Privacy Policy

We recognize that your privacy is very important and take it seriously. This Privacy Policy details how Alphacloud collects, uses, discloses and secures personal information:

• when you visit or interact with our websites at certseal.com and app.certseal.com, including our APIs and our MCP server for AI apps ("Platform");
• from our customers ("Customers") who sign up for and use CertSeal ("Services"); and
• when you otherwise communicate with us, such as through email or via social media platforms.

By using the Services, you consent to our use of your information in accordance with this Privacy Policy. We will not use or share your personal information with anyone except as described in this Privacy Policy. Capitalized terms that are not defined in this Privacy Policy have the meaning given them in our Terms of Use.

This Privacy Policy is intended to meet our duties of transparency under the "General Data Protection Regulation" ("GDPR").

We will post any modifications or changes to this Privacy Policy on this page.

1. Who we are and how to contact us

Who we are. Alphacloud Technologies Pte Ltd, a limited company organized and existing under the laws of Singapore (Unique Entity Number 201902224G), operates CertSeal and is the Controller of your Personal Data (referred to as either "Alphacloud", "we", "us" or "our" in this Privacy Policy). Our address is 50 Lakeside Drive #09-04 Caspian, Singapore 648315. For the personal data of certificate recipients, we act as a Processor for our Customers instead; see Certificate recipients.

How to contact us. If you have any questions about our practices or this Privacy Policy, please contact us at hello@certseal.com.

2. Your rights relating to your personal data

You have the right under this Privacy Policy to:

• Request access to your Personal Data. If you are in certain jurisdictions, this enables you to receive a copy of the Personal Data we hold about you and to check that we are lawfully processing it.
• Request correction of the Personal Data that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
• Request erasure of your Personal Data. This enables you to ask us to delete or remove Personal Data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your Personal Data where you have exercised your right to object to processing (see below).
• Object to processing of your Personal Data. This right exists where we are relying on a legitimate interest as the legal basis for our processing and there is something about your particular situation, which makes you want to object to processing of your Personal Data on this ground. You also have the right to object where we are processing your Personal Data for direct marketing purposes.
• Request the restriction of processing of your Personal Data. This enables you to ask us to suspend the processing of Personal Data about you in certain scenarios (for example if you want us to establish its accuracy or the reason for processing it).
• Request the transfer of your Personal Data. If you are in certain jurisdictions, we will provide to you, or a third party you have chosen, your Personal Data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
• Withdraw consent. This right only exists where we are relying on consent to process your Personal Data ("Consent Withdrawal"). If you withdraw your consent, we may not be able to provide you with access to certain specific functionalities of our Services. We will advise you if this is the case at the time you withdraw your consent.
• How to exercise your rights. If you want to exercise any of the rights described above, please contact us using the contact details in Who we are and how to contact us.

Typically, you will not have to pay a fee to access your Personal Data (or to exercise any of the other rights). However, except in relation to Consent Withdrawal, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive, or, we may refuse to comply with your request in these circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your Personal Data (or to exercise any of your other rights). This is a security measure to ensure that Personal Data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

Complaints

If you would like to submit a complaint regarding this Privacy Policy or our practices in relation to your Personal Data, please contact us at hello@certseal.com with the subject "Data privacy inquiry". We will reply to your complaint as soon as we can.

If you feel that your complaint has not been adequately resolved, please note that if you are in the EU the GDPR gives you the right to contact your local data protection supervisory authority. You can find information on your country's data protection authority here.

3. Whose personal data do we collect?

We may process your personal data, if:

• You are our potential or current client;
• You are an entity (or you are providing services to an entity), that we want to sell our services to;
• You are providing services / work for our client or to an entity, that uses our services or platform developed by us (you act on behalf of them e.g. as their employee, associate, representative);
• You have received a certificate issued through CertSeal by one of our Customers (see Certificate recipients);
• You visit our websites;
• You are interested in actions that we undertake (e.g. as part of contact with media).

4. When we may process your personal data?

We may process your personal data received directly from You or from other sources. Therefore, your personal data may be processed:

• If you have provided us with your personal data via various means of communication (e.g. by sending us an inquiry / offer, via email, via our platform, by telephone or via our website);
• In the case of conclusion or performance of a contract, including in case when your personal data has been provided to us as contact data for the purpose of proper performance of the above contract;
• If we have received your personal data from another source (e.g. from an entity that is our contractor / client, such as a Customer that issues you a certificate, during events or from publicly available sources / websites).

