Privacy Policy
Effective date: 21 April 2026 · Last updated: 26 April 2026
1. Who We Are
CertVault ("CertVault", "we", "us", or "our") operates the CertVault platform at certvaultapp.com. CertVault enables workers to store and share professional certificates and compliance documents with employers worldwide.
For the purposes of the GDPR and UK GDPR, CertVault is the data controller of your personal data. For questions about how we handle your data, contact us at legal@certvaultapp.com.
2. What Personal Information We Collect
2.1 Workers
When you register and use CertVault as a Worker, we may collect:
- Identity: full name, profile photo.
- Contact: email address.
- Location: country of residence, work rights.
- Professional: industries, roles, work types, availability status.
- Documents: certificates, licences, qualifications, and other compliance documents you upload.
- Health data (special category): medical fitness certificates and immunisation records — only if you explicitly upload them and consent to their processing.
- Account activity: login timestamps, document upload dates, last active date.
- Consent records: timestamps and version of consent given at signup and for sensitive data.
2.2 Employers
When you register and use CertVault as an Employer, we may collect:
- Identity and contact: name, email address, company name.
- Billing: payment method details (handled by Stripe — we do not store card numbers).
- Account activity: worker searches, contact requests, workforce management activity, login timestamps.
2.3 Automatically Collected Information
- Log data: IP address, browser type, pages visited, time spent.
- Device information: operating system, screen resolution.
- Session cookies (strictly necessary for authentication — see Section 11).
2.4 Security Scanning
All documents uploaded to CertVault are submitted to a third-party security scanning service to check for malware. This involves transmitting the file to the scanning provider. See Section 6 for details.
3. Lawful Basis for Processing (GDPR / UK GDPR)
Under the GDPR and UK GDPR, we must have a lawful basis for processing your personal data. The table below sets out the basis we rely on for each type of processing:
| Processing Activity | Lawful Basis |
|---|---|
| Creating and managing your account | Contract (Art. 6(1)(b)) |
| Displaying your profile and documents to employers you share with | Contract (Art. 6(1)(b)) |
| Sending account transactional emails (password resets, expiry reminders) | Contract (Art. 6(1)(b)) |
| Processing payments via Stripe | Contract (Art. 6(1)(b)) |
| Security scanning of uploaded files | Legitimate interests (Art. 6(1)(f)) — protecting platform integrity |
| Updating last-active date to keep worker profile visible in search | Legitimate interests (Art. 6(1)(f)) — core platform function |
| AI-powered certificate data extraction (scan-on-upload) — non-sensitive documents (licences, work visas, site safety cards, etc.) | Legitimate interests (Art. 6(1)(f)) — user convenience feature |
| AI-powered certificate data extraction (scan-on-upload) — special category data (medical fitness, immunisation records) | Explicit consent (Art. 6(1)(a) + Art. 9(2)(a)) — only processed where the worker has given specific consent for AI processing of these document types at upload |
| AI in-app assistant conversations | Legitimate interests (Art. 6(1)(f)) — product support |
| Processing medical / immunisation records (special category health data) | Explicit consent (Art. 9(2)(a)) — workers must actively consent before upload |
| Storing consent audit trail (terms_agreed_at, consent timestamps) | Legal obligation (Art. 6(1)(c)) — GDPR compliance record-keeping |
| Complying with legal requests | Legal obligation (Art. 6(1)(c)) |
For Australian users, the corresponding basis is purpose-limitation under the Australian Privacy Principles (APP 3, APP 6).
4. Special Category Data — Health Records
Medical fitness certificates and immunisation records are special category personal data under GDPR Article 9 and equivalent laws. We only process this data when you have given us explicit, informed consent (recorded with a timestamp in our system) before any upload.
You may withdraw this consent at any time by deleting your medical/immunisation records and contacting us at legal@certvaultapp.com to request removal of your consent record.
We never share health records with anyone other than employers you explicitly choose to make your profile visible to.
The consent record stored at upload time includes a timestamp and acknowledgment that: (a) the file will be scanned for malware by VirusTotal (which may retain samples per its own policy); (b) the document's text content may be processed by Anthropic for OCR purposes; (c) consent can be withdrawn at any time by deleting the record and contacting legal@certvaultapp.com; and (d) the consent record (this acknowledgment + a timestamp) exists alongside your account and is removed in full when you close your CertVault account — we retain no audit trail of past consent.
