Privacy notice

Certinance is a UK-based provider of certificate management, expiry tracking and compliance document management software.

For privacy enquiries, data protection requests or complaints, please contact privacy@certinance.co.uk.

For customer support, contact support@certinance.co.uk.

For general enquiries, contact info@certinance.co.uk.

Certinance acts as a data controller for account administration, subscriptions, service security and its own business operations.

For personal information contained within customer-managed compliance records, Certinance generally acts as a data processor on behalf of the customer organisation, in accordance with the Data Processing Schedule.

Our paid subscriptions are available to UK-established businesses. The service is not intended for children.

Depending on how you use Certinance, we handle:

• Account information: name, email address, account identifier, authentication and verification status.
• Organisation information: business name, organisation membership, invited users, access roles, contact information, optional business identifiers and the UK-business eligibility declaration (including who made it and when).
• Workspace content: compliance-certificate records, names and other personal information included in metadata and uploaded PDFs, document versions, expiry dates and audit history. When a user chooses automated document extraction, selectable PDF text is analysed locally in that user's browser to suggest document details. Source text and unconfirmed extraction output are not sent to a hosted extraction provider or saved by Certinance; metadata the user checks and confirms is saved as workspace content. The original uploaded PDF is stored separately through our private document-storage provider, Cloudinary, in accordance with the document-storage arrangements described in this Notice. Browser-local extraction does not change those storage arrangements.
• Billing details: selected plan, account entitlement, transaction and invoice state, and Stripe customer/subscription references. Stripe processes payment-card information; Certinance does not store complete card numbers.
• Security and diagnostics: access and authentication events, abuse-prevention and rate-limit information, necessary request identifiers and operational logs.
• Correspondence: messages and information you send in support, privacy or billing enquiries.

Information may be supplied by you, your organisation's authorised users, service providers involved in delivering the service or generated through normal account and security operations.

Please avoid placing unnecessary personal information in documents. Unless expressly agreed with appropriate safeguards, customers should not upload special-category personal data or criminal-offence information.

We use personal information for the following purposes, with lawful bases depending on the person's relationship to the service:

Where we act only as a processor for customer-controlled PDF and certificate content, the customer is responsible for determining the applicable controller lawful basis. Certinance processes that information on the customer's documented instructions rather than claiming a separate general contractual lawful basis of its own. This includes locally analysing selectable PDF text when an authorised user requests extraction and saving only the metadata that the user reviews and confirms.

We do not use personal information for behavioural advertising and do not sell it. We do not currently operate optional marketing analytics.

If we rely on legitimate interests, we identify the specific interest, assess whether processing is necessary and balance that interest against the affected individuals' rights.

Personal information may be made available to appropriately authorised members of your organisation and to providers needed to operate Certinance, according to their functions:

Providers' roles as processors, subprocessors or separate controllers vary according to the information and service. We maintain information about the relevant service providers and their processing roles in our Subprocessor Register. Further details may be requested using the privacy contact details above.

We may also share information with professional advisers or relevant public authorities where justified or legally required.

Some service providers or their subprocessors may process or access personal information outside the UK. Where an activity involves a restricted transfer under UK data-protection law, we must identify and rely on an appropriate UK adequacy provision or other lawful safeguard, and complete any necessary transfer assessment.

UK-business-only subscriptions do not mean that all personal information stays in the UK. We do not claim UK-only or EU-only processing.

Further details about processors, subprocessors and applicable safeguards can be requested at privacy@certinance.co.uk.

We retain account, organisation and customer-content information while needed to provide the service and administer the customer relationship.

Following trial expiry or the end of an entitled paid subscription, eligible users may have read-only access for up to 90 days, including authenticated download and export, subject to the applicable access and security rules. Customers should export important records promptly.

Authorised organisation Owners and Admins can permanently delete eligible individual documents through the service after explicit confirmation, subject to applicable access, entitlement, legal-hold and retention restrictions. Whole-workspace deletion and verified early-erasure or end-of-service requests are handled under a controlled manual procedure, including Firestore metadata, Cloudinary document assets, legal holds and evidence of completed action. No automatic organisation-wide deletion job is currently enabled.

Some financial, fraud-prevention, security, dispute and statutory records may be retained longer where justified or required by law. Provider backups and logs follow their own appropriate retention and expiry arrangements; immediate erasure from every backup is not promised.

We must maintain and follow an operational deletion schedule to implement the stated retention policy. This notice does not promise that a deletion job is already automated.

We use safeguards including verified authentication, tenant and role-based authorisation, Firestore security rules, encrypted service secrets, private document storage, short-lived authorised downloads, access restrictions, file size/type checks and SHA-256 integrity checks.

Customer PDFs are not malware-scanned. PDF format and integrity checks do not establish that a file is free of malicious content. Customers should upload documents from trusted sources and maintain suitable device protection.

No online service can guarantee absolute security.

Subject to statutory conditions and exceptions, you may have rights to be informed; access your personal information; correct inaccurate information; ask for erasure or restriction; object to processing; receive portable information; and receive protections concerning certain solely automated decisions.

To exercise rights, email privacy@certinance.co.uk. We may request reasonable verification of identity and authority. If your request concerns customer-controlled document data, we may direct you to the relevant customer organisation and assist it in responding.

Privacy complaints

You can complain to us about how we handle personal information using privacy@certinance.co.uk. Where practicable, we will acknowledge a data-protection complaint within five working days, investigate it appropriately and tell you the outcome without undue delay and within any applicable statutory response deadline.

You may also complain to the Information Commissioner's Office (ICO) via https://ico.org.uk.

Firebase Authentication uses browser storage, which can include IndexedDB, to maintain the sign-in session and provide authentication and security functions requested by users. This has been assessed as necessary for those functions.

Certinance does not currently use behavioural advertising, social-media tracking pixels or optional marketing analytics. If non-essential tracking is introduced, we will reassess the need for consent and update the notices and controls accordingly.

Certinance does not currently carry out solely automated decision-making producing legal or similarly significant effects. Automated extraction suggests information from selectable PDF text locally in the user's browser; it does not determine compliance or document validity, and the customer must check and confirm suggested information before relying on it. This extraction does not itself introduce an additional cookie or tracking technology.

See the Cookie notice for this information in a standalone format.

We may update this notice as our services and legal obligations evolve. We will display the current version and effective date, keep appropriate records of earlier versions and communicate material changes where appropriate.

Contact: privacy@certinance.co.uk