Privacy Policy

Who we are

CertTutor is operated by Charlie Whight, an individual based in Spain. We will update this policy when a legal entity is registered. For any questions or data requests, contact us at privacy@certtutor.io. We aim to respond to all requests within 30 days.

What we collect

We collect only what we need to run the service:

• Email address — to create your account and send important updates
• Password — stored as a secure one-way hash; we cannot read it
• Study session data — your answers to practice questions, used to personalise your study plan
• Exam date (optional) — if you choose to provide it, we use it to pace your preparation

Lawful basis for processing

For core service functions — account creation, login, and delivering your study sessions — we process your data under Contract: it is necessary to provide the service you signed up for.

For improving the product and maintaining security, we rely on Legitimate Interests. We do not rely on consent for core functionality.

How long we keep your data

• Active accounts: data retained while your account is active
• Account deletion: all personal data deleted within 30 days of a deletion request
• Study session data: retained for the life of the account; deleted on deletion
• Backups: purged within 90 days of account deletion, where technically feasible

Your rights

Under EU GDPR (RGPD) you have the following rights. To exercise any of them, email privacy@certtutor.io with your name and account email — we will respond within 30 days, free of charge.

• Access — request a copy of the data we hold about you (JSON or CSV)
• Erasure (right to be forgotten) — delete your account in settings, or email us. We will remove your data within 30 days. This right is fully functional.
• Rectification — update your email or exam date in account settings, or email us
• Portability — request your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interests
• Restriction — request that we limit how we process your data

Third-party sharing

We do not sell your personal data. We share anonymised usage data with Google via Google Analytics 4 (GA4) to understand how visitors use this site. This data is used solely to improve the product. See Google's Privacy Policy for details of how Google processes this data. We will update this policy if further sharing arrangements are introduced.

International transfers

Your account and study session data is stored on servers located in the UK or EU. Anonymised usage data collected via Google Analytics 4 may be transferred to and processed by Google on servers outside the UK and EEA (including the United States). Google relies on Standard Contractual Clauses for such transfers. See Google's Privacy Policy for details.

Cookies

We use session cookies to keep you logged in. These are strictly necessary, first-party cookies required for the service to function.

• auth_token — keeps you authenticated; HTTP-only, secure; expires after 15 minutes of inactivity
• refresh_token — renews your session; HTTP-only, secure; expires after 30 days

We also use Google Analytics 4, which sets cookies to collect anonymised usage data (pages visited, session duration, and similar). These are analytics cookies. We use this data to understand how visitors use the site and improve the product. Google Analytics cookies are not used for advertising purposes. We use IP anonymisation where available.

Supervisory authority

You have the right to complain to a supervisory authority. As CertTutor is operated from Spain, the lead supervisory authority is the AEPD (Agencia Española de Protección de Datos). If you are based in another EU member state, you may also lodge a complaint with your local data protection authority.