Privacy Policy

1. Introduction

This Privacy Policy explains how CertiTrack (“we”, “us”, or “our”), a business based in Seattle, Washington, USA, collects, uses, shares, and protects personal information when you visit thecertitrack.com, use the CertiTrack application at app.thecertitrack.com, or use the vendor upload portal (together, the “Services”).

CertiTrack is a business tool. Our customers are companies that use the Services to track the compliance documents of their vendors, contractors, and suppliers. This policy applies to our customers’ users, to website visitors, to people who start signing up, and to vendors who receive emails from us or upload documents through the portal. If you do not agree with this policy, please do not use the Services.

2. Our role: controller and processor

Account and website data. For information about our customers’ users, website visitors, and people who start signing up, CertiTrack decides how the information is used and acts as the “controller” (or “business” under California law).
Customer Data. For the information our customers upload or enter about their vendors (for example vendor names, contact details, certificates, licenses, permits, and payment records), we act as a “processor” or “service provider” on the customer’s behalf. The customer decides what is collected, why, and how long it is kept, and is responsible for having a lawful basis to share it with us and to have us contact their vendors. We process Customer Data only on the customer’s instructions, as set out in our Terms of Service and this policy.
If you are a vendor and have a question about your information, or want it corrected or deleted, please contact the company that requested your documents. We will help them respond. If you cannot reach them, email us at legal@thecertitrack.com and we will pass your request on.

3. Information we collect

Information you give us

Account details: first and last name, work email address, company name, company industry and time zone, your password (stored only in hashed form), and your user role in the account.
Sign-up details: the name, email address, and company name you enter when you start signing up, even if you do not finish.
Terms acceptance record: when you accept our Terms of Service, we record the date and time, the version of the Terms you accepted, and the IP address you accepted from.
Billing details: your plan, billing period, and billing history. Card and bank details are entered directly with our payment processor, Stripe, on Stripe’s pages. We never see or store full card numbers.
Customer Data: vendor names, contact names, email addresses, phone numbers, addresses, categories, notes, uploaded documents (such as certificates of insurance, licenses, and permits), the details extracted from them (such as expiry and effective dates, policy numbers, insurer names, and coverage amounts), and payment records (amounts, dates, statuses, and any recorded override of a compliance warning).
Vendor portal uploads: the files and document types a vendor submits through a secure upload link.
Communications: messages you send to us, including support requests and anything you attach to them.
Settings: notification and account preferences.

Information collected automatically

Technical and log data: IP address, browser type, device and operating system, pages and features used, and the date and time of requests. We record the IP address when you sign up, sign in, request or complete a password reset, and accept our Terms, to protect accounts and to keep a record of acceptance.
Product activity: actions taken in your account (for example uploads, extractions, confirmations, reminders sent, plan changes, and payment overrides), kept as an activity log for your company, together with the IP address the action came from.
Email activity: whether a service email we sent was delivered or bounced, so we can fix delivery problems.
Cookies and browser storage: see Section 7.

Information from others

Members of your company may add you as a user by entering your name and email address.
Customers provide information about their vendors, as described in Section 2.
When you sign up, an email verification service (ZeroBounce) checks that your email address is valid and deliverable. We send it only the email address.
Stripe sends us the status of your subscription and payments (for example that a payment succeeded or failed), not your card details.

Information we do not collect

We do not ask for and do not want government identification numbers (such as Social Security or tax identification numbers), bank account numbers, or health information. Please do not enter them into notes, vendor fields, or support messages. If a document you upload happens to contain such details, it is stored as part of that document, as described in Section 8.

4. How we use information

We use personal information to:

Provide, operate, maintain, and secure the Services, including your account, your company’s account, and your subscription.
Read uploaded documents with AI to extract details such as expiry dates, and show them to you for review and confirmation. The free certificate checker on our website reads a file the same way, without storing it.
Calculate compliance scores and schedule expiry reminders based on the information in your account.
Send service emails: verification codes, password resets, expiry reminders to you and your vendors, upload requests and upload confirmations, usage and plan-limit alerts, billing notices, and notices about changes to the Services or these policies.
Send a short series of getting-started emails to new accounts (for example a nudge to verify your email or upload a first document). You can turn these off in Settings under Notifications. Service emails that are needed to run your account cannot be turned off while the account is open.
Process payments and manage plans, limits, and usage counts.
Respond to questions and support requests.
Understand how the Services are used, fix problems, and improve them.
Detect and prevent fraud, abuse, and security incidents, and enforce plan limits.
Comply with law and enforce our Terms of Service.

