Privacy Policy

Last updated: November 3, 2026

This Privacy Policy explains how CertSprint ("we", "us", "our") collects, uses and protects your personal data when you use https://getcertsprint.com.

1. Who is responsible for your data

CertSprint is run by Aurelio Avila, who is the controller of your personal data. You can reach him at [email protected]. We have not appointed a data protection officer.

2. Data we collect

  • Account data: your first and last name, email address and password (stored only as a hash). If you sign in with Google or GitHub, we receive your name, email address and account ID from them instead of a password.
  • Age check: at sign-up we ask for your date of birth only to confirm that you are at least 16. We record that you passed the check, not the date itself.
  • Study progress: the questions you've answered, your scores, practice exam results and readiness by exam domain, so we can show your progress.
  • Purchase data: which certification packages or hearts you bought, when and for how much. Payments are handled by Stripe; we never see or store your full card number.
  • Proof of consent: when you start a purchase, we record that you ticked the box by which you accept the Terms and ask for immediate access (which ends your 14-day right of withdrawal), the version of that text, the time, the IP address the purchase was made from, your browser type (for example "Firefox on Windows", not the full browser string) and the Stripe checkout session ID. When you create an account on the sign-up page, we also record which version of the Terms you accepted and when.
  • Support data: what you write in support requests and in the support chat, plus the name and email address you give on a support request if you're not signed in. If you use the chat without an account, your browser keeps a random guest ID so the conversation stays yours.
  • Technical data: your IP address, which we use briefly to limit repeated requests and protect the service. Our server logs record the page requested, the result and how long it took, but not your IP address or email.
  • Cookies and browser storage: essential storage that keeps you signed in (including the optional "Keep me signed in" cookie, which lasts up to 30 days), saves your progress and remembers your theme and cookie choice. Google Ads and Meta cookies load only if you accept them. Our Cookie Policy lists each one.
  • Campaign labels: if you arrive from one of our social posts, the link's campaign labels (utm_source, utm_medium, utm_campaign, utm_content, such as "youtube" or a video name) are kept in this tab's session storage until you close it, and are attached to a checkout you start so we can see which posts lead to purchases. They contain no personal identifier.

3. Why we use your data, and on what legal basis

We use your data only for the purposes below, each with its legal basis under the GDPR:

  • Creating and running your account, saving your progress, giving you access to what you bought and keeping you signed in: performance of our contract with you (Art. 6(1)(b)).
  • Checking that you are at least 16: needed to enter into the contract, because CertSprint is only for people aged 16 or over (Art. 6(1)(b)).
  • Taking payments and sending receipts and other essential service emails, such as verification codes, password resets and security alerts: performance of the contract (Art. 6(1)(b)).
  • Keeping payment and accounting records: compliance with our legal obligations (Art. 6(1)(c)).
  • Recording, when you buy, your acceptance of the Terms and your request for immediate access (which ends the 14-day right of withdrawal), as proof of your consent and to defend payment disputes and fraud: compliance with our legal obligations (Art. 6(1)(c)) and our legitimate interest in defending payment disputes and preventing fraud (Art. 6(1)(f)).
  • Answering support requests and chat messages, including automatic translation of chat messages that aren't in English: performance of the contract if you have an account; otherwise our legitimate interest in answering people who contact us (Art. 6(1)(f)).
  • Keeping the service and your account secure, preventing abuse and fraud, and limiting repeated requests: our legitimate interest in running a safe, reliable service (Art. 6(1)(f)).
  • Counting visits without cookies and reading campaign labels: our legitimate interest in knowing which pages and posts are useful (Art. 6(1)(f)). Neither identifies you.
  • Measuring with Google Ads and Meta whether an ad led to a purchase: your consent (Art. 6(1)(a)), which you can withdraw at any time.

We don't use your data for anything else. Where we rely on our legitimate interests, you can object at any time (see section 7).

