1. Who is responsible
Emerjoe Rosas, trading as Certinator, based in Central Luzon, Philippines, is responsible for the controller activities described in this policy. Contact support@certinator.com for privacy questions, access, correction, account closure or deletion requests. Our brand domain is certinator.com.
For account administration, service security and our own website operations, the operator determines the purposes of processing. When a customer sends recipient data for hosted certificate generation, we generally process it on the customer’s instructions. The customer remains responsible for its recipient notices and lawful basis.
2. Information and processing paths
The information processed depends on the features you choose.
- Account: email, display name, authentication/session information and saved organization preferences.
- Saved workspace: templates, uploaded branding assets, activity and configured defaults that you choose to save to your account.
- Browser generation: certificate fields and artwork are rendered on your device. This does not make your visit anonymous; the website and authentication still involve network requests.
- API and MCP: submitted recipient fields, template content and artwork reach our servers to create the requested output. API keys and authorization metadata support access control and usage limits.
- Background generation: job inputs, progress and temporary output files are stored to process and deliver the job.
- Recipient library and email delivery: saving or importing contacts stores recipient names and email addresses in your private account. When you explicitly send certificate emails, PDFs, recipient addresses, your message and delivery metadata are uploaded and processed by Certinator and Brevo. Replies are directed to the issuer’s verified account email. Delivery, bounce and suppression events support status tracking and abuse prevention.
- Public verification: only the verification fields selected by the issuer become available through a public verification link. Certificate status is always visible. Issuers can change field visibility without changing the registered certificate details.
- Operations: request and error metadata, timestamps, usage counters and communications you send to support may be processed to run and secure the service.
Institution profiles and domain-check information
When you request a company email check, Certinator processes the submitted company email address, the selected domain, a protected code digest, expiry, attempt count and request metadata. Brevo receives the target email address and code message to deliver the requested check. DNS checks process the selected domain and a random TXT challenge; the published TXT record is accessible through public DNS. No identity documents, selfies or legal-identity checks are collected for this feature. Necessary account-request processing provides the requested service; proportionate request limits and short-lived logs protect it against abuse. We assess the applicable lawful basis for our controller processing and do not treat an authorization checkbox as permission to use another person's data unlawfully.
Email codes stop working after 10 minutes. Successful email checks clear the active email target and code material. Expired email challenge material and expired seven-day DNS challenges are removed by the routine daily cleanup task. Rate-limit events use a keyed digest of the target rather than the target address and are removed by that task after seven days. Removal runs when the task executes and is not instantaneous expiry or deletion from provider logs and backups. The current check method, domain and timestamp remain with the profile until removed or account erasure. You can remove a domain check or unpublish your profile in Settings without deleting your account.
Profiles are private until explicitly published. Only the selected profile details, check result, optional branding or aggregate counts, and selected credential catalog become public. A separate recipient-directory setting makes eligible names already public on non-revoked, unarchived verification records discoverable in the issuer portal. Enable it only with the necessary authority or lawful basis. Directory profiles are grouped by displayed name rather than a verified personal identity. Turning the setting off removes directory access; copies held by others may persist. Company email challenge targets, code digests, private recipient fields and usage allowances are not included in public profiles. An institution may separately choose a public contact email for retrieval enquiries. Domain checks do not authorize publication of recipient information or establish legal identity. Contact support@certinator.com to exercise applicable privacy rights or report an unauthorized company email check; do not send identity documents, passwords or one-time codes to support.
3. Purposes and legal bases
We process information to provide requested tools, maintain accounts, save your settings, deliver outputs and answer support requests. Where the GDPR applies to our controller activities, performance of a contract or requested pre-contract steps supports necessary service processing; legitimate interests may support proportionate security and abuse prevention; legal obligations may require particular disclosures or retention. Consent is used where a feature or law requires it, and can be withdrawn without affecting earlier lawful processing.
