ChatterCert
Privacy Policy
This page says exactly what we collect, who can see it, which providers touch it, how long we keep it, and what you can ask us to do with it. No legal fog — if anything is unclear, email hello@chattercert.com.
Last updated: August 3, 2026
What we collect
- Account: your email address and the display name you choose for certifications. There are no passwords — sign-in works by emailed one-time link.
- Learning and exams: course progress, quiz and exam attempts, answers, scores, and timing. Scores are never public — certification pages show only pass/fail status or a level band.
- Marketplace profile (only if you opt in to the marketplace): headline, experience, languages, availability, pay expectations, and the contact handles you choose to share with a hiring agency. Contact handles are stored encrypted.
- Agency verification evidence (agencies only): documents and references submitted for manual review, such as business registration or workspace evidence.
- Payments: handled entirely by Whop, our merchant of record. We receive confirmation that a purchase or subscription happened; we never see or store card numbers.
- Infrastructure logs: standard server logs from our hosting and CDN providers. We run no third-party analytics or advertising trackers.
How we use it
- running your account, courses, and exams, and issuing certifications;
- keeping certification pages accurate — the live VALID/LAPSED/REVOKED status;
- operating the marketplace: matching, applications, interviews, and contact reveals;
- protecting exam integrity — detecting cheating and account sharing;
- sending transactional email (sign-in links, purchase and certification notices) — no marketing lists you did not join; and
- meeting legal obligations.
Who sees what
This is the exact public/private split:
- Public — certification pages. Anyone with your certificate link sees your chosen display name, the credential, the date earned, the course version, and the current status badge. Nothing else: no email, no scores, no failed attempts, no purchase history.
- Private — everything else by default. Your marketplace profile is never public and never indexed. It is visible only to agencies that have passed our manual verification and been approved — and only after you publish it.
- Contact details are revealed only on mutual acceptance. An agency cannot see your contact handles until you both agree to an interview. Until then they stay encrypted.
- Agency evidence is never shown to candidates. Verification evidence is visible only to staff reviewers, and every staff access is logged.
- We disclose data outside these rules only if legally required, and we will tell you unless the law prevents it.
Service providers
These are all of the providers that process user data on our behalf, and what each one does:
- Supabase — database and authentication (magic-link sign-in). Hosted in the United States.
- Vercel — application hosting.
- Whop — merchant of record for all payments; card data lives with Whop, not us.
- Resend — sends our transactional email.
- Cloudflare — DNS and content delivery.
- Anthropic — AI grading of the English assessment’s writing section only (details below).
- Slack — internal operations notifications to our own team (for example, “a purchase completed”).
That is the complete list. If we add a provider that touches user data, we update this page.
AI processing
One thing on this site is graded by an AI model: the writing section of the English proficiency assessment. Your written responses are scored against a fixed, published rubric in two independent passes; disagreement between passes, or any grading failure, routes the submission to a human reviewer, and you can appeal any writing result to a human. Submissions are sent to Anthropic solely for grading — they are not used to train AI models. Everything else — quizzes, multiple-choice exams — is graded by our own code on our servers.
How long we keep data
- Account and certification records: kept while your account exists. Exam attempt records are retained while a certification stands, because they are the evidence behind the credential.
- Rejected agency verification evidence: deleted within 90 days of the case closing.
- Approved agency verification evidence: raw uploads deleted within 12 months; we keep the review result and minimal metadata.
- Contact reveals and application history: kept for 24 months after the job closes, then minimized.
- Resolved report evidence: kept up to 24 months depending on severity, unless the law requires longer.
- Audit logs (who accessed what): kept 36 months.
Security
- Contact handles and other sensitive marketplace fields are encrypted at rest (AES-256-GCM).
- Database access is controlled with row-level security; privileged credentials never reach the browser.
- Exam answer keys never leave the server; grading happens server-side.
- Verification evidence and exam assets live in private storage buckets, not public URLs.
- Payment card data never touches our systems at all — it stays with Whop.
Your rights
Email hello@chattercert.com from your account address and we will:
- show you the data we hold about you, or export it in a portable format;
- correct anything inaccurate;
- delete your marketplace data — profile, applications, and shared contact details — without touching your certification history. The two are separate; leaving the marketplace never costs you a credential; and
- delete your account.We remove your personal data, keeping only the minimal records needed for certification integrity (an issued certificate’s public record stays, because employers rely on it never silently vanishing) and anything the law requires us to keep.
Age requirement
ChatterCert is for adults. You must be 18 or older to create an account, and we do not knowingly collect data from anyone under 18. If we learn an account belongs to a minor, we delete it and its data.
Cookies
We set cookies for one purpose: keeping you signed in. There are no advertising cookies, no cross-site trackers, and no third-party analytics. That is why there is no cookie banner.
Changes
When this policy changes, we update the date at the top. For material changes — a new provider, a new use of data — we email account holders before the change takes effect.
Contact
Privacy questions and requests: hello@chattercert.com.