Privacy Policy

This policy explains what personal data CertifyAIx (“we”) collects when you use CertifyAIx, why, who it is shared with, and your rights. We are the data fiduciary (controller) for this data.

1. What we collect

• Account details — your name and email address. If you sign up with a password we store only a one-way (bcrypt) hash of it, never the password itself. If you sign in with Google we receive your name, email address and profile photo from Google.
• Profile details you choose to add — job title and country. We also record your timezone, detected from your browser, so daily limits and streaks follow your local day.
• Learning activity — the certifications you add, your answers and attempts, bookmarks and notes, practice and exam sessions (including time spent), and daily activity totals.
• Exam session details — the IP address and browser type when you start a timed exam, used to keep sessions secure and resolve disputes.
• Things you post or send — discussion comments (shown to other learners with your name), question reports, feedback messages, and material you upload to the Contribute feature.
• Payments — the plan bought, amount, currency, your approximate country, status and Razorpay's order and payment references. Card, UPI and bank details are entered with Razorpay and never reach us.

2. Why we use it

• To provide the Service: your account, sign-in, progress tracking, plans and access.
• To process payments and keep the records tax law requires.
• To run the Contribute feature: uploads are analysed to extract anonymised topic signals (which topics and concepts the material tests) that help us write new, original questions. Your wording is not published.
• To keep the Service secure, prevent abuse and enforce our Terms.
• To answer your messages and handle complaints.

We process data with your consent (given when you sign up or upload) and where necessary to provide the Service you asked for, meet legal obligations, or for our legitimate interest in keeping the Service secure. We do not sell personal data, show advertising, or use your data to profile you for marketing.

3. Who we share it with

Only with service providers who process it on our behalf, under contract, for the purposes above:

• Google Cloud — hosting, database and file storage for uploads.
• Google — sign-in, if you choose “Continue with Google”.
• Anthropic — an AI service that analyses Contribute uploads to extract topic signals. Uploads are sent only when you submit them.
• Razorpay — our payment gateway, which processes payment when you buy a plan. We share your name and email to pre-fill the checkout; your payment details are collected by Razorpay directly and handled under Razorpay's privacy policy. Razorpay tells us the order and payment reference, amount and status so we can activate your access.

We may also disclose data where the law requires it, or to protect rights and safety. Some providers may process data outside your country; we rely on their contractual and security commitments when they do.

4. Cookies and local storage

We use what the Service needs to work, and analytics to improve it:

• Sign-in cookies — keep you signed in and protect forms against cross-site request forgery. These are strictly necessary.
• Browser storage — remembers display preferences such as light/dark theme and whether the side panel is collapsed. It stays in your browser.
• Analytics — Google Analytics and Microsoft Clarity tell us which pages and features people use (for example, which certifications are practised and where sign-up or checkout is abandoned), using cookies and similar technology. Clarity may record anonymised interactions such as clicks and scrolling; we mask text you type. We use this only to improve the Service, never to sell data. Visitors in the EEA, the UK and Switzerland are asked first, and nothing is set unless they accept; you can change your choice by clearing this site's data in your browser.

We do not sell personal data or use it for third-party advertising profiles.

5. How long we keep it

• Account and learning data — while your account is open. When you ask us to delete your account, we delete or anonymise it within 30 days.
• Uploaded files — until you delete the upload or your account. Anonymised topic signals derived from them contain none of your wording and are kept.
• Payment records — for as long as tax and accounting law requires, even after account deletion.
• Security logs — for a limited period needed to investigate abuse.

6. Your rights

Subject to applicable data-protection law — including, where it applies, the EU/UK GDPR — you can ask to:

• access a summary of the personal data we hold about you;
• correct or update it (most profile details can be edited in the app);
• delete it or close your account;
• withdraw consent (this does not affect processing already done);
• nominate someone to exercise your rights if you are unable to.

Email support@certifyaix.com from your account’s address. We respond within 30 days. If you are not satisfied, you may complain to your local data protection authority.

7. Security

We use encrypted connections (HTTPS), hashed passwords, access controls and least-privilege access to production systems. No system is perfectly secure; we will notify you and the authorities of a personal data breach as the law requires.

8. Children

CertifyAIx is for adults preparing for professional certifications. It is not intended for anyone under 18, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.

9. Changes

We will update the “last updated” date when this policy changes and notify signed-in users of material changes.

10. Complaints

Privacy complaints can be sent to support@certifyaix.com.

Questions about this policy: support@certifyaix.com.