Where the GDPR, the UK GDPR, or similar laws apply, we rely on these legal bases: performing our contract with you or your company; our legitimate interests in running, securing, and improving the Services and in communicating with our customers; your consent where we ask for it; and compliance with legal obligations.

AI and your documents. We do not use Customer Data to train AI models, and we do not allow our providers to. Our AI provider, Anthropic, reads documents for us under commercial terms that do not allow it to train its models on them. The AI suggests details; a person on your team confirms them before they count. The AI does not verify that a document is genuine, that coverage is adequate, or that endorsements are present.

We do not make decisions about you that have legal or similarly significant effects using automated processing alone.

We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not rent or trade lists. We share information only as follows:

Service providers (sub-processors) that help us run the Services, under contracts that require them to protect the information and use it only to provide their services to us:

Provider	Purpose	Location
Xano	Application backend and database	United States
Amazon Web Services (S3)	Private storage of uploaded document files	United States
Cloudflare	Website and application hosting, DNS, and network security	Global network, headquartered in the United States
Stripe	Payment processing, invoicing, and the billing portal	United States
Anthropic	AI reading of uploaded documents	United States
Resend	Sending service emails	United States
ZeroBounce	Checking that email addresses are valid at sign-up	United States
Google Fonts	Delivering the typeface used on our website and application (your browser requests the font file from Google, which sees your IP address)	United States

We will update this table before adding a provider that handles personal information. Advertising measurement on the marketing website, if any, is described in Section 7.

Within your company account. Other users in your company account can see the Customer Data, settings, billing information, and activity in that account.
Your vendors. When you send a vendor a reminder or an upload request, the vendor receives the information you include in it, together with your company’s name and the names of the documents requested.
Stripe as an independent business. When you pay, Stripe collects your payment details under its own privacy policy and acts as an independent controller for the information needed to process payments and prevent fraud.
Business transfers. If we are involved in a merger, acquisition, financing, reorganization, or sale of all or part of our business or assets, information may be transferred as part of that transaction. We will notify account owners before their information becomes subject to a different privacy policy.
Legal reasons. To comply with law, regulation, or valid legal process; to respond to lawful requests from public authorities; or to protect the rights, property, or safety of CertiTrack, our customers, their vendors, or others. Where the law allows, we will tell the affected customer before disclosing their Customer Data.
With your direction or consent.

6. Data retention

Account information and Customer Data are kept while your company’s account is active, so that the Services work and your history is available to you.
When an account is closed, or when you ask us to delete your data, we delete or anonymize personal information within 30 days, except where we must keep it longer to meet legal, tax, or accounting obligations, resolve disputes, or enforce our agreements. Billing records are kept for as long as tax and accounting rules require (usually 7 years).
Sign-up details for people who do not finish signing up are deleted or anonymized within 12 months.
Vendor upload links expire after the period shown in the request (72 hours by default). The record that a link was issued and used is kept with the account’s activity log.
Security and sign-in logs are kept only as long as needed for security purposes, normally no more than 12 months.
Backups are overwritten on their regular cycle, normally within 30 days of deletion from the live system.
Free certificate checker on our website: the file you upload is read once to produce the summary and is not stored. We keep only a one-way scrambled form of your IP address, the file type, and the time of the check, to limit the free tool, for no more than 30 days.
We may keep aggregated or anonymized information that no longer identifies anyone, for example counts of documents processed.

7. Cookies and browser storage

The CertiTrack application uses your browser’s local storage to keep you signed in and to remember small preferences (for example, whether you hid the Getting Started card). These are strictly necessary for the application to work. The application does not use advertising or tracking cookies, analytics scripts, or third-party scripts of any kind.

Stripe’s checkout and billing pages, which open when you pay or manage a subscription, set their own cookies for fraud prevention under Stripe’s privacy policy.

