ChatterCert

Privacy Policy

This page says exactly what we collect, who can see it, which providers touch it, how long we keep it, and what you can ask us to do with it. No legal fog — if anything is unclear, email hello@chattercert.com.

Last updated: September 21, 2026

What we collect

  • Account: your email address and the display name you choose for certifications. There are no passwords — sign-in works by emailed one-time link.
  • Learning and exams: course progress, quiz and exam attempts, answers, scores, and timing. Scores are never public — certification pages show only pass/fail status or a level band.
  • Private applications and technical screening: the details and answers you submit to an agency, any credentials you choose to share, and your technical assessment results. Technical checks record download and upload speed, latency, jitter, timing, and basic browser-reported device capabilities. A first-party cookie helps recognize the same browser on a later check.
  • Marketplace profile (only if you opt in to the marketplace): headline, experience, languages, availability, pay expectations, and the contact handles you choose to share with a hiring agency. Contact handles are stored encrypted.
  • Agency verification evidence (agencies only): documents and references submitted for manual review, such as business registration or workspace evidence.
  • Payments: handled entirely by Whop, our merchant of record. We receive confirmation that a purchase or subscription happened; we never see or store card numbers.
  • Infrastructure and error data: standard server/CDN logs and limited technical error and performance context used to keep the service working. We do not use advertising trackers or sell this data.

How we use it

  • running your account, courses, and exams, and issuing certifications;
  • keeping certification pages accurate — the live VALID/LAPSED/REVOKED status;
  • operating the marketplace: matching, applications, interviews, and contact reveals;
  • protecting exam integrity — detecting cheating and account sharing;
  • sending essential account email (sign-in, purchase, security and certification), plus course or product updates you requested or that relate to your account. You can unsubscribe from non-essential email;
  • meeting legal obligations.

Who sees what

This is the exact public/private split:

  • Public — certification pages. Anyone with your certificate link sees your chosen display name, the credential, the date earned, the course version, and the current status badge. Nothing else: no email, no scores, no failed attempts, no purchase history.
  • Private — everything else by default. Your marketplace profile is never public and never indexed. It is visible only to agencies that have passed our manual verification and been approved — and only after you publish it.
  • Marketplace contact details are revealed only on mutual acceptance. An agency cannot see your contact handles until you both agree to an interview. Until then they stay encrypted.
  • Private applications: submitting shares your account email, application details, responses, and selected screening evidence with that agency. Drafts stay private. This does not publish a marketplace profile. Withdrawing removes the shared application data from the agency’s view; your reusable technical results remain in your account.
  • Agency screening — only after you accept an invitation.The named agency can see your progress and results for the listed assessments, including scores, levels and failed attempts started during the 30-day screening. You may also choose to share existing credentials. Agency visibility ends 90 days after screening ends, or immediately when you stop sharing at Account → Agency access. Stopping sharing does not remove remaining sponsored access. Unrelated learning history and contact details are not shared.
  • Agency evidence is never shown to candidates. Verification evidence is restricted to authorized staff reviewers. Administrative changes are recorded in our audit logs; we do not claim that every low-level storage read is individually logged.
  • We disclose data outside these rules only if legally required, and we will tell you unless the law prevents it.

Service providers

The principal providers currently used to operate ChatterCert are below. A provider only receives the data needed for its role:

  • Supabase — database and authentication (magic-link sign-in). Hosted in the United States.
  • Vercel — application hosting.
  • Whop — merchant of record for all payments; card data lives with Whop, not us.
  • Resend — sends our transactional email.
  • Cloudflare — DNS, content delivery, and browser-based connection testing when you start a technical assessment.
  • Anthropic — AI grading of the English assessment’s writing section only (details below).
  • Loops — account and course lifecycle email that you request or that relates to your account.
  • Sentry — error and performance monitoring, configured not to collect default personal identifiers or session replays.
  • Slack — internal operations notifications to our own team (for example, “a purchase completed”).

Cloudflare Turnstile may also process limited browser and network information when a proof-of-human check is shown. We update this page when a material provider or use changes.

Cloudflare connection testing

Starting a technical assessment sends test traffic directly from your browser to Cloudflare. Cloudflare processes your IP address and network request information to perform the test. We do not send your ChatterCert account details, device cookie, application answers, or identity documents to Cloudflare. Optional results logging in the speed-test library is disabled. See Cloudflare’s speed-test information for its data practices. ChatterCert stores the measurements returned by your browser; they are not independent verification of your connection or device ownership.

AI processing

One thing on this site is graded by an AI model: the writing section of the English proficiency assessment. Your written responses are scored against a fixed, published rubric in two independent passes. A material disagreement triggers a third AI pass and a deterministic median consensus. There is no routine human grading or human-review queue. If the provider is unavailable, the attempt remains pending and is retried rather than being assigned a guessed result. We send the response and prompt context needed for grading, not payment details or an account profile. Anthropic processes that data under the API terms and settings applicable to our account. Everything else — quizzes and multiple-choice exams — is graded by our own server code. You may contact us to report a suspected technical error, but we do not promise a human re-grade.

How long we keep data

We keep data only as long as reasonably needed for the purposes above, certification integrity, dispute handling and legal obligations. The following are our current operational targets, not promises to retain data for the full period; a legal hold, active safety matter or payment dispute can require longer retention.

  • Account and certification records: kept while your account exists. Exam attempt records are retained while a certification stands, because they are the evidence behind the credential.
  • Rejected agency verification evidence: deleted within 90 days of the case closing.
  • Approved agency verification evidence: raw uploads deleted within 12 months; we keep the review result and minimal metadata.
  • Contact reveals and application history: kept for 24 months after the job closes, then minimized.
  • Resolved report evidence: kept up to 24 months depending on severity, unless the law requires longer.
  • Administrative audit logs: targeted for 36 months.

Security

  • Contact handles and other sensitive marketplace fields are encrypted at rest (AES-256-GCM).
  • Database access is controlled with row-level security; privileged credentials never reach the browser.
  • Exam answer keys never leave the server; grading happens server-side.
  • Verification evidence and exam assets live in private storage buckets, not public URLs.
  • Payment card data never touches our systems at all — it stays with Whop.

Your rights

Email hello@chattercert.com from your account address and we will:

  • show you the data we hold about you, or export it in a portable format;
  • correct anything inaccurate;
  • delete your marketplace data — profile, applications, and shared contact details — without touching your certification history. The two are separate; leaving the marketplace never costs you a credential; and
  • delete your account. We remove your personal data, keeping only the minimal records needed for certification integrity (an issued certificate’s public record stays, because employers rely on it never silently vanishing) and anything the law requires us to keep.

Age requirement

ChatterCert is for adults. You must be 18 or older to create an account, and we do not knowingly collect data from anyone under 18. If we learn an account belongs to a minor, we delete it and its data.

Cookies

We use first-party cookies to keep you signed in and protect account flows. We do not use advertising cookies or cross-site advertising trackers. Operational providers may receive the technical request information described above; optional proof-of-human checks may load Cloudflare Turnstile.

Changes

When this policy changes, we update the date at the top. For material changes — a new provider, a new use of data — we email account holders before the change takes effect.

Contact

Privacy questions and requests: hello@chattercert.com.

Terms of Service →