Privacy Policy

V2C Inc, a Delaware corporation, is the data controller responsible for your personal data. For any questions about this Privacy Policy or our data practices, contact us at: [email protected]

3.1 Information You Provide

• Email sign-in: We send a one-time code to your email address. There is no password
• Account Information: Name, email address, country, and region when you create an account
• Profile Information: Alias, profile picture
• Linked Emails: Other email addresses you add, so we can match certifications issued to them
• Credential Data: Professional certifications you add, including issuer, credential name, dates, and any certificate files you upload

3.2 Information Collected Automatically

• Device Information: Device type, operating system, unique device identifiers
• Usage Data: Features used, time spent, actions taken within the app
• Log Data: IP address, browser type, access times
• Web Analytics: Cloudflare Web Analytics counts page views on this website. It sets no cookies and does not track you across sites
• Error Reports: When something breaks, an error report is sent to Sentry. The website sends only an internal user id. The current mobile app also sends your email address

3.3 Third-Party Data

• Credly: When you link your Credly profile, we access your public badge information
• Accredible: When you add an Accredible credential, we check it with Accredible and read who it was issued to
• Microsoft Learn: When you import your Microsoft Learn transcript, we read the certifications on the transcript you shared. Microsoft Learn also returns your name and the contact email you choose to share. We use that email only to confirm the certifications are yours, and we do not store it

We use your information for the following purposes:

• To provide and maintain our Service
• To verify and display your professional credentials
• To calculate and display your ranking on leaderboards
• To generate shareable profile pages and verification links
• To send sign-in codes and occasional product emails (every one has an unsubscribe link), and welcome push notifications in the app if you allow them
• To send you notifications about credential expiration or rank changes (with your consent)
• To improve and personalize our Service
• To detect and prevent fraud or abuse

We process your personal data under the following legal bases:

• Contract: Processing necessary to provide our Service to you
• Consent: Where you have given explicit consent (e.g., marketing communications)
• Legitimate Interests: For fraud prevention, security, and service improvement
• Legal Obligation: When required by applicable law

We may share your information with:

• Public Profiles: Your real name, alias, profile picture, country, points, rank, and verified credentials are publicly visible on your own profile page, and search engines can find it
• Verification Pages: The same information, including your real name, is visible to anyone with your verification link, which points search engines to your public profile
• Everywhere Else: Leaderboards, leaderboard search and share images made on the website show your alias only, never your real name. Rank and certification images you share from the CertScore mobile app currently include your real name
• Service Providers:
  • Supabase: database, sign-in and file storage
  • Cloudflare: hosting, security, image storage, and Web Analytics (no cookies)
  • Anthropic: AI that reads uploaded certificates and checks names and profile pictures
  • Resend: email delivery
  • Sentry: error reports
  • OneSignal: push notifications in the mobile app, if you allow them
  • Expo: mobile app updates, which share your device details and IP address with Expo
  • Slack: internal alerts to our team, which can include your name, alias and email
• Legal Requirements: When required by law or to protect our rights

We do not sell your personal data to third parties.

Your data may be transferred to and processed in countries outside the European Economic Area (EEA). We ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission.

We retain your personal data for as long as:

• Your account is active
• Needed to provide our Service
• Required by applicable law

When you delete your account, we delete your profile, certifications, linked emails, and profile picture right away. Copies in our database backups are removed as those backups expire, within 30 days, except where retention is required by law.

We keep your email address and alias in our security log as a record that the account was deleted. We keep that record for security and legal purposes, and it has no set deletion date. Internal team alerts that were already sent (see Service Providers) can include your name, alias or email, and they are not removed.

Under GDPR, you have the following rights:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your data ("right to be forgotten")
• Restriction: Request limitation of processing
• Portability: Receive your data in a portable format
• Objection: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw consent at any time where processing is based on consent

To exercise these rights, contact us at [email protected] or use the "Delete account" option in Settings.

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption in transit (TLS) and at rest
• Row-level security policies in our database
• Regular security assessments
• Access controls and authentication

Our Service is not directed to individuals under 16 years of age. We do not knowingly collect personal data from children. If you become aware that a child has provided us with personal data, please contact us.

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date. For significant changes, we will provide notice through the app or by email.

If you have questions about this Privacy Policy or wish to exercise your rights, contact us at:

• V2C Inc, a Delaware corporation
• Email: [email protected]

If you are in the EEA and believe we have not adequately addressed your concerns, you have the right to lodge a complaint with your local data protection supervisory authority.