Privacy Policy

1. Information We Collect

We collect the following information when you use CertArc:

• Account information: email address, display name (when provided)
• Usage data: questions answered, session history, readiness scores, exam dates
• Billing information: subscription status, plan type, billing period. Payment card details are handled exclusively by Creem (our payment processor) — we do not store card numbers.
• Technical data: IP address, browser type, device type, access timestamps (standard web server logs)

2. How We Use Your Information

• To provide and improve the CertArc service
• To manage your subscription and process payments
• To personalise your learning experience (adaptive question selection)
• To send service-related communications (subscription, receipts)
• To comply with legal obligations

We do not sell your personal data to third parties.

3. Data Storage and Security

Your data is stored in Supabase (cloud database, APAC region). We use row-level security, encrypted connections (TLS), and access controls to protect your data. No payment card data is stored on CertArc infrastructure.

4. Third-Party Services

• Supabase — authentication and database (Privacy Policy)
• Creem — payment processing and Merchant of Record (Privacy Policy)
• Vercel / hosting provider — infrastructure and CDN

5. Cookies and Tracking

We use essential cookies to maintain your login session and remember your preferences. Our payment processor (Creem) may set cookies during checkout for fraud prevention and session management. We do not use advertising or tracking cookies. You may disable cookies in your browser settings, though this may affect platform functionality.

6. Data Retention

We retain your account and usage data as long as your account is active. Billing event logs are retained for legal and financial compliance purposes. You may request data deletion by contacting support@certarc.com.

7. Your Rights

Depending on your jurisdiction, you may have rights to access, correct, delete, or port your data. To exercise these rights, contact support@certarc.com.

8. Non-Affiliation

CertArc is not affiliated with, endorsed by, or sponsored by ISACA®. CISM® is a registered trademark of ISACA. No personal data is shared with ISACA or any certification body.

9. Changes to This Policy

We may update this Privacy Policy. Material changes will be communicated via email. Continued use constitutes acceptance.

10. Contact

For privacy inquiries, contact support@certarc.com.