5. What personal data we collect

Alphacloud uses Personal Data we collect to provide the Services, maintain security, monitor aggregate metrics such as total number of visitors, traffic, and demographic patterns, and track user content and users as necessary to comply with the Digital Millennium Copyright Act and other applicable laws.

Information You Directly Provide to Us. There are many occasions when you provide information that may enable us to identify you personally ("Personal Data") while using the Services. The Personal Data we may collect from you is outlined in the table below.

Aggregated Data. We may also collect, use and share "Aggregated Data" for any purpose. Aggregated Data may be derived from your Personal Data, but once in aggregated form it will not constitute Personal Data as this data does not directly or indirectly reveal your identity. However, if we combine or connect Aggregated Data with your Personal Data so that it can directly or indirectly identify you, we treat the combined data as Personal Data which will be used in accordance with this Privacy Policy.

No Special Categories of Personal Data. We do not collect any "Special Categories of Personal Data" about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sexual orientation, political opinions, trade union membership). Nor do we collect any information about criminal convictions and offences.

We do not knowingly solicit personal information of children under the age of 18. We do not knowingly collect personal information of and from children under the age of 18. If we learn that a child under the age of 18 has provided us with personal information without parental consent, we will take steps to delete it. Customers such as schools may issue certificates to minors under their own legal basis and parental consent obligations, with Alphacloud acting only as their Processor.

6. Certificate recipients

When a Customer issues you a certificate through CertSeal, that Customer is the Controller of your personal data and Alphacloud processes it on the Customer's behalf as a Processor, under our Data Processing Agreement. This data includes your name and email address, the course, event or program, issue and expiry dates, any other details the Customer adds to your certificate, whether the certificate email was delivered, and when your certificate page is viewed.

Each certificate has a public page that anyone with its link can view, as described in section 10 of our Terms of Use. To exercise your rights over this data, please contact the organization that issued your certificate. If you contact us instead, we will forward your request to them and assist as needed.

If the organization offers Open Badges, you can also download your certificate as an Open Badges 3.0 credential: a file signed by that organization containing your name, the achievement, the dates, and the organization's name, website and contact email, but not your email address. Once downloaded, the file stays with you: neither the organization nor Alphacloud can recall or delete it. It can only be revoked. Verifiers check that against a public revocation list hosted by CertSeal, which holds numbered entries and no personal data.

7. How we use cookies and other tracking or profiling technologies

Alphacloud may collect non-personally identifiable information regarding your usage of the Services, including the pages you viewed, time spent using the website, demographic data such as server locations, connection speed, and other information that does not identify you. Like most online services, we also use cookies, log files and other technologies that may collect Personal Data. The cookies we use and how to control them are listed in our Cookie Policy.

Cookies. When you visit the Services, we may send one or more "cookies", small data files, to your computer to uniquely identify your browser and help you navigate the Services. A persistent cookie remains on your computer after you close your browser so that it can be used by your browser on subsequent visits to the Service. Persistent cookies can be removed by following your web browser's directions. A session cookie is temporary and disappears after you close your browser. We use:

• Essential cookies, which are essential to provide you with the Services and to enable you to use their features, such as keeping you signed in. Without these cookies, the Services that you have asked for cannot be provided.
• Functionality storage, items in your browser's storage that allow the Services to remember choices you make, so that you don't have to re-enter your preferences every time you visit.
• Analytics and performance cookies, which collect information about traffic to our website and how visitors use it. The information is aggregated, and we use it to operate the website more efficiently and to monitor the level of activity on it. We use Google Analytics, with IP anonymization, for this purpose.

We do not use advertising or cross-site tracking cookies.

How can I disable cookies? You can typically reset your web browser to refuse all cookies or to notify you when a cookie is being sent. In order to do this, follow the instructions provided by your browser (usually located within the "settings", "help", "tools" or "edit" facility). If you do not accept our cookies, you may experience some inconvenience in your use of our Services and some features of the Service may not function properly. Further information about cookies is available at www.allaboutcookies.org and www.youronlinechoices.com.

Log Files. Log file information is automatically reported by your browser each time you access a web page. When you use the Services, our servers automatically record certain information your web browser sends whenever you visit any website. These server logs may include information such as your web request, Internet Protocol address, browser type, referring / exit pages and URLs, number of clicks, domain names, landing pages, pages viewed, and other such information.