The marketing website at www.thecertitrack.com uses Google Ads conversion tracking. When you arrive from one of our ads and later create an account, Google sets a first-party cookie on this domain so we can tell which ads lead to signups. We do not see who you are from this data. The application at app.thecertitrack.com does not load any advertising or analytics scripts. You can opt out through your browser settings or at adssettings.google.com.

We do not respond to browser “Do Not Track” signals, because there is no agreed standard for them. Where a Global Privacy Control signal is recognized by law as an opt-out of sale or sharing, we honor it, and in any case we do not sell or share personal information.

You can clear cookies and local storage in your browser settings at any time. If you do, you will be signed out of the application.

8. Security

We use technical and organizational measures designed to protect personal information, including:

Encryption of data in transit using TLS (HTTPS) on every page and API request.
Passwords stored only as salted hashes, never in readable form.
Uploaded documents kept in private cloud storage in the United States, encrypted at rest, and never published at a public address.
Documents opened only through links that expire after five minutes, issued after we confirm the person is signed in to the company that owns the document.
Each company’s data available only to that company’s signed-in users.
Upload links for vendors that are unique, tied to one vendor, limited to a small number of files, and expire.
Strict browser security headers on the application, and no third-party scripts inside it.
Limited internal access to production systems, protected by strong credentials.
Automated checks that stop secrets from being committed to our code.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your password confidential and for the people you invite to your account. If we learn of a security incident that affects your personal information, we will notify affected customers without undue delay, and notify authorities and individuals as required by law.

9. Your privacy rights

Depending on where you live, you may have the right to:

Know what personal information we hold about you and access it.
Correct inaccurate or incomplete information.
Delete your personal information.
Receive your information in a portable, machine-readable format.
Object to or restrict certain processing.
Withdraw consent where we rely on consent, without affecting processing that happened before.
Not be discriminated against for exercising these rights.

You can update your name, email address, and preferences at any time in the application under Settings. For anything else, email legal@thecertitrack.com. We will verify your identity before acting on the request, usually by confirming the request from the email address on the account, and respond within 30 days, or within any shorter period the law requires. You may use an authorized agent where the law allows; we will ask for proof that the agent is authorized. If we deny a request, we will explain why, and you may ask us to review the decision.

If you are in the EEA, UK, or Switzerland, you may also complain to your local data protection authority.

If your request concerns Customer Data (for example, you are a vendor of one of our customers), we will pass it to that customer and help them respond, because the customer controls that data.

California residents. In the last 12 months we have collected the categories of personal information described in Section 3 (identifiers, commercial information, internet activity, professional information, and the contents of documents and messages) for the purposes in Section 4, and shared them only with the service providers and other parties in Section 5. We do not sell personal information, do not share it for cross-context behavioral advertising, and do not use or disclose sensitive personal information for purposes other than providing the Services. You have the rights listed above, including the right to know, delete, correct, and not be discriminated against. California’s “Shine the Light” law: we do not disclose personal information to third parties for their own direct marketing.

10. International data transfers

We are based in the United States and our service providers process information there and, for Cloudflare’s network, in the country closest to the visitor. If you use the Services from outside the United States, your information will be transferred to and processed in the United States, whose data protection laws may differ from those where you live. Where required, we use appropriate safeguards for these transfers, such as the Standard Contractual Clauses approved by the European Commission and the UK Addendum. Customers who need a data processing agreement for Customer Data can email us at legal@thecertitrack.com.

11. Children’s privacy

The Services are for businesses and are not directed to anyone under 18. We do not knowingly collect personal information from children under 16. If you believe a child has given us personal information, email legal@thecertitrack.com and we will delete it.

12. Links to other websites

The Services may link to other websites and services, such as Stripe’s checkout and billing pages or the websites of insurers and licensing bodies. Their privacy practices are governed by their own policies, not this one.

13. Changes to this policy

We may update this policy from time to time. We will post the new version on this page and update the “Last updated” date. If the changes are material, we will also notify account owners by email or in the application before they take effect. Your continued use of the Services after a change takes effect means the updated policy applies.

14. Contact us

Questions or requests about this policy or our data practices:

Email: legal@thecertitrack.com
Postal mail: CertiTrack, Seattle, Washington, USA. Email is the fastest way to reach us; if you need a mailing address for a legal notice, email us and we will provide one.