Privacy policy

2. What we collect

We collect only what we need to run CerShare. The table shows each kind of information and where it comes from.

When you upload a spreadsheet, it is read in your browser. We don’t keep the file: we store its name and the rows you issue, which become the certificates.

We don’t need sensitive information, such as health details, religion or government ID numbers, and we ask issuers not to put it in certificate fields or spreadsheets.

3. How we use your information

• To provide CerShare: create your account, save your designs, generate certificates, deliver them by email on the issuer’s behalf, and host their story pages.
• To verify certificates: show anyone who scans a QR code or opens a story page who issued the certificate, when, and whether it is still valid.
• To show issuers how their certificates are doing: opens, scans, shares, downloads, applause and email delivery, in the app and in notifications.
• To run profiles and families: show your profile and certificates to the people you choose, let parents keep their children’s certificates, and let family members see and applaud what is shared with them.
• To review reports about certificates people added themselves, and remove fake or misleading ones.
• To take payments and keep the tax and accounting records the law requires.
• To keep CerShare safe: detect abuse, fraud and spam, limit repeated attempts, and protect accounts.
• To support you and send service emails, such as sign-in codes, receipts, security notices, changes to your plan and, for issuers, getting-started tips you can turn off.
• To improve the product, using totals from our own records and, if you accept analytics cookies, Google Analytics.
• To send product news and the CerShare Journal, only if you opt in. Every one has an unsubscribe link.

We do not sell personal information or share it for advertising. We never use recipient data uploaded by issuers for our own marketing: receiving a certificate never puts you on a mailing list. We do not use your content, including certificate text and recipient lists, to train machine-learning models.

4. Legal bases (UK GDPR and GDPR)

Where data protection law in the UK or the European Economic Area applies, we rely on the following legal bases.

5. Story pages and visibility

Every certificate has its own web address, reached by its QR code or link, that opens its story page. A story page shows the certificate, the recipient’s name, the issuer, the date and whether the certificate is valid, and, when the recipient adds them, a one-line message and applause from visitors.

There are four visibility levels:

Recipients are in control. Once they claim a certificate, recipients can change who sees its page and edit or remove their line at any time, and can ask the issuer or us to take the page down. Only the recipient can make a page Public: an issuer can suggest it, but the page stays Shareable until the recipient agrees.

Issuers choose the starting visibility (Private or Shareable). On the Business plan they can also revoke a certificate or give it an expiry date. A revoked or expired certificate’s page says clearly that it is no longer valid, and applause, sharing and downloads stop.

Applause is anonymous. If you applaud without signing in, a cookie holds a random ID so you can only applaud once; we store a one-way hash of that ID, never your name.

Children’s certificates are never public. When an issuer marks a certificate as issued to an under-18, its page can only be Private, Family or Shareable, never appears on the Wall of Tales, and is always hidden from search engines. On a child’s profile it is Private or Family only. See Children.

We may hide a story from the Wall of Tales, or revoke a certificate, if it breaks our Terms of service.

6. Profiles, families and certificates you add

Profiles on CerShare are free. Your profile, at cershare.com/u/ and the address you choose, shows your name, photo, a short bio and the certificates you choose: those issued to you through CerShare (marked Verified) and those you add yourself (marked Added by and your name).

• Who can open it: only you and your family, anyone with the link (the default), or, for adults who choose it, anyone, including search engines. Profiles are never listed by search engines unless you turn that on, and only adults can: you confirm you are 18 or over.
• Each certificate has its own visibility: Private, Family, Shareable or Public. Only Public ones show on your profile to everyone else. You can change it, or delete a certificate you added, at any time in My profile.

Certificates you add yourself

You can add a photo or PDF of a certificate you already have, such as a paper one or one from before CerShare. You are responsible for it: it must be real and yours (or your child’s), and fake or misleading certificates are not allowed. Self-added certificates are always labelled “Added by …”, are never shown as verified, have no QR verification, and never appear on the Wall of Tales. Anyone who can see one can report it; CerShare staff review reports and may remove a certificate, which then stays visible only to the person who added it.

Children’s profiles

• A parent or legal guardian with a CerShare account can create a profile for their child. The child has no login of its own: the parent manages it. We keep only what it needs: first name (and an initial, if the parent adds one), year of birth, an optional photo and the certificates added or linked to it.
• A child’s profile and everything on it is private to the family: Private (the parents who manage it) or Family (the people they invite). It is never public, never in search results, never on the Wall of Tales, has no link that works for anyone else, and there are no comments or messages. Only invited family members, signed in, can applaud. Google Analytics never runs on a child’s profile pages, and nothing about children is sent to it.
• Parents’ rights: a parent or guardian can see, correct and delete everything on their child’s profile at any time. Deleting a child’s profile is immediate and complete: the photo and every certificate added to it are erased, and certificates a school or club issued are unlinked (they stay with the issuer).
• At 18, the parent can hand the profile over: the young person gets an invitation by email, and when they accept with their own account, the certificates move to them, as Private, and leave the family.

