in. An emailed code is kept only in scrambled form, and deleted after a day. The site doesn’t record your IP address or device; Microsoft and our host keep their own standard logs.
  • Your program: your exercise team, whether you’ve booked your hotel room, and which files you’ve downloaded.
  • Surveys: your answers. A named survey keeps them with your name. An anonymous survey keeps only the answers and the date; a cookie on your phone stops it being answered twice.
  • Email: which of the site’s emails went to you and whether they arrived.

Who sees it

  • NRLC staff who run the training programs see registrations, payments, teams, downloads and named survey answers, for the programs they run.
  • Presenters see the survey results for their own modules, never who gave them.
  • Other trainees don’t see your details.
  • NRLC staff travel through the NRLC member portal. For that, the site tells the portal a program’s dates, place, hotel and schedule, and which presenters, program staff and program managers are NRLC staff or have portal accounts. It doesn’t tell the portal anything about trainees, registrations, payments, files or surveys. If that ever changes, we’ll update this notice first.

Who helps us run it

  • Stripe takes card payments and sends your receipt, under its own privacy policy.
  • Microsoft runs sign-in, NRLC’s directory and email, under NRLC’s Microsoft 365 agreement and its Data Protection Addendum.
  • Vercel hosts the site, and Supabase holds its database and files, each under its Terms of Service.

Everything is stored in the United States.

How long we keep it

  • Dietary and accessibility notes: deleted 30 days after the program.
  • Sign-in codes: deleted after a day.
  • Registrations and payments: kept for NRLC’s accounting records [Open: how long, Dottie].
  • Survey answers and the record of changes staff make: kept.

You can sign in to see a program until three months after its last day. If you’re NRLC staff or have an NRLC portal account and sign in with Microsoft, you keep access.

Cookies

One cookie keeps you signed in, for 14 days. Another holds your email for 15 minutes while you sign in. An anonymous survey sets one so it can’t be answered twice from the same phone. There are no analytics or advertising cookies.

Keeping it safe

The site checks who you are and what you’re on, on its own server, before it shows any page or file. Data is encrypted in transit and at rest, only the site’s own server can reach the database, and staff actions are logged.

Your choices

To see, correct or delete what we hold about you, write to mmaratto@rrnrlc.org. We may need to keep some records for accounting, security or legal reasons. If we change this notice, the date at the top changes too.