Privacy Policy

Who is responsible for your data

CandiCerts is operated by Maher MHD Nabih Houri, an individual based in Doha, Qatar, who is responsible for the personal data described here. Contact: support@candicerts.com.

What we collect

CandiCerts may collect your email address, account and authentication data, certification progress, practice attempts and the time spent on each question, glossary review progress, study goals (target exam date and weekly study time), feedback and question reports you submit, the messages you send to Ask CandiCerts, and your subscription status. We collect only what is needed to provide and improve the study service. CandiCerts does not record audio: the voice feature is not offered.

We also count page views with Vercel Web Analytics, which sets no cookies: it records the page visited, the referring page, the browser and device type, and an approximate country. Your IP address is used briefly to limit repeated requests (for example error and security reports) and is not kept with your account.

A functional cookie remembers your language choice.

Signing in

You sign in with a one-time link sent to your email address. We do not store a password. Our authentication provider processes your email address and session data to keep you signed in.

For account security, we keep a record for each signed-in device: a device label (the browser and operating system), an approximate city and country provided by our hosting provider, a hashed form of a random device cookie, and sign-in times. An account can be signed in on 2 devices at a time; signing in on a third device signs out the device that signed in first. We email you when your account is signed in on a new device.

How we use information

We use this information to authenticate your account, provide certification access, personalize practice, calculate progress, deliver explanations, process payments through our payment provider, and protect the service from abuse.

Payments

Payments are processed by Lemon Squeezy, LLC as the merchant of record, which handles payments, taxes and refunds and collects your payment details and billing address under its own privacy policy; CandiCerts receives only what it needs to grant access (which certification you bought, the subscription status and period, and your customer email), never your card number.

Ask CandiCerts and AI

When you send a message to Ask CandiCerts, or request an explanation, lesson or study roadmap, the text and the study context in view (certification, exam domain, the practice question on screen, and a summary of your progress in that certification) are sent to our AI provider to generate the reply. Ask CandiCerts conversations are stored with your account so they can continue across sessions. Your messages are not used to train models by CandiCerts.

Contact form

When you send a message with the contact form in the help center, it is emailed to support@candicerts.com through our email delivery provider, with your email address set so that we can reply to you. The email contains your message, your email address, the name you give (if any), and your account id if you are signed in. CandiCerts does not store the text of your message in its own database: it is kept in the support mailbox, and in our email delivery provider's logs until they expire. We keep a short record of the request (its topic, the length of the message, whether you were signed in, whether the email was delivered, and your account id if you were signed in, or a shortened hash of your email address if you were not) to run the support inbox and stop abuse.

Notify me

When you use Notify me on a certification that is not open yet, we store your email address and that certification only to tell you when that track opens, and we delete them after we send that email, or sooner if you ask.

Free mini mock

You can take the free mini mock without an account. We record that a mini mock was started and completed, the certification, and the score. Your answers are not stored. To limit abuse, every visitor is counted by a pseudonymous keyed hash of the IP address that changes every day; your IP address itself is not stored. If you are signed in, the record is also linked to your account.

Service providers

CandiCerts uses infrastructure providers for authentication, database hosting, deployment, AI generation, email delivery, usage analytics and payment processing. These providers process information only as needed to provide their services.

How long we keep data

• Account data (your email address, progress, practice and mock attempts, study goals, reports, Ask CandiCerts conversations, the explanations you asked for, and your subscription status and purchase email) is kept while your account exists, until you ask us to delete it.
• Operational records (sign-in and activity events, error reports, AI usage cost records, contact-form requests and mini mock records, which we use to run and protect the service) are deleted automatically after 90 days. Rate-limit records are deleted after 7 days.
• Notify me requests (your email address and the certification) are deleted after we send the email that the track has opened, or sooner if you ask.
• Signed-in devices (the device records described under Signing in) are kept while that device is signed in. Once we record that a device has been signed out, its record is deleted 90 days later. We record this when a device is signed out by the 2-device limit or from your account page, and, after a normal sign-out, at your next sign-in. Deleting your account deletes all of them.
• Payment records (card details, billing address, invoices) are kept by Lemon Squeezy, as merchant of record, under its own retention policy and the tax and accounting rules that apply to it. CandiCerts keeps only the subscription status and purchase email listed above.

Your choices

You may request a copy of your attempts and progress, correction of your account information, or deletion of your account. Email support@candicerts.com from the address on your account, or use the support page; account deletion is not yet self-service inside the app.

Content notice

CandiCerts creates original study content and is not affiliated with or endorsed by certification providers. It does not intentionally use real, recalled, or leaked exam questions.