Family members

You can invite another adult, such as a co-parent or grandparent, by email to your family: to see what you share with the family, or to help manage your children’s profiles. They need their own CerShare account and must accept with the address you invited. You can remove them, and they can leave, at any time.

7. Emails we send

• Service emails, such as sign-in codes, receipts, security notices, team invitations and updates about your batches, go to account holders whenever they are needed.
• Certificate emails are sent on the issuer’s behalf, with the issuer’s name, to the recipients the issuer chose. Receiving one does not subscribe you to anything.
• Getting-started tips go to people who issue certificates, until they turn them off.
• The CerShare Journal and product news go only to people who asked for them: by ticking the box (unticked to start with) when signing up, by turning them on in Settings, or by confirming a newsletter sign-up through the link we email.

Every newsletter and marketing email has a one-click unsubscribe link and a link to your email preferences, where you can choose topics or stop them all.

If an email to an address bounces permanently or is reported as spam, we add the address to a suppression list and stop sending certificate and marketing emails to it. Sign-in codes and receipts you ask for still go out. We don’t put tracking pixels in our emails.

8. Cookies and analytics

CerShare sets a few cookies of its own that it needs to work. They don’t need your consent, and none of them is used for advertising.

Google Analytics

If you accept analytics cookies in our cookie banner, we load Google Analytics 4 to understand how people use our website. Nothing from Google Analytics loads before you accept. It sets the _ga and _ga_<ID> cookies, which last up to 2 years. Google Analytics 4 does not store your IP address, and we have not turned on its advertising features or Google signals. We never load it in our staff back office or on the story pages of certificates issued to under-18s.

You can change your choice at any time with the Cookie settings link at the bottom of every page.

9. Sharing and processors

We share personal information with service providers (processors) who help us run CerShare. They work under written contracts that limit them to our instructions and require them to keep data secure.

Everything we keep with Amazon Web Services is encrypted in transit and at rest. Cloudflare runs our domain name’s DNS, forwards email sent to our addresses and runs the bot check on the forms above; visits to the CerShare website don’t pass through Cloudflare.

We may also share information:

• with the issuer of a certificate: whether it was delivered, opened, scanned, shared, downloaded or applauded, and the recipient’s line and visibility;
• with the other members of your organisation, who see the designs, batches and certificates it holds;
• with our professional advisers, such as lawyers and accountants, under confidentiality;
• with courts, police or regulators when the law requires it;
• with a buyer or successor if CerShare is ever sold or merged, who would have to respect this policy.

When you share a story page to LinkedIn, WhatsApp, X or another service, that service’s own privacy policy applies to what you post there. Stripe, Google and Microsoft are also responsible, under their own privacy policies, for information they collect directly from you.

10. International transfers

CerShare is hosted by Amazon Web Services in its us-east-2 region (Ohio, United States), so your information is stored and processed in the United States. Content delivery uses AWS edge locations around the world, and Stripe, Google and Microsoft may process data in the United States and other countries.

When personal information goes from the UK or the European Economic Area to a country without an adequacy decision, we rely on recognised safeguards: for these providers, the UK Extension to the EU–US Data Privacy Framework where the provider is certified, or the International Data Transfer Addendum to the EU Standard Contractual Clauses (with the Clauses themselves for data from the European Economic Area). You can ask us about the safeguards that apply at privacy@cershare.com.

11. How long we keep it

We keep personal information only as long as we need it for the purposes above.

Database backups are kept for 7 days, and earlier versions of stored files for 30 days, so information we delete leaves our backups within that time.

