Privacy Policy

Last updated: July 10, 2026

This Privacy Policy explains how Certivar ("Certivar", "we", "us") collects, uses, and protects personal data when you use our compliance automation platform and websites (the "Service"). We built Certivar for compliance-minded teams, and we hold ourselves to the same standard.

1. Information We Collect

Account information — such as your name, work email, organization, and role, provided when you register.
Customer Data — the evidence, documents, and control information you upload to manage your compliance program.
Usage data — logs, device and browser information, and activity within the Service, used for security and to improve the product.

2. How We Use Information

We use personal data to provide and secure the Service, authenticate users, process payments, communicate with you about your account, provide support, and comply with legal obligations. We do not sell your personal data.

3. Sharing & Subprocessors

We share data with vetted service providers (subprocessors) that help us operate the Service — for example, cloud hosting (AWS), email delivery, and payment processing. These providers are bound by confidentiality and data-protection obligations and process data only on our instructions. We may disclose data if required by law.

4. Security

We protect data with encryption in transit and at rest, network isolation, least-privilege access controls, and audit logging. No system is perfectly secure, but we work continuously to safeguard your information and maintain tenant isolation.

5. Data Retention

We retain personal data for as long as your account is active or as needed to provide the Service, and thereafter as required to comply with legal obligations, resolve disputes, and enforce agreements. You may request deletion of your data as described below.

6. Your Rights

Depending on your location, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing (for example, under GDPR or CCPA). To exercise these rights, contact us at privacy@certivar.com.

7. Cookies

We use essential cookies to keep you signed in and to secure the Service, and limited analytics to understand and improve usage. You can control cookies through your browser settings.

8. International Transfers

We may process and store data in the United States and other countries. Where required, we use appropriate safeguards for cross-border transfers of personal data.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the Service or by email, and the "Last updated" date above will change.

10. Contact

For privacy questions or requests, contact our team at privacy@certivar.com.