Privacy Policy

CredTally stores your professional license records and certificates so you can track your continuing-education requirements. We do not show ads inside the app. Optional advertising measurement is off unless you accept it in Privacy choices. We never send credential files or license records to advertising services. You can delete your account from Settings.

• Account information — your email address and, if you provide it, your name. If you sign in with Google, we receive your email and name from Google. We never see your Google password, and no password exists for email sign-in.
• License and CE records — the licenses, requirements, course entries, dates, hours, and notes you enter.
• Certificate files — the PDF or image files you upload. These may themselves contain personal information (your name, license number); they are stored privately as described below.
• Billing information — payments are processed by Stripe. We store your subscription status and Stripe customer reference; we never receive or store your full card number.
• Optional advertising measurement — if you accept, configured Meta, Google and Reddit tags can receive visits to public marketing pages and ordinary browser/network information such as IP address, browser type and advertising identifiers. Meta can also receive a verified initial Pro purchase amount, currency and pseudonymous event ID. We do not include your email, name, account ID, Stripe identifiers, license details or files in the purchase event.
• Technical basics — standard server logs (IP address, browser type, requested pages) used for security and debugging, retained briefly by our hosting provider.

• To operate the product: compute your remaining hours, store and display your records, and assemble your audit exports.
• To send deadline reminder emails — you control the schedule in Settings, and every reminder includes a one-click unsubscribe link.
• To send essential transactional email, such as sign-in links and billing notices.
• To respond when you contact support.

We do not sell or rent your professional records or use them to train AI models. If you opt in, limited advertising measurement data is shared as described above to understand which campaigns bring paying subscribers. Advertising services may combine it with information they hold under their own privacy policies.

Essential cookies keep you signed in. A short-lived, signed checkout receipt cookie verifies a completed payment; it is not accessible to browser scripts. We store your advertising choice in this browser for up to 180 days. Optional advertising tags and their cookies load only after you accept, on selected marketing pages and a clean checkout confirmation page, not on private record screens. Meta automatic event collection and advanced matching are not enabled by our integration.

Use the Privacy choices button to reject or withdraw permission at any time. Rejection does not affect account access or your subscription. We honor Global Privacy Control as a rejection. We use local browser storage to suppress repeat purchase events. Ad blockers, rejection or closing checkout early can prevent measurement; this does not affect billing.

A small set of providers process data on our behalf, each receiving only what their role requires:

• Supabase — database, authentication, and file storage (your records and certificates live here, encrypted at rest).
• Stripe — payment processing and subscription management.
• Resend — delivery of sign-in and reminder emails.
• Vercel — application hosting, server logs and aggregate site analytics.
• Meta, Google and Reddit — optional advertising measurement when configured and accepted. Purchase measurement is sent only to Meta.

Beyond these providers, we disclose personal data only if required by law, or to protect the rights, safety, or security of CredTally and its users.

• All traffic is encrypted in transit (TLS), and data is encrypted at rest.
• Database access is isolated per user with row-level security — your records are readable only by your authenticated account.
• Certificates are stored in private storage, never at public URLs. They are served through short-lived signed links generated only for you.

No system is perfectly secure, but if we learn of a breach affecting your personal data we will notify you promptly as required by law.

We keep your data for as long as your account exists. Deleting your account in Settings permanently removes your account, licenses, credit records, and uploaded certificates from our production systems immediately; residual copies in encrypted backups age out on the backup rotation schedule. Downgrading from Pro deletes nothing.

Depending on where you live, you may have rights to access, correct, export, or delete your personal data. CredTally gives you those controls directly: your records are viewable and editable in the app, exportable via the audit packet, and deletable via account deletion. For anything else — or to exercise rights under laws like the CCPA or GDPR — email us and we will respond within 30 days.

The Service is for licensed professionals and is not directed to anyone under 18. We do not knowingly collect data from children.

If we make material changes, we will notify you by email or in the app before they take effect. The effective date at the top always reflects the current version.

Privacy questions or requests: admin@credtally.com. See also our Terms of Service.