Privacy Policy

1. Information We Collect

We collect the following information when you use CertArc:

• Account information: email address, display name (when provided)
• Usage data: questions answered, session history, readiness scores, exam dates
• Billing information: subscription status, plan type, billing period. Payment card details are handled exclusively by Creem (our payment processor) — we do not store card numbers.
• Technical data: IP address, browser type, device type, access timestamps (standard web server logs)
• How you arrived: when you create an account, we record how you arrived: the site that sent you, any campaign tag in the link, and the first page you opened, with the time. This helps us see which channels bring learners. We keep it with your account and delete it when you delete your account.
• Assistant connection records: if you connect an AI assistant (see Assistant connections)

2. How We Use Your Information

• To provide and improve the CertArc service
• To manage your subscription and process payments
• To personalise your learning experience (adaptive question selection)
• To send service-related communications (subscription, receipts)
• To send study reminders and exam tips about the program you are preparing for, and news of new CertArc programs and offers
• To provide assistant connections you choose to make
• To comply with legal obligations

We do not sell your personal data to third parties.

Email. Sign-in codes, security alerts and billing emails are always sent. Study reminders, exam tips, and offers and product updates are all on by default. You can turn each one off in Settings or with the link at the bottom of any of those emails. If you start another certification after turning off study reminders or exam tips, they turn back on, and you can turn them off again the same way. We do not track opens or clicks in our emails. If an address bounces permanently or reports an email as spam, we keep that address on a do-not-send list so we never email it again, even after the account is deleted.

3. Data Storage and Security

Your data is stored in Supabase (cloud database, APAC region). We use row-level security, encrypted connections (TLS), and access controls to protect your data. No payment card data is stored on CertArc infrastructure.

4. Third-Party Services

• Supabase — authentication and database (Privacy Policy)
• Creem — payment processing and Merchant of Record (Privacy Policy)
• Resend — sending CertArc's emails (Privacy Policy)
• OpenAI (ChatGPT) — only if you connect it (Privacy Policy)
• Anthropic (Claude) — only if you connect it (Privacy Policy)
• Meta (Muse) — only if you connect it (Privacy Policy)
• Vercel / hosting provider — infrastructure and CDN

5. Assistant connections

Connecting is your choice. You can connect an AI assistant, such as ChatGPT or Claude, to CertArc. On CertArc's consent screen you approve read-only access to your study data for every certification you study on CertArc, including ones you start after connecting.

What the assistant can read, for each certification you study on CertArc:

• Sprint and practice-exam scores for each take, with completion dates and whether a take was a full or focus retake
• Per-answer results: Correct or Incorrect, your Confident, Unsure or Guess rating, your tagged miss reason, the domain and knowledge area, and time taken
• Domain and knowledge-area results, blind spots and miss-reason patterns
• Pace and timing summaries built from your answer times, and how a retake changed your answers compared with your first take
• Your readiness score, the parts it is built from, the points still within reach, and the retakes suggested to win them back
• Sprint progress, your target exam date, your study calendar (session names, dates, status and the plan's time zone) and your next study step
• When you practised (practice days and total practice time), sessions in progress, whether a sprint or exam can be retaken yet and the review still to do, your weekly readiness history, and whether your access is paid or a trial and when it ends (never prices or payment details)

What it cannot read: question text, answer options or explanations; your email address, name, billing or payment details.

Why: to answer the questions you ask the assistant about your own study.

Who receives it: the assistant's provider (OpenAI for ChatGPT, Anthropic for Claude, Meta for Muse) receives this information when you ask about it, and handles it under its own privacy policy and your settings with that provider. It may be processed outside your country.

What CertArc keeps: a record of each connection (which assistant, whether it covers one certification or every certification you study, and when it was created, expires or was disconnected). Access credentials are stored only in hashed form. We keep short-lived usage counters to prevent abuse. We don't receive or store your assistant conversations; we receive only the request needed to answer each question.

How long: a connection lasts up to 30 days. Connection records are deleted 90 days after a connection ends, or when you delete your CertArc account.

Your control: disconnect any time in Connected assistants. That stops new reads immediately but doesn't delete what the assistant has already received.

Practice without an account: if you practise CertArc's public questions in an assistant without connecting, we don't receive your name or email. The provider's requests may include approximate location, language or an anonymised identifier; we don't use or store them, and your practice answers aren't recorded.

6. Cookies and Tracking

We use essential cookies to maintain your login session and remember your preferences, including one that remembers an assistant connection request for 15 minutes while you sign in. Our payment processor (Creem) may set cookies during checkout for fraud prevention and session management. Until you create an account, how you arrived is kept in your browser tab only, not in a cookie, and is cleared when you close the tab. We do not use advertising or tracking cookies. You may disable cookies in your browser settings, though this may affect platform functionality.

7. Data Retention

We retain your account and usage data as long as your account is active. Billing event logs are retained for legal and financial compliance purposes. You may request data deletion by contacting support@certarc.com.

8. Your Rights

Depending on your jurisdiction, you may have rights to access, correct, delete, or port your data. To exercise these rights, contact support@certarc.com.

9. Non-Affiliation

CertArc is not affiliated with, endorsed by, or sponsored by ISACA® or ISC2®. CISM®, CISA®, AAISM™ and AAIA™ are trademarks of ISACA. CISSP® is a registered trademark of ISC2. No personal data is shared with ISACA, ISC2 or any certification body.

10. Changes to This Policy

We may update this Privacy Policy. Material changes will be communicated via email. Continued use constitutes acceptance.

11. Contact

For privacy inquiries, contact support@certarc.com.