Privacy Policy
Effective date: October 28, 2026
This policy explains how CredentialsTracker (“we”, “us”), operated by CredentialsTracker, collects, uses, and protects personal information. Contact us at credentialstracker@gmail.com.
Who this covers
CredentialsTracker is a tool that businesses use to track licenses, certificates, insurance, and training for their staff and subcontractors. It involves two groups of people:
- Account holders: the businesses and people who sign up. For this information we decide how it is used.
- Staff and subcontractors whose details are entered by an account holder, or who upload a document through a private link. For this information the account holder decides what is collected and why, and we act as their service provider. If you are one of these people, please contact the business that gave you the link first. You can also contact us and we will help.
Information we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Identifiers and contact details | Name, email address, mobile number, IP address | You, or the account holder who added you |
| Account information | Email address, password (stored only in hashed form), subscription status | You |
| Professional and employment-related information | Role, licenses, certificates, insurance policies, training dates, license and policy numbers, the name printed on a document, expiry dates | The account holder, or you through an upload link |
| Uploaded documents | Photos or PDFs of the items above | The account holder, or you through an upload link |
| Activity records | Reminders sent, approvals and changes recorded in the audit log, text-message consent choice | Created by the service |
| Payment information | Handled by Stripe. We receive subscription status and a customer ID, not full card numbers | You, through Stripe |
| Technical information | Basic server logs, IP addresses, and your sign-in session stored in your browser | Collected automatically |
Please do not upload documents showing Social Security numbers, bank or card numbers, or health information. They are not needed for this service.
How we use information
- To provide the service: store records, show dashboards, send reminders and upload requests, and keep an audit log.
- To read uploaded documents and check that the name matches (see “Automated reading of documents” below).
- To process payments, keep accounts secure, prevent misuse, fix problems, and meet legal obligations.
- To contact account holders about their account, the service, and changes to our terms.
We do not use personal information for advertising and we do not build advertising profiles.
Automated reading of documents
When a document is uploaded, we send it to an AI service provided by Anthropic, which returns the document number, name, and dates so they can be filled in. These results can be wrong, so a person should always check them. The AI does not make decisions about anyone: flagged documents, such as a name that does not match, are reviewed by the account holder before they are approved. As we understand Anthropic’s commercial terms, content sent through its API is not used to train its models; see Anthropic’s own policies for details.
Who we share information with
We share information only with companies that help us run the service, and only as needed for that purpose:
| Provider | What it does |
|---|---|
| Supabase | Database, file storage, sign-in, and scheduled functions (servers in the United States) |
| Cloudflare | Hosting for the web pages |
| Resend | Sending reminder and request emails |
| Anthropic | Reading uploaded documents |
| Stripe | Payments and billing |
| Twilio | Text messages, only if text reminders are turned on for an account and the person has agreed to receive them |
We may also disclose information when required by law, to protect rights and safety, or in a merger or sale of the business, in which case we will tell account holders. We do not sell personal information, and we do not share it for cross-context behavioral advertising. We do not disclose personal information to third parties for their own direct marketing.
How long we keep information
We keep information while an account is active. When an account holder deletes a person or a document in the app, the record and the stored file are deleted. Account holders can delete their account at any time from the Account tab, which permanently deletes the account and its data, or ask us to do it. Copies may remain in backups for a limited time before they are overwritten. Entries in the audit log are kept as part of the account’s records and are deleted with the account. To prevent repeated free trials, after an account is deleted we keep a one-way scrambled (hashed) version of the email address, not the address itself, together with the date of first sign-up. Records of subscription payments may be kept longer where the law requires.
Security
We use encrypted connections, per-account access rules so each account can only see its own data, private file storage, and an audit log. No system is perfectly secure. If a security breach affects personal information, we will notify affected account holders as required by California law.
Your California privacy rights
If you are a California resident, you may have the right to know what personal information we hold about you, to have it deleted or corrected, to limit the use of sensitive personal information, and not to be treated differently for using these rights. We do not sell or share personal information, so there is nothing to opt out of. The categories listed in the table above are the categories we collected in the past 12 months, and we disclosed them only to the providers listed above for business purposes. The only sensitive information we collect is account log-in details.
To make a request, email credentialstracker@gmail.com. We may need to verify your identity, and an authorized agent may make a request for you. We aim to respond within 45 days. If your information was entered by an employer or other business, we may refer you to them, because they control it.
Cookies, tracking, and “Do Not Track”
We use your browser’s local storage only to keep you signed in. We do not use advertising or analytics cookies and do not track people across other websites, so we do not need to respond to “Do Not Track” signals.
Text messages
Mobile numbers are stored so reminders can be sent by text if an account holder turns this on. We only text people who have agreed to receive texts, and anyone can reply STOP to opt out.
Where information is processed
The service is hosted in the United States and is intended for businesses operating in the United States. If you use it from elsewhere, your information will be transferred to the United States.
Children
The service is for businesses and is not directed to anyone under 16. We do not knowingly collect information from children.
Changes to this policy
If we make material changes, we will update the effective date above and email account holders before the changes take effect.
Contact
CredentialsTracker, credentialstracker@gmail.com