4. Who receives your data

We share personal data only with the providers that help us run CertSprint, and only what each of them needs:

  • Cloudflare: hosts and protects the website, counts visits without cookies and forwards emails sent to our support address.
  • Railway: runs our servers and the database that holds accounts, progress, purchases and support messages.
  • Stripe: processes payments. Stripe also uses payment data as an independent controller, for example to prevent fraud and meet its own legal obligations.
  • Resend: sends our service emails.
  • Translated (MyMemory): translates support chat messages written in languages other than English.
  • Google and GitHub: only if you choose to sign in with them.
  • Google (Google Ads) and Meta: only if you accept advertising cookies.

Discord: our community server is hosted on Discord; anything you post there is governed by Discord's own privacy policy.

We may also disclose data when the law requires it, for example to tax authorities. We do not sell your personal data.

5. Transfers outside the European Union

Our database and servers are hosted by Railway in the United States, and Cloudflare, Stripe, Resend, Google, GitHub and Meta may also process data there. Cloudflare, Stripe, Resend, Google, GitHub and Meta are certified under the EU-U.S. Data Privacy Framework, which the European Commission has found to provide adequate protection. Transfers to Railway, and any transfer the Framework doesn't cover, rely on the European Commission's standard contractual clauses included in each provider's data processing terms. Translated is based in Italy. You can ask us for a copy of these safeguards.

6. How long we keep your data

  • Account, progress, purchase history and the support messages linked to your account: for as long as your account exists. If you delete your account in Settings, we delete it, together with this data, within 30 days.
  • Payment and accounting records: 10 years, as Italian law requires (Article 2220 of the Italian Civil Code). They are kept in Stripe and in our accounts, even after you delete your CertSprint account.
  • Proof of consent at purchase (IP address, Terms version, time, browser type and checkout session ID): 13 months, also after you delete your account, then deleted.
  • Support requests and chats sent without an account: until the matter is resolved and for as long as we may need them to answer follow-up questions about it. You can ask us to delete them sooner.
  • Verification and password-reset codes: deleted 7 days after they expire. One-time codes for signing in with Google and GitHub: deleted one day after they expire.
  • "Keep me signed in" sessions: up to 30 days, deleted one day after they expire. "Sign out everywhere" ends them at once.
  • Notifications on the site: 180 days.
  • IP addresses used to limit repeated requests: deleted one day after the limit period ends.
  • Server logs: they contain no IP addresses or emails, and Railway keeps them only for its limited log retention period.
  • Data stored in your browser: until you sign out or clear it, as described in the Cookie Policy.

7. Your rights

Wherever you live, you have the right to:

  • Access the personal data we hold about you
  • Correct inaccurate data
  • Have your data deleted ("right to be forgotten")
  • Receive a copy of your data in a portable format
  • Object to processing based on our legitimate interests, or ask us to restrict processing
  • Withdraw your consent to advertising cookies at any time with the "Change my choice" button in our Cookie Policy, without affecting anything done before you withdrew it

To exercise any of these rights, email [email protected] or use our support request form. We reply within one month. You can also delete your account yourself at any time in Settings.

8. Your right to complain

If you believe we have handled your data unlawfully, you can lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali, or with the supervisory authority of the EU country where you live, where you work or where the alleged breach took place.

9. Do you have to give us your data?

You can browse CertSprint without giving us any personal data. To create an account, you need to give your name, email address, a password and your date of birth, or sign in with Google or GitHub; without them we can't create your account. To buy, you need to give Stripe your payment details. Everything else, such as support messages and advertising cookies, is up to you.

10. Automated decisions

We don't make decisions about you based solely on automated processing that have legal or similarly significant effects. The sign-up form only checks that the date of birth you enter makes you at least 16, the support chat suggests answers from a fixed list, and readiness scores are a study aid.

11. Data security

We use industry-standard measures (encryption in transit, hashed passwords) to protect your data. No system is 100% secure, but we do not store payment card details on our own servers.

12. Children's privacy

CertSprint is not directed at children under 16. We do not knowingly collect data from children under this age.

13. Changes to this policy

We may update this Privacy Policy from time to time. We'll update the "Last updated" date above when we do.

14. Contact

Questions about this Privacy Policy or your data? Email [email protected] or use our support request form.