Who we are
Community Works Collective and RecWorks are operated by Raft Education LLC (d/b/a Community Works Collective; d/b/a RecWorks), PO Box 17299, Chapel Hill, NC 27516, USA.
This policy covers:
- the RecWorks credentialing platform at proof.recworks.io and its organization subdomains, including embedded submission forms, verification pages, certificates and credential files;
- the recworks.co website; and
- the communityworkscollective.com website.
Privacy questions and requests: privacy@recworks.co or privacy@communityworkscollective.com. Both reach the same person.
What we collect
We collect only what issuing, reviewing and verifying a credential requires.
| Who | What we collect | Where it comes from |
|---|---|---|
| Learners | Name and email address; answers to the organization's submission questions (for example reflections, links and uploaded files); submission date and status; reviewer decisions and feedback; credentials issued | The learner, through a form embedded in the organization's community or course platform |
| Learners | Group or cohort tags, and participation records such as tags applied to the learner's membership | The organization's community platform (for example Circle) or a roster the organization uploads |
| K-12 students | No name or email. Students sign in with a class code and a per-student code; only the teacher's own roster, kept outside RecWorks, links a code to a person | The teacher |
| Administrators and reviewers | Name, email address, role, and a record of review and issuance actions | The administrator, and sign-in through Auth0 |
| Website visitors (recworks.co and communityworkscollective.com) | Only what you type into a contact form (name, email, organization, message) | You |
We do not collect payment card data, government identifiers, or precise location. We do not use tracking pixels or advertising cookies, and we do not sell or share personal data for advertising.
How we use it
We use personal data to:
- route a submission to the right reviewers and record their decision;
- issue, sign, deliver and host the credential, and send the email that delivers it;
- let anyone the learner shares a credential with verify that it is genuine;
- let administrators run their programs, including reports on submissions and credentials for their own organization; and
- keep the service secure, fix problems and answer support requests.
Our legal basis for platform data is contractual necessity: issuing and delivering the credential a learner has earned. We process it under our agreement with the organization that runs the program. For contact-form messages, our legal basis is our legitimate interest in replying to you. We do not use personal data to train AI models or build profiles for marketing.
Our role
For learner and program data, the organization that runs the program decides what is collected and why. It is the controller, and RecWorks processes the data on its behalf. If you are a learner, contact that organization first; we will help them answer your request. For website contact messages and administrator accounts, Raft Education LLC is the controller.
A Data Processing Agreement is available to customer organizations on request at privacy@recworks.co.
Sub-processors and where data lives
All platform data is stored in the United States. The database is in US West (Oregon); hosting is in US East.
| Sub-processor | Purpose | Data involved | Location |
|---|---|---|---|
| Supabase | Database | All platform records described above | United States (US West, Oregon) |
| Vercel | Hosting and delivery; storage of badge images and uploaded files (Vercel Blob) | Name and email in transit; badge images and files learners upload | United States (US East) |
| Auth0 (Okta) | Administrator sign-in | Administrator name and email | United States |
| Twilio SendGrid | Email delivery | Recipient name and email; message content | United States |
| Circle | Looking up a learner's membership tags in the organization's Circle community, when the organization connects one | Learner email | United States |
If you are outside the United States, your data is transferred to and processed in the United States. We will tell customer organizations before adding or replacing a sub-processor.
Credentials you can share
A credential is meant to be shown to others, so parts of it are published. What appears depends on the privacy level the organization sets for the credential:
| Privacy level | What a visitor to the verification page sees |
|---|---|
| Public | The learner's full name and the credential |
| Limited name | First name and last initial, and the credential |
| Anonymous | The credential, with no name |
| Private link | The credential, only for people who have its link |
| Fully private | Nothing; the credential has no public page |
At every level, the learner's email address never appears in plain text in a published credential. It is replaced by a salted one-way hash, which lets someone who already knows the email confirm a match but does not reveal it. Credentials are cryptographically signed, so anyone can check one is genuine without signing in.
Once a learner shares a credential, for example by adding it to LinkedIn or downloading the badge file, copies outside RecWorks are beyond our control. If a credential is revoked, its verification page shows that it is revoked.
How long we keep it
- Issued credentials are kept for as long as the credential is active, so it can still be verified. When a customer's agreement ends, the organization chooses whether its credentials stay verifiable or are deleted within 90 days.
- Submissions, uploaded files and review records are kept for the life of the program plus 12 months, then deleted, unless the organization asks us to delete them sooner.
- Contact-form messages are kept for 24 months.
- Backups are automated, encrypted, taken daily, and kept for 7 days. Deleted data leaves the backups within that window.
When an organization ends its service, we delete or return its data as our agreement with it sets out.
Security
- Data is encrypted in transit (TLS) and at rest.
- Each organization's data is kept separate; administrators and reviewers see only their own organization's records, and scoped reviewers see only the submissions assigned to their group.
- Administrator sign-in runs through Auth0.
- Credentials are signed with Ed25519, so any change to a credential is detectable.
- If a breach affects personal data, we notify affected customer organizations and, where required, supervisory authorities within 72 hours of becoming aware of it.
The RecWorks Trust Center has more detail for security reviewers.
Your rights
Depending on where you live, you may have the right to:
- see the personal data we hold about you and get a copy;
- have it corrected, for example a misspelled name on a credential;
- have it deleted, or have a credential made private or revoked;
- object to or restrict how it is used; and
- complain to your data protection authority.
Learners: send your request to the organization that issued your credential, or to privacy@recworks.co and we will pass it to them and help them respond. Everyone else: email privacy@recworks.co. We reply within 30 days and may need to confirm your identity first. We do not charge for requests.
Children
RecWorks can be used in K-12 programs without collecting any student's name or email. Students sign in with class and student codes, and only the teacher's roster, kept outside RecWorks, links a code to a child. Schools and districts using RecWorks remain responsible for their own obligations under laws such as COPPA and FERPA.
Cookies and browser storage
- recworks.co and communityworkscollective.com: no analytics or advertising cookies. If you choose a language, our translation service (Weglot) sets one cookie to remember it.
- The RecWorks platform: uses only the cookies needed to keep administrators signed in. Submission forms and verification pages set no cookies. Interactive course content stores a random identifier in your browser so your progress can be saved; it contains no personal information.
Changes to this policy
When we change this policy we update the date at the top and keep earlier versions available on request. For material changes, we email customer organizations and credential holders before the change takes effect.
Contact
privacy@recworks.co · privacy@communityworkscollective.com
Raft Education LLC, PO Box 17299, Chapel Hill, NC 27516, USA