Privacy policy

This policy explains what CertPrepy LLC (“CertPrepy”, “we”) collects when you use certprepy.com and the service, and what we do with it.

What we collect

• Account and company details: your email address, company name and the business details you enter.
• Product and certificate data: the products, certificates, trade parties and IDs you create.
• Uploaded lab reports and the fields extracted from them.
• CPSC Product Registry API tokens, if you add them. We store them encrypted.
• Shopify access tokens and store data needed for the features you use, if you connect Shopify.
• Billing information. Payments are handled by Stripe. We do not store your card number.
• Waitlist details: your email address, optional company name and optional number of regulated SKUs, if you join the waitlist.
• Scope check usage: the product type and answers you submit, recorded without your name, to understand how the checker is used.
• A first-party cookie that records which channel you arrived from (for example search, a partner link or direct), the first page you landed on and a source label. It holds no personal data.
• A sign-in session cookie when you are signed in.
• Aggregated page view counts by day, page and channel. These contain no personal data and no IP addresses.
• Support emails you send us and our replies.

How we use it

To run the service, prepare and check your certificates, send sign-in links and account emails, send monitoring alerts you are entitled to, process payments and refunds, answer support requests, prevent abuse, and understand which channels bring visitors. We send waitlist emails only to people who joined the waitlist, and each includes an unsubscribe link.

Who processes data for us

• Vercel: website hosting.
• Supabase: database and file storage.
• Resend: email delivery.
• Stripe: payments and billing portal.
• xAI: text extraction from lab reports, when AI extraction is enabled. The report text is sent to xAI for that purpose.
• Shopify: when you connect your store.

If you add a CPSC Registry API token, CertPrepy calls the CPSC Product Registry on your behalf with that token for the features you use.

We do not sell your data

We do not sell your data and we do not share it for advertising. We disclose it only to the processors above, when the law requires it, or with your consent.

Retention

We keep your account and certificate data while your account is open so the service works. If you close your account or ask us to delete data, we delete it, except records we must keep for billing, tax or legal reasons. You are separately required to keep your own certificate records for the period the CPSC rules set.

Export and deletion

To get a copy of your data or ask for it to be deleted, email support@certprepy.com from the address on your account. To leave the waitlist, use the unsubscribe link in any waitlist email.

Security

We store CPSC Registry API tokens encrypted. No system is perfectly secure, so use a work email you control.

Changes and contact

We will post changes here with a new date. Questions go to support@certprepy.com. See also the terms and contact page.