Customers must identify their own lawful basis before submitting or publishing recipient data. Philippine law includes education information within sensitive personal information; where that law applies, the customer must obtain the necessary consent or establish another permitted basis for the certificate details. No automated decision about a person’s eligibility, qualification or entitlement is made by the certificate renderer.
4. Storage and retention
Direct API render outputs are returned in the response rather than saved as a downloadable file by that render endpoint. Background job downloads expire after one hour. Expiration blocks download access; physical cleanup is handled separately and is not a promise of instantaneous deletion from all systems.
The application cleans expired job outputs when its cleanup routine runs and removes older job records after seven days through that routine. Infrastructure logs, workflow execution data and backups may have separate provider retention. Saved account data and public verification records do not currently have a universal automatic deletion schedule; contact support to request closure or erasure. We may retain limited records where required by law or to resolve an identified dispute.
Email attachments expire from the queue after one hour and are normally removed from active storage after dispatch. Workflow cleanup and a daily cleanup task remove expired attachments and unarchived email history older than 30 days. Archived email history is retained until restored or account erasure; archiving never extends PDF attachment retention. Provider logs, workflow state and backups can have separate retention; expiry does not promise immediate deletion from all systems. Contacts remain saved until you remove them or request account erasure. Limited suppression records may remain after contact deletion to prevent sending again to bounced or blocked addresses.
Your own downloads, browser storage, recipients’ copies and customer-controlled bot logs are outside our direct control. Clearing browser site data removes local preferences and may remove unsaved work.
We review verified erasure and account-closure requests and aim to delete covered active account data within 30 days, subject to lawful retention and third-party provider limitations explained in our response. Purchase records, if paid sales begin, will be retained only for applicable accounting, tax and dispute requirements. We do not sell personal information or use recipient data to train an AI model.
5. Providers and international processing
Vercel hosts the website, server execution and background workflows. Neon provides the application database and authentication. Our configured application compute and database region is Singapore; this is not an EU-only service. Provider operations, delivery networks, support and subprocessors may involve additional countries.
Brevo processes recipient email addresses, messages, certificate attachments and delivery metadata for optional certificate email delivery requested by the customer. It also processes company email addresses and code messages for requested company email checks. Its infrastructure, logs and subprocessors may involve international processing under its applicable terms.
A current provider list is included in the data processing agreement. Where GDPR international-transfer rules apply, an appropriate transfer mechanism and any required assessment must be in place before processing. EU standard contractual clauses must be separately executed where required; neither the Philippines nor Singapore is represented as an EU adequacy jurisdiction.
For purchases through Dodo Payments, it processes payment, tax, invoice and fraud-prevention information under its own privacy policy as merchant of record. Certinator may receive order identifiers, customer email, purchased plan and subscription status to fulfill and support the service. Do not send card details to Certinator support. We do not receive full payment-card numbers from that checkout.
7. Your rights and how to exercise them
Depending on applicable law, you may request access, correction, erasure, restriction or portability, object to certain processing, or withdraw consent. Email support@certinator.com with enough context to locate the relevant account or record. Do not send a password or API key. We may proportionately verify your identity and explain any legal exception that limits the request.
Where the GDPR applies, we respond without undue delay and within one month; a permitted extension will be explained within that period. You may complain to your competent European data protection authority. People covered by Philippine privacy law may also contact the National Privacy Commission. If a customer issued your certificate, contacting that issuer can help us coordinate your request, but does not remove your ability to contact us.
8. Children, security and revisions
The service is intended for organizations and people able to enter the relevant agreement. An issuer handling children’s information must establish the necessary authority and protections; avoid submitting children’s data until those arrangements are confirmed.
Read the security page for implemented controls and their limitations. No system is risk-free. We will update this notice when material processing changes occur and use an appropriate notice mechanism where required.
Reference materials
These service-specific documents are informed by official European materials. References do not execute international-transfer clauses.