Certova ("we", "us", "our") operates the website at certova.ai and the Certova compliance platform (the "Service"). This Privacy Policy explains what information we collect, how we use it, and the choices you have.
1. Information we collect
- Account information - name, email, company, and password (stored hashed) when you register.
- Content you upload - the policies, procedures, configurations, and other documents you submit for compliance analysis.
- Usage data - log data, device and browser information, and how you interact with the Service.
- Cookies - strictly necessary cookies for authentication and session management. See Section 7.
2. How we use information
- To provide the Service - analyzing your documents, mapping controls, and generating gap analyses and reports.
- To authenticate you and keep your account and data secure.
- To communicate with you about your account, billing, and product updates.
- To improve the Service and develop new features.
3. How your documents are processed
Uploaded documents are stored in encrypted, S3-compatible object storage and scoped to your project. Embeddings used for AI retrieval are stored in an isolated, per-project vector store. We use AI model providers to process content; document content is sent to these providers only to deliver the analysis you request and is not used to train third-party foundation models where provider settings allow.
4. Sharing and disclosure
We do not sell your personal information. We share data only with sub-processors that help us run the Service (e.g., cloud hosting, AI model providers, payment processing), under contractual confidentiality and data-protection obligations, or where required by law.
5. Data retention
We retain your account and content for as long as your account is active. You can delete projects and documents at any time, and you may request deletion of your account by contacting us.
6. Your rights
Depending on your location, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. See our GDPR page for details and how to exercise these rights.
7. Cookies
We use only strictly necessary cookies required to log you in and maintain your session. We do not use advertising cookies.
8. Security
We apply encryption in transit and at rest, project-level data isolation, and access controls. Learn more on our Security page.
9. Changes to this policy
We may update this policy from time to time. Material changes will be posted here with a new "Last updated" date.
10. Contact
Questions about privacy? Email [email protected].