5. How We Use Your Information
- To provide and operate the Platform.
- To enable workers to store and share professional documents with employers.
- To enable employers to search for, view, and manage worker profiles.
- To send account-related notifications (password resets, document expiry reminders, platform updates).
- To process subscription payments securely via Stripe.
- For internal analytics and product improvement using aggregated or de-identified data where possible.
- To enforce our Terms of Service and protect platform integrity.
- To comply with our legal obligations.
We will not use your personal information for direct marketing without your separate consent. We do not serve third-party advertising and do not sell your data.
6. Third-Party Processors
We share personal information with the following trusted sub-processors. Each is bound by a Data Processing Agreement (DPA) or equivalent contractual obligations to process your data only as directed by us:
| Processor | Location | Purpose |
|---|---|---|
| Supabase, Inc. | USA (AWS us-east-1) | Database, authentication, and file storage |
| Vercel, Inc. | USA / Global CDN | Web hosting and serverless infrastructure |
| Resend, Inc. | USA | Transactional email delivery |
| Stripe, Inc. | USA / EU | Payment processing and subscription management |
| Anthropic, PBC | USA | AI-powered certificate scanning and in-app assistant |
| VirusTotal (Google LLC) | USA | Security scanning of uploaded documents |
VirusTotal scans every uploaded file for malware. VirusTotal may retain submitted file samples indefinitely for threat-intelligence purposes under their own privacy policy. Do not upload documents containing proprietary or confidential information that you would not want a third-party security vendor to retain.
Anthropic processes document text (for OCR-based certificate scanning on upload) and in-app assistant conversations to provide AI features. Under Anthropic's API Commercial Terms, data submitted via the API is not used to train Anthropic models. Data is retained per Anthropic's then-current API data-retention policy, which as at the date of this Privacy Policy is generally 30 days for non-abuse data, with extended retention only for abuse investigation. Anthropic may update this policy from time to time; the most current terms apply. Anthropic uses its own infrastructure subprocessors (including AWS and Google Cloud) — see trust.anthropic.com for their current list.
6.1 International Transfers
Our sub-processors are primarily located in the United States. We transfer personal data internationally on the basis of:
- EU-US Data Privacy Framework (DPF) — where the receiving sub-processor is DPF-certified, this is the primary adequacy mechanism for transfers from the EU to the US (effective 10 July 2023).
- EU Standard Contractual Clauses (SCCs) — used as a fallback for EU transfers where DPF certification does not apply, and as the primary mechanism for transfers to non-DPF jurisdictions.
- UK International Data Transfer Agreements (IDTAs) and the UK Extension to the EU-US DPF — for transfers under UK GDPR.
- Australian Privacy Principles (APP 8) — for transfers involving Australian users.
If you would like a copy of the safeguards in place, contact us at legal@certvaultapp.com.
7. Worker-to-Employer Data Sharing
A core function of the Platform is enabling Workers to share their profile and documents with Employers. When you create a Worker account, your basic profile is included in employer search results so Employers can find you for genuine roles.
You control employer access at the relationship level rather than via a global on/off switch:
- Search visibility — Worker profiles are surfaced in employer search while the account is active (you have signed in or confirmed availability within roughly the last 7 days). Inactive accounts are excluded from search.
- Document access — An Employer only gains access to your uploaded documents after a hiring or contact relationship has been established (for example, you accept their contact request, or are otherwise added to their workforce). Until that point, only your basic profile fields are visible in search.
- Revoking access — You can revoke an individual Employer’s access to your documents at any time by deleting the hire or contact relationship from your dashboard. Removal takes effect immediately.
- Deleting documents — When you delete a document from your dashboard, it is permanently removed from storage and from any Employer’s view immediately.
Employers who have added you to their workforce (with your acceptance) continue to view your documents only while you remain in their workforce roster. We do not currently offer a global "hide profile" toggle; visibility is managed by maintaining or removing the relevant relationships.
8. Your Rights
Depending on your location, you have the following rights regarding your personal data. We respond to all requests without undue delay, and in any event within one month of receiving your request (extendable by a further two months for complex or numerous requests, with notice to you, in line with GDPR Article 12(3)). We will action urgent erasure requests as quickly as reasonably practicable.
