Privacy Policy

CredTally stores your professional license records and certificates so you can track your continuing-education requirements. We collect only what the product needs, we never sell your data, we show no ads, and you can permanently delete everything yourself at any time from Settings.

• Account information — your email address and, if you provide it, your name. If you sign in with Google, we receive your email and name from Google. We never see your Google password, and no password exists for email sign-in.
• License and CE records — the licenses, requirements, course entries, dates, hours, and notes you enter.
• Certificate files — the PDF or image files you upload. These may themselves contain personal information (your name, license number); they are stored privately as described below.
• Billing information — payments are processed by Stripe. We store your subscription status and Stripe customer reference; we never receive or store your full card number.
• Technical basics — standard server logs (IP address, browser type, requested pages) used for security and debugging, retained briefly by our hosting provider.

• To operate the product: compute your remaining hours, store and display your records, and assemble your audit exports.
• To send deadline reminder emails — you control the schedule in Settings, and every reminder includes a one-click unsubscribe link.
• To send essential transactional email, such as sign-in links and billing notices.
• To respond when you contact support.

We do not sell or rent your data, share it with advertisers, or use it to train AI models.

We use only essential cookies — the session cookie that keeps you signed in. There are no advertising cookies and no cross-site tracking.

A small set of providers process data on our behalf, each receiving only what their role requires:

• Supabase — database, authentication, and file storage (your records and certificates live here, encrypted at rest).
• Stripe — payment processing and subscription management.
• Resend — delivery of sign-in and reminder emails.
• Vercel — application hosting and server logs.

Beyond these providers, we disclose personal data only if required by law, or to protect the rights, safety, or security of CredTally and its users.

• All traffic is encrypted in transit (TLS), and data is encrypted at rest.
• Database access is isolated per user with row-level security — your records are readable only by your authenticated account.
• Certificates are stored in private storage, never at public URLs. They are served through short-lived signed links generated only for you.

No system is perfectly secure, but if we learn of a breach affecting your personal data we will notify you promptly as required by law.

We keep your data for as long as your account exists. Deleting your account in Settings permanently removes your account, licenses, credit records, and uploaded certificates from our production systems immediately; residual copies in encrypted backups age out on the backup rotation schedule. Downgrading from Pro deletes nothing.

Depending on where you live, you may have rights to access, correct, export, or delete your personal data. CredTally gives you those controls directly: your records are viewable and editable in the app, exportable via the audit packet, and deletable via account deletion. For anything else — or to exercise rights under laws like the CCPA or GDPR — email us and we will respond within 30 days.

The Service is for licensed professionals and is not directed to anyone under 18. We do not knowingly collect data from children.

If we make material changes, we will notify you by email or in the app before they take effect. The effective date at the top always reflects the current version.

Privacy questions or requests: admin@credtally.com. See also our Terms of Service.