Privacy Policy

1. What we collect

Account data. Your email address and password (stored only as a salted hash by our authentication provider, never in plain text). Optionally your full name, if you enter one.

Study profile. The certification track you are studying for, your target exam date if you set one, and your study streak.

Study activity. The questions, flashcards, study notes, games, and performance based questions you interact with; the answers you give; whether they were correct; how long you took; your exam simulator attempts and scores; your generated study plan and which tasks you complete; and the readiness scores we calculate from all of that.

Billing data. If you subscribe, our payment processor handles your card details. We never see or store full card numbers. We store a customer identifier, your plan, and your subscription status.

Content you submit. Reviews or testimonials you choose to send us, and any email you send to our support addresses.

Technical data. Standard server logs and product analytics events, such as pages viewed and features used, together with your IP address, browser, and device type.

We do not collect special category data, and we do not ask for it.

2. Why we use it

• To create and run your account, and to authenticate you (performance of our contract with you).
• To deliver the study features you asked for: serving questions, tracking progress, scheduling revision, and calculating readiness (performance of our contract).
• To take payment and manage your subscription (performance of our contract).
• To send transactional email such as sign-in confirmations and password resets (performance of our contract).
• To understand how the Service is used so we can improve it, and to keep it secure and prevent abuse (our legitimate interests).
• To display a testimonial you submitted, with the first name and last initial you gave us (your consent, which you can withdraw).
• To comply with legal obligations such as tax and accounting rules.

We do not sell your personal data, and we do not share it for cross-context behavioural advertising.

3. Who we share it with

We use a small number of service providers who process data on our behalf under contract, and only for the purposes above:

• Supabase - database, authentication, and file storage.
• Vercel - application hosting and delivery.
• Stripe - payment processing and subscription billing.
• Resend - transactional email delivery.
• PostHog - product analytics.

We may also disclose data if required by law, or as part of a merger or acquisition, in which case we will tell you before your data becomes subject to a different policy.

4. International transfers

Our providers may process data in countries other than yours, including the United States. Where data leaves the UK or European Economic Area, we rely on appropriate safeguards such as the European Commission's standard contractual clauses.

5. How long we keep it

We keep your account and study data for as long as your account is open, because the value of the Service depends on your history. If you delete your account, we delete your personal data within 30 days, except where we must keep records longer for legal reasons such as billing and tax records, which we keep for up to seven years. Aggregated statistics that cannot identify you may be kept indefinitely.

6. Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, to correct it, to delete it, to object to or restrict how we use it, to receive a portable copy, and to withdraw consent where we rely on it. You also have the right to complain to your local data protection authority.

You can delete your account yourself at any time from Settings. Deleting your account immediately and permanently removes your profile, study progress, question and exam history, study plan, and any review you submitted, subject to the retention exceptions above.

To exercise any other right, email privacy@certclue.com. We will respond within 30 days. We will not treat you differently for exercising them.

7. Cookies

We use cookies that are strictly necessary to keep you signed in and to keep the Service secure. We also use analytics cookies to understand aggregate feature usage. We do not use advertising cookies and we do not run third-party ad trackers. You can clear or block cookies in your browser, but sign-in will not work without the necessary ones.

8. Security

Data is encrypted in transit and at rest by our infrastructure providers. Access to production data is limited to the people who need it. Row level security rules in our database restrict each account to its own records. No system is perfectly secure, but if a breach affects your personal data we will notify you and the relevant regulator as required by law.

9. Children

The Service is not directed at children under 16 and we do not knowingly collect their data. If you believe a child has given us personal data, contact privacy@certclue.com and we will delete it.

10. Changes

If we change this policy materially, we will give notice by email or in the Service before the change takes effect. The date at the top shows when this version was published.

11. Contact

[LEGAL ENTITY NAME], [REGISTERED BUSINESS ADDRESS]. Privacy questions and data rights requests: privacy@certclue.com.