Privacy Policy

1. Overview

This Privacy Policy describes how CertScore.ai collects, uses, stores, and retains information when you use certscore.ai and the CertScore.ai service.

2. Account And Submitted Information

We may collect information you provide directly, such as your email address, name, authentication details, submitted domains, scan settings, selected plan, and account preferences.

3. Usage And Operational Data

We may collect technical information needed to operate the service, such as authentication events, usage logs, scan status events, browser metadata, and product interaction data.

4. Website Scan Data

CertScore.ai analyzes publicly accessible website content using automated systems and rule-based checks. We may retain scan metadata, derived signals, counts, booleans, timestamps, evidence URLs, change history, and limited policy or disclosure excerpts when needed to support analysis, review, remediation, and evidence context. We do not describe the service as an archive of full websites or complete policy text bodies.

5. Purposes Of Processing Personal Data

Processing purposes: CertScore.ai processes personal data and service data for account administration, authentication, scan and report delivery, monitoring, customer support, billing, security, fraud and abuse prevention, product reliability, optional analytics after consent, legal or business recordkeeping, and responding to privacy requests.

CertScore.ai may process account and submitted information to create and manage accounts, authenticate users, provide scans and reports, manage plans, respond to requests, send service messages, and operate customer support.

CertScore.ai may process usage and operational data to run the service, secure accounts, debug errors, monitor scan status, improve product reliability, measure product usage after optional analytics consent, prevent abuse, and maintain business records.

CertScore.ai may process public website scan data to generate evidence-led reports, support remediation review, preserve limited evidence context, compare changes over time, and operate monitoring or validation workflows requested by users.

6. Third-Party Service Providers And Recipients

CertScore.ai uses third-party infrastructure and service providers that may receive or process information on our behalf. These provider categories include cloud hosting, PostgreSQL-compatible database hosting, S3-compatible object storage, job processing, email delivery, payment and subscription processing, authentication, analytics, security, and operational monitoring.

Current provider examples include AWS for hosting and infrastructure, Stripe for payment and subscription processing, Gmail SMTP where applicable for email delivery, Google Analytics for optional website analytics, and Microsoft Clarity for optional session-insight analysis. Provider use may vary by feature, account state, and operational configuration.

These providers process data to operate, secure, troubleshoot, measure, bill for, or support the CertScore.ai service. CertScore.ai does not describe service-provider access alone as a sale of personal information.

7. Payments And Subscription Records

Payment card details are handled by Stripe rather than stored directly by CertScore.ai. CertScore.ai may retain Stripe customer identifiers, subscription identifiers, plan status, invoice or checkout status, billing event metadata, and related operational records needed to provide paid plans, support cancellation, reconcile payments, prevent fraud, and maintain business records.

8. Cookies, Analytics, And Session-Insight Tools

CertScore.ai uses cookies and similar technologies to operate the service, maintain sessions, remember preferences, protect accounts, and understand usage.

Optional analytics and session-insight tools, including Google Analytics and Microsoft Clarity, are intended to run only after analytics consent is allowed. Microsoft Clarity is configured with masking intended to avoid intentionally collecting sensitive form inputs or private report content.

Users can reject optional analytics from the consent surface and can review or change analytics preferences from the Cookie preferences link in the site footer.

9. International Transfers

CertScore.ai is operated from the United States and uses service providers that may process information in the United States and other countries. Where personal information is transferred across borders, CertScore.ai reviews vendor, contractual, security, and operational safeguards as part of service operation.

Cross-border processing may occur for hosting, storage, payment processing, email delivery, analytics, support, security, and other operational purposes described in this policy.

10. Data Retention

We retain account data, scan metadata, limited evidence context, and related operational records for as long as needed to operate the service, subject to plan limits, retention settings, legal, security, billing, audit, dispute-resolution, and operational needs.

11. Your Privacy Rights

Depending on where you live, you may have rights to request access to personal data, deletion, correction, portability, restriction, objection, or certain opt-outs. CertScore.ai provides a public privacy request form at certscore.ai/privacy-request and also accepts requests sent to [email protected].

12. Security

We use reasonable technical and operational measures to protect account and scan data, but no system can guarantee absolute security.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected on this page with updated content.

14. Data Protection Officer / Privacy Contact Point

Privacy contact point: for privacy-related questions, data-protection questions, or privacy rights requests, contact CertScore.ai at [email protected] or use the privacy request form linked from this policy and the site footer.

CertScore.ai does not currently publish a separate named Data Protection Officer. The privacy and data-protection contact point for this service is [email protected].