Third-Party Services. Alphacloud may use third-party services such as Google Analytics to help understand and improve the use of the Services. These services typically collect the information sent by your browser as part of a web page request, including cookies and your IP address. They receive this information and their use of it is governed by their respective privacy policies.

8. How we use your personal data and why

We generally use Personal Data for the following: to deliver and improve our Services; to manage our platform and provide you with customer and technical support; to perform research and analysis about our platform; to verify your identity and prevent fraud or other unauthorized or illegal activity; and to enforce or exercise any rights in our Terms of Use.

In respect of each of the purposes for which we use your Personal Data, the GDPR requires us to ensure that we have a legal basis for that use if you are within the EU. The legal bases depend on the Services you use and how you use them. This means we collect and use your Personal Data only where:

• We need it to provide you the Services, including to operate the Services, provide customer support and personalized features and to protect the safety and security of the Services;
• It satisfies a legitimate interest (which is not overridden by your data protection interests), such as for research and development, to market and promote the Services and to protect our legal rights and interests; or
• We need to process your data to comply with a legal or regulatory obligation.

We may also rely on your consent as a legal basis for using your Personal Data where we have expressly sought it for a specific purpose. If we do rely on your consent to a use of your Personal Data, you have the right to change your mind at any time (but this will not affect any processing that has already taken place). We have set out below, in a table format, more detailed examples of relevant purposes for which we may use your Personal Data.

We do not sell or rent personal data, and we do not use it to train third-party AI models.

What happens when you do not provide necessary Personal Data?

Where we need to process your Personal Data either to comply with law, or to perform the terms of a contract we have with you and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with the functionalities of the Services). In this case, we may have to stop you from using our Services.

9. Who we share your personal data with?

We may share your Personal Data with third parties in the ways that are described in the table below. We consider this information to be a vital part of our relationship with you.

As we develop our business, we may buy or sell businesses or assets. In the event of a corporate sale, merger, reorganization, dissolution or similar event, we may also transfer your Personal Data as part of the transferred assets without your consent or notice to you.

10. AI apps you connect

You can connect CertSeal to an AI app, such as Claude or ChatGPT, through our MCP server. When you connect, you sign in to CertSeal, choose one workspace, and choose what the app may do: see your data; create batches and issue certificates, which uses your certificate allowance; and, only if you tick it, email certificates to recipients.

• What the app receives. When you ask the app to do something in CertSeal, it receives the data that request needs from the workspace you chose: the workspace name and certificate usage; design and email template names and the details a design prints; batch names; recipient names, email addresses and certificate details; and certificate IDs and links.
• What we don't see. We don't receive your conversation with the AI app, only the requests it makes to CertSeal.
• Who processes it. The app's provider (for example Anthropic for Claude, or OpenAI for ChatGPT) receives that data under its own terms and privacy policy and your settings with it. The provider is not our sub-processor: you choose it and instruct us to send it the data. Where the data is about your certificate recipients, you are responsible for having the right to share it with the AI app you choose.
• What we keep. A record of each connection (the app, the workspace, the permissions you granted, and when it was made and last used) and a log of each action the app takes (which action, when, and the result). The log contains no recipient names or email addresses. We store the app's access tokens only in hashed form.
• Disconnecting. Disconnect the app under Connected Apps in CertSeal to stop its access immediately. You can also remove CertSeal in the AI app.

11. Third-party subprocessors

We currently use third party subprocessors to provide our services. Prior to engaging any third party subprocessor, Alphacloud performs diligence to evaluate their privacy, security and confidentiality practices, and executes an agreement implementing its applicable obligations.

Alphacloud may use the following subprocessors for the purpose described below:

AI apps and integrations that you connect yourself, such as Claude, ChatGPT, Zoom, Zapier or Make, are not our subprocessors; see AI apps you connect.

Likewise, if your organization sends certificate emails through its own email server or its own Resend account, those emails, including each recipient's name and email address, go through that provider, which your organization chose and which is not our subprocessor. We store the server password or API key you give us encrypted, and use it only to send your organization's certificate emails.

As our business grows and evolves, the Subprocessors we engage may also change. We will endeavor to provide the owner of Customer's account with notice of any new Subprocessors to the extent required under the Agreement, along with posting such updates here. Please check back frequently for updates.