Rights under GDPR / UK GDPR (EU and UK residents)
- Right of access (Art. 15): Request a copy of all personal data we hold about you. Use the "Download my data" button in your dashboard.
- Right to rectification (Art. 16): Request correction of inaccurate or incomplete data.
- Right to erasure / right to be forgotten (Art. 17): Request deletion of your account and all associated data. Use "Delete Account" in your account settings, or email us.
- Right to data portability (Art. 20): Download your data as a self-contained HTML file (which is structured and machine-readable per Art. 20) from your dashboard. Uploaded files (PDFs, images) are not included in the export and can be requested separately by emailing support@certvaultapp.com.
- Right to restriction of processing (Art. 18): Request that we limit how we use your data while a dispute is being resolved.
- Right to object (Art. 21): Object to processing based on legitimate interests. We will stop unless we can demonstrate compelling legitimate grounds.
- Right to withdraw consent (Art. 7(3)): Where we process data on the basis of consent (including sensitive health data), you may withdraw consent at any time without affecting the lawfulness of prior processing.
- Right to lodge a complaint: Lodge a complaint with your national supervisory authority. EU residents can find their authority at edpb.europa.eu. UK residents can contact the ICO at ico.org.uk.
Rights under the Australian Privacy Act (Australian residents)
- Access and correction (APP 12 & 13): Request access to or correction of personal information we hold.
- Complaints (APP 1): Lodge a privacy complaint with us first; if unresolved, escalate to the OAIC at oaic.gov.au.
To exercise any of these rights, contact us at legal@certvaultapp.com. We may need to verify your identity before acting on your request.
9. Data Security
We take appropriate technical and organisational measures to protect your personal data from misuse, interference, loss, and unauthorised access:
- Encrypted data transmission (HTTPS/TLS).
- Row-level security (RLS) so users can only access their own data.
- Automated security scanning of all uploaded documents.
- Authentication and access controls with admin-only access to sensitive features.
- Consent timestamps recorded and stored for audit purposes.
- Regular security reviews of our infrastructure.
Authentication and account security
Passwords are validated at signup and password-reset by our authentication provider (Supabase Auth) and must be at least 8 characters long. We recommend choosing a passphrase of at least 12 characters that you do not reuse on other sites.
Multi-factor authentication (MFA) is not currently available for end-user accounts. This is on our roadmap; in the interim, account security relies on a strong password and standard session-token protections. If you suspect your password has been exposed, reset it immediately via the "Forgot password" flow on the login page.
No method of transmission or storage is 100% secure. If you believe your account has been compromised, contact us immediately at support@certvaultapp.com.
10. Data Breach Notification
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we must:
- Notify the relevant supervisory authority within 72 hours of becoming aware of the breach (GDPR Art. 33 / UK GDPR).
- Notify affected individuals without undue delay where the breach is likely to result in high risk (GDPR Art. 34).
- Notify the OAIC and affected users under the Australian Notifiable Data Breaches scheme.
- Document all breaches in our internal breach register regardless of whether notification is required.
11. Data Retention
We retain your personal data for as long as your account is active or as needed to provide our services. Specific retention periods:
| Data Type | Retention Period |
|---|---|
| Account and profile data | Removed immediately on account closure |
| Uploaded documents — single document deletion by worker | Removed immediately from storage and database; no recovery window |
| Uploaded documents — on whole-account closure | Removed immediately on account closure |
| Health / sensitive data (medical, immunisation) | Deleted immediately on account deletion or explicit consent withdrawal |
| Consent records (terms_agreed_at, sensitive_data_consented_at, consent_version) | Deleted with the account on closure — once the underlying data is gone, the consent record loses its purpose |
| Billing records (held by Stripe, not by CertVault) | 7 years — retained independently by Stripe to satisfy tax-law obligations; CertVault stores no payment card data and no local billing copy beyond active subscription state. To exercise data-subject rights against Stripe-held billing records (access, deletion, portability), contact Stripe directly via stripe.com/privacy-center; CertVault cannot delete Stripe-held data on your behalf. |
| Security scan logs | 90 days |
| AI conversation logs (if retained by Anthropic) | Per Anthropic API data retention policy |
12. Cookies and Tracking Technologies
CertVault uses strictly necessary cookies only — specifically, a session cookie required to keep you signed in (managed by Supabase Auth). We do not use advertising, tracking, or analytics cookies.