Closing your account

You can delete your account yourself in Settings → Profile → Delete account. To make sure it’s you, we email a 6-digit code to the address on the account (whether you sign in with a password, Google or Microsoft) and ask you to type DELETE. Then:

• Straight away, you are signed out everywhere and nobody can sign in to the account. Your Public certificates become Shareable, and we stop all newsletters and product news.
• Organisations: if you are the only member of an organisation, it closes with your account: it can’t issue or send anything more, and its paid plan is cancelled immediately (payments already made aren’t refunded automatically). If others are members, you leave it and they keep it. If you are its only owner, make someone else an owner, or remove the other members, first.
• After 30 days, we erase your personal data: your profile, sign-in methods, settings, sessions, codes and email history, and the data of any organisation that closed with your account (designs, batches and their downloads, logos, team invitations and certificate activity). Until then you can change your mind by emailing help@cershare.com.
• We keep only what the law or other people need: invoices for tax records (see the table above), your email address on our “no marketing” list, audit log entries without your ID, IP address or email address, and a record of each certificate a closed organisation issued (below).
• Certificates you received stay with the organisations that issued them (they control that data), but are no longer linked to you: your public profile goes, and your lines on them are removed. Applause you gave stays anonymous.
• Your profile and family: your profile disappears for everyone else straight away; after 30 days the certificates you added yourself and their files are erased, and so are the child profiles in a family you created, with their photos and certificates, unless a co-parent you invited to manage it still has an account (then they keep managing it). You leave other people’s families.

Certificates issued by a closed organisation

Recipients rely on their certificates long after they receive them, and an issuer leaving CerShare doesn’t make an award untrue. So when an organisation closes, we don’t delete or revoke the certificates it issued. We keep only what verification needs (the certificate as issued, with the recipient’s name, the issuer’s name and the date) and delete the recipient’s email address and the certificate’s activity, the issuer’s logo, description and verified domain. The story page then says the certificate was issued by that organisation on that date, that the organisation has since closed its CerShare account, and that nobody can revoke or update the certificate any more. These pages are never on the Wall of Tales and never in search results.

We keep these records on the basis of legitimate interests, the recipients’ and those of people checking their certificates, for as long as CerShare runs. A recipient, or a parent or guardian for an under-18, can ask us at privacy@cershare.com to remove one, and we will.

12. Your rights

Depending on where you live, you have the right to:

• Access the information we hold about you.
• Correct anything that is wrong or incomplete.
• Delete your information, unless we must keep it.
• Restrict how we use it while a concern is resolved.
• Export your data in a common, machine-readable format.
• Object to processing based on legitimate interests.
• Withdraw consent at any time, for example by changing visibility.
• Complain to a data protection authority.

You can change much of this yourself: your name, email address, sign-in methods and notifications in Settings, your email topics on the email preferences page, your profile and each certificate’s visibility in My profile, your children’s profiles in Family, each claimed certificate’s line on its story page, and deleting your account in Settings. For anything else, email privacy@cershare.com. We reply within one month and may need to confirm your identity first. If your request is about recipient data that an issuer uploaded, we will pass it to the issuer and help them respond.

You can also complain to a data protection authority, such as the UK Information Commissioner’s Office (ico.org.uk), or the data protection authority in your EU country. We would appreciate the chance to put things right first.

13. Security

We encrypt data in transit (HTTPS, including between our servers and the database) and at rest (the database and file storage). The database runs in a private network and can’t be reached from the internet. Passwords are hashed with Argon2, and session tokens and one-time codes are stored only as hashes. A web application firewall and rate limits protect sign-in and other forms.

Our staff back office is open only to a short, named list of CerShare staff. Every change made there needs a reason and is recorded in the audit log.

No system is perfectly secure. If a breach affects your information, we will tell you and the relevant authorities as the law requires.

14. Children

CerShare accounts are for adults and organisations. You must be 18 or over to open an account, or be acting with the authority of the organisation you represent. People under 18 can receive certificates without an account, and their parents can keep them in a child’s profile (see Profiles, families and certificates you add).

Schools, clubs and other organisations may issue certificates to children. They are responsible for having the right to do so and for giving parents or guardians any notices required. When an issuer marks certificates as issued to under-18s:

• the story page can be Private, Family or Shareable, never Public, and never appears on the Wall of Tales or on a public profile;
• the page is always hidden from search engines, and link previews show no picture or description;
• we never load Google Analytics on it;
• a parent or guardian can ask the issuer, or us at privacy@cershare.com, to remove the page.

Children’s profiles that parents create follow the same rules and more: they are private to the family, never public or searchable, and a parent can delete one, completely, at any time. For a child under 13, everything on the profile is provided and controlled by the parent or guardian, as the US Children’s Online Privacy Protection Act (COPPA) requires, and we follow the UK Age Appropriate Design Code (the Children’s Code): high privacy by default, no profiling, no nudges to share more.

15. Changes to this policy

We will update this page when our practices change and change the “Last updated” date at the top. If a change is significant, we will tell account holders by email or in the app before it takes effect.

16. Contact us

Questions, requests or concerns about privacy? Get in touch.