12. How long we store your personal data

We will retain your information for as long as it is reasonably needed for the purposes set out in How we use your personal data and why unless you request that we remove your Personal Data as described in Your rights relating to your personal data.

We will only retain your Personal Data for so long as we reasonably need to use it for these purposes unless a longer retention period is required by law (for example for regulatory purposes).

This may include keeping your Personal Data after the termination of your contract for the period of time needed for us to pursue legitimate business interests, conduct audits, comply with (and demonstrate compliance with) legal obligations, resolve disputes and enforce our agreements.

Certificates you have issued stay viewable at their links as described in section 10 of our Terms of Use. Server logs, including the log of actions taken by AI apps you connect, are kept for up to 90 days.

If your organization has issued Open Badges and its account is closed, we keep its approved issuer name, website and contact email, its public keys and its revocation lists, so that the badges it issued keep verifying. Its private signing keys are deleted.

13. Where we store your personal data

The Services are operated by Alphacloud from Singapore. Personal Data that you provide us is stored with Amazon Web Services in the United States (N. Virginia), and may be stored, processed and accessed by us, our staff, sub-contractors and third parties with whom we share Personal Data in other regions for the purposes described in this policy. We may also store Personal Data in locations outside the direct control of Alphacloud (for instance, on servers or databases co-located with hosting providers). Where we transfer Personal Data out of Europe, we rely on the safeguards described in our Data Processing Agreement, such as the European Commission's Standard Contractual Clauses.

14. How we protect your personal data

Alphacloud uses industry-standard physical, managerial, and technical safeguards to preserve the integrity and security of your personal information. We limit access to your Personal Data to those employees and other staff who have a business need to have such access. All such people are subject to a contractual duty of confidentiality.

We periodically review our policies and procedures to evaluate their effectiveness and ensure that they remain up to date. We cannot, however, ensure or warrant the security of any information you transmit to Alphacloud or guarantee that your information on the Services may not be accessed, disclosed, altered, or destroyed by a breach of any of our physical, managerial, or technical safeguards.

We have put in place procedures to deal with any actual or suspected Personal Data breach. In the event that personal information is compromised as a result of such a breach of security, Alphacloud will promptly notify those persons whose personal information has been compromised, in accordance with the notification procedures set forth in this Privacy Policy, or as otherwise required by applicable law.

Alphacloud cannot ensure that your Personal Data will be protected, controlled or otherwise managed pursuant to this Privacy Policy if you share your login and password information with any third party, including any third party operating a website or providing other services. If you believe you have discovered a vulnerability, please email support@certseal.com.

15. Links to other websites

This Privacy Policy applies only to the Services. Our platform may contain links to other websites not operated or controlled by Alphacloud. We are not responsible for the content, accuracy or opinions expressed in such websites, and such websites are not investigated, monitored or checked for accuracy or completeness by us.

Please remember that when you use a link to go from the Services to another website, our Privacy Policy is no longer in effect. Your browsing and interaction on any other website, including those that have a link on our Site, is subject to that website's own rules and policies. Such third parties may use their own cookies or other methods to collect information about you.

16. Google Authentication

If you choose to sign up or sign in using Google on CertSeal, please note the following:

• Access and Usage of Google User Data: CertSeal accesses limited information from your Google account (your name, email address and profile picture) strictly for authentication purposes. The usage of Google user data is confined to the functionality described in this Privacy Policy.
• Privacy Policy Hosting and Visibility: Our privacy policy is hosted on the verified domain of our website, visible to users, and can be accessed through a link on the sign-up page of our app.
• OAuth Consent Screen: The privacy policy URL linked to the OAuth consent screen on the Google Cloud Console matches the privacy policy link in our app. By using Google Authentication, you acknowledge and agree to the additional terms outlined in this section. We are committed to ensuring the security and responsible use of your data.

17. Changes to our privacy policy

We reserve the right, in our sole discretion, to change, modify, add, or remove portions of this Privacy Policy at any time. Any changes or updates will be effective immediately upon posting to this page. You should review this Privacy Policy regularly for changes. You can determine if changes have been made by checking the Effective Date at the top of this page. Your continued use of our services following the posting of any changes to this Privacy Policy means you consent to such changes.

Questions about this document? Email hello@certseal.com — a real human will reply.