Because we use only strictly necessary cookies, opt-in consent is not required under the EU ePrivacy Directive or UK PECR. However, we display a cookie notice on your first visit to explain this. You can view our full Cookie Policy for details.
13. Children's Privacy
The Platform is intended for users aged 18 and over. CertVault does not currently perform automated age verification at signup; eligibility is established by user self-attestation as part of the Terms of Service. If we become aware of an account belonging to a person under 18, we will close the account and delete associated personal information promptly.
We acknowledge that some industries we serve (notably trades and apprenticeships) include legitimate workers aged 16-17 who would have appropriate guardian consent. We are evaluating whether to lower the eligibility floor with appropriate guardian-consent flows in a future update; this Privacy Policy will be updated accordingly if so.
If you believe a child has provided us with personal information, please contact us at legal@certvaultapp.com.
14. Employer Data Processing
If you are an Employer using CertVault to manage worker data, you are a data controller in your own right for the purposes of any personal data you access about workers through the Platform. CertVault acts as your data processor in this context.
We provide a Data Processing Agreement (DPA) for employers who require one for GDPR compliance. Contact legal@certvaultapp.com to request a signed copy.
15. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify registered users of material changes by email at least 30 days before they take effect. The current version is always available at certvaultapp.com/privacy, and the effective date at the top of this page will be updated accordingly. For material adverse changes that affect your rights, you may close your account before the effective date.
16. Notice to California Residents (CCPA / CPRA)
If you are a California resident, the California Consumer Privacy Act (as amended by the California Privacy Rights Act) provides you with the following rights in addition to those described in Section 8:
- Right to know what categories and specific pieces of personal information we collect, use, disclose, and (where applicable) sell or share.
- Right to delete personal information we hold about you, subject to limited exceptions.
- Right to correct inaccurate personal information.
- Right to opt out of the "sale" or "sharing" of personal information for cross-context behavioural advertising.
- Right to limit the use and disclosure of sensitive personal information.
- Right to non-discrimination for exercising any of these rights.
CertVault does not sell personal information for monetary value, and does not share personal information with third parties for cross-context behavioural advertising. We have not done so in the preceding 12 months and have no plans to do so. The only third parties that receive your personal data are the sub-processors we engage to deliver the service, listed in our DPA Section 5.
To exercise any of these rights, contact privacy@certvaultapp.com or legal@certvaultapp.com — the same channels used for GDPR and Australian Privacy Act requests apply. We may need to verify your identity before acting on your request, and will respond within the 45-day period required by the CCPA (extendable by 45 days where reasonably necessary, with notice to you).
You may also designate an authorised agent to make a request on your behalf, in accordance with California Civil Code § 1798.135.
17. Contact Us
For privacy-related inquiries, data subject requests, or complaints:
CertVault (Australian sole trader)
ABN: 51 371 573 935
2 Tandang Sora Street
Labason, Zamboanga Del Norte
Philippines 7117
Email: legal@certvaultapp.com
Data Protection Officer
CertVault has conducted a Data Protection Officer (DPO) assessment under GDPR Article 37(1) and determined that the appointment of a DPO is not required at current operational scale. The assessment is documented internally, available for inspection by relevant supervisory authorities on request, and is re-evaluated:
- Annually, regardless of operational changes.
- Upon a material increase in active worker accounts. CertVault reviews active-worker counts during the annual assessment and ad-hoc whenever growth materially changes the platform's risk profile.
- Upon a material increase in the volume of stored special-category data under GDPR Article 9 (in CertVault's case, primarily medical fitness certificates and immunisation records).
- Upon addition of a new processing purpose that involves sensitive data, or any new sub-processor that processes sensitive data on CertVault's behalf.
- Upon any actual or suspected personal data breach involving sensitive data.
For DPO-related inquiries or to request a copy of the assessment, contact legal@certvaultapp.com.
Supervisory Authorities
EU residents — contact your national data protection authority. A list is available at edpb.europa.eu.
UK residents — Information Commissioner's Office (ICO): ico.org.uk · 0303 123 1113
Australian residents — Office of the Australian Information Commissioner (OAIC): oaic.gov.au · 1300 363 992