Privacy Policy

This Privacy Policy explains how CertifyAI collects, uses, stores, and protects personal data. It is aligned with the principles of India’s Digital Personal Data Protection Act, 2023 (DPDP) and, where applicable, the GDPR.

1. Who is responsible

For account holders (organizations), CertifyAI is the data processor and the organization is the data controller for the recipient data they upload. Organizations are responsible for having a lawful basis and any required consent to upload student or recipient personal data.

2. Data we collect

• Account data — your name and email, managed by our authentication provider (Clerk). Passwords are stored and hashed by Clerk; we never see them.
• Organization data — organization name, address, website, branding.
• Recipient data you upload — names, roll numbers, courses, dates, and optional photos, used to generate documents.
• Usage data — counts of certificates generated, downloads, and verifications, for your dashboard analytics.

3. How we use data

We use data solely to provide the Service: to authenticate you, generate and verify documents, and show analytics. We do not sell personal data. We do not use recipient data for advertising.

4. Where data is stored

Data is stored in our database provider, Supabase (hosted on cloud infrastructure), and the application is hosted on Netlify. Generated PDFs are not stored — they are re-created on demand from your template and data. Access is protected by row-level security so one organization can never read another’s data.

5. Third parties

• Clerk — authentication (accounts, login, password reset).
• Supabase — database storage.
• Netlify — application hosting.
• Optional AI provider — if enabled, template-layout detection may send an uploaded template image to an AI provider; recipient personal data is not sent.

6. Retention

We retain data for as long as your organization is active. When you delete your organization (Settings → Danger zone), all of its templates, certificates, batches, and recipient data are permanently deleted from our database.

7. Your rights

Under DPDP and similar laws you may:

• access and correct your account and organization data (Settings);
• delete your organization and all its recipient data (Settings → Danger zone);
• delete your personal account via the account menu (handled by Clerk);
• contact us to exercise any data-subject right.

8. Security

We use HTTPS, row-level security, hashed passwords, security headers, and access controls. No system is perfectly secure, but we take reasonable measures to protect your data. We recommend you keep your own export/backup of important documents.

9. Children

Where recipient data concerns minors (e.g. students), the uploading organization is responsible for obtaining any consent required by law before uploading.

10. Contact

Data protection queries: privacy@certifyai.app (replace with your actual contact address before launch).

This document is a starting template, not legal advice. Have it reviewed by a qualified lawyer, appoint a contact/grievance officer as required by the DPDP Act, and update the details before launching publicly.