Who we are
Cert Made Easy (“we”, “us”, “our”) operates the website at certmadeeasy.com and provides certification exam preparation services. We are based in the United Kingdom.
For any questions about this policy or your personal data, contact us at [email protected].
What data we collect
We collect the following personal data when you use our service:
- Account information: email address, display name, and password (hashed). If you sign in with Google, we receive your name and email from Google.
- Profile information: profession, years of experience, and certification goals — provided voluntarily during onboarding to personalise AI explanations.
- Usage data: answers to quiz questions, marked questions, study progress, and chat messages with the AI assistant.
- Exam requests: if you ask us to add an exam we don’t offer yet, the exam you named, the month you plan to sit it if you tell us, and, if you are not signed in, the email address you give us for the heads-up.
- Payment data: when you make a purchase, payment is processed by Stripe. We store the transaction reference and amount but never see or store your card details.
- Technical data: IP address, browser type, and device information — collected automatically for security and service operation.
How we use your data
We use your data to:
- Provide and maintain the quiz platform and your account
- Track your study progress and generate performance insights
- Analyse study activity, such as which questions are answered correctly, in aggregated and anonymised form to improve Cert Made Easy for all learners and to publish insights and articles, such as which exam topics learners find hardest. Published figures never identify individual users, and AI chat messages are not used for this
- Personalise AI-powered explanations based on your experience level
- Process payments via Stripe
- Send transactional emails (account confirmation, password resets)
- Tell you when an exam you asked us to add becomes available, and decide which exams to add next
- Protect against abuse and ensure service security
- Measure product usage and the performance of our marketing campaigns, including reaching potential users on advertising platforms
We do not sell your personal data.
Legal basis for processing (UK GDPR)
- Contract: processing your account data and quiz answers is necessary to provide the service you signed up for.
- Legitimate interest: technical data for security and service reliability, and aggregated, anonymised analysis of study activity to improve the service and publish insights.
- Consent: optional profile information (profession, experience) and AI chat — you can skip or delete this at any time.
Where your data is stored
Your data is stored on servers in the European Union (Ireland, eu-west-1) via our infrastructure provider Supabase. Stripe processes payments in compliance with PCI-DSS standards. AI explanations are generated via OpenAI’s API — your question context (not personal data) is sent to generate responses.
How long we keep your data
- Account and study data: retained while your account is active. Deleted within 30 days of account deletion.
- Payment records: retained for 7 years as required by UK tax law.
- Technical logs: retained for up to 90 days.
Your rights
Under UK GDPR, you have the right to:
- Access your personal data
- Correct inaccurate data
- Delete your account and associated data
- Export your data in a portable format
- Object to processing based on legitimate interest
- Withdraw consent at any time for optional data
To exercise any of these rights, email [email protected]. We will respond within 30 days.
Cookies and similar technologies
We use cookies and similar technologies for three purposes:
- Essential: authentication and session management. Required for the service to function.
- Analytics: PostHog helps us understand how the product is used so we can improve it.
- Advertising: Google Ads measures the performance of our advertising and lets us reach potential users. It may set cookies and share usage data (such as pages visited and purchases) with Google. When you are signed in, we also share a hashed (irreversible) version of your email address so Google can match conversions to ad clicks — your raw email is never shared.
If you are in the UK or the EEA we ask before setting anything in the analytics or advertising categories, and nothing in either category runs until you accept. You can change that answer whenever you like:
You can also opt out of interest-based advertising via your Google ad settings, and block or delete cookies in your browser settings.
AI assistants (our MCP server)
You can use Cert Made Easy from an AI assistant such as ChatGPT or Claude through our MCP server at certmadeeasy.com/mcp (see Use with AI). It needs no account and does not identify you. The assistant sends us only what a tool needs: an exam name or code, a search term, a question id, and the option letters you chose.
We record each call in PostHog to learn what is useful: the tool, which assistant made the call, the exam, the search term (its first 80 characters), and whether a checked answer was right. These records are not linked to you or to any account, hold no IP address, and do not include your conversation. A search term is stored as the assistant sent it, so do not put personal details in one. What your assistant shares with us is covered by its own privacy policy.
Third-party services
- Supabase — authentication and database hosting (EU)
- Stripe — payment processing
- OpenAI — AI-powered quiz explanations
- Google — optional OAuth sign-in, and advertising measurement via Google Ads
- PostHog — product analytics (EU-hosted)
Children
Our service is not directed at children under 16. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
Changes to this policy
We may update this policy from time to time. Material changes will be communicated via email or a notice on our website. The “last updated” date at the top reflects the latest revision.
Contact
Cert Made Easy
United Kingdom
[email protected]
If you are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO).