Privacy Policy

Last updated: 29 September 2026

CertPulse ("we," "us") provides certificate generation and verification infrastructure for event organizers. This policy explains what data we collect, why, who we share it with, and how long we keep it, whether you are an event organizer using CertPulse, a participant whose certificate we generate, or a prospective customer contacting us. It applies to certpulse.revupulse.com, app.certpulse.revupulse.com, and verify.certpulse.revupulse.com.

What we collect

• Participant data: name, email, and whatever other fields an organizer's roster includes (rank, category, distance covered, etc.), imported by the organizer via CSV/Excel upload. We also generate a rendered certificate (PDF or PNG) from this data.
• Organizer/admin account data: name, email, and a securely hashed password (for password-based accounts; passwordless accounts store no password at all).
• Email delivery data: delivery, bounce, and complaint status for certificate emails we send on an organizer's behalf, reported to us by our email provider.
• Enquiry data: name, organization, email, phone, and event details you submit through our enquiry form if you are considering CertPulse for your event.
• Local, on-device data: your session token and a cosmetic design-system preference, stored in your browser's localStorage. This never leaves your device and is not a cookie (see our Cookie Policy).
• Website and app usage data: on our marketing site (certpulse.revupulse.com), the pages you view, what you click, how far you scroll, and a recording of your visit (mouse movement, scrolling and clicks on the page). Anything you type into a form field is masked and never recorded. In the CertPulse app (app.certpulse.revupulse.com) we record the same kind of usage, but every piece of text and every image on screen is masked too, so no organizer or participant details (names, emails, rosters, certificates) are captured; once you're signed in, your visits are linked to your internal CertPulse account ID, never your email or name. It's collected without cookies, and a visit that starts on the marketing site and continues into the app is linked as one visit.

Why we collect it

Participant data exists solely to generate and deliver that participant's certificate, and to let anyone with the certificate's link verify it's genuine. Organizer account data lets you securely access your event's admin dashboard. Enquiry data lets us respond to your interest in CertPulse. Website and app usage data shows us which parts of our site and app are clear and which confuse people, so we can improve them. We do not sell any of this data, to anyone, ever.

Who we share it with

We use a small number of infrastructure providers to run CertPulse, each of which processes data on our behalf under their own security and privacy commitments:

• Render: hosts our backend application.
• Turso: hosts our database (participant, admin, and enquiry records).
• Cloudflare: hosts our websites, stores rendered certificate files, and (where enabled) provides bot-protection on our public forms.
• Resend (with Amazon SES as its underlying mail infrastructure): delivers certificate and notification emails.
• PostHog: usage analytics and masked visit recordings for our marketing site and app (see PostHog's privacy policy).

We do not share participant, organizer, or enquiry data with any other third party, and we do not use it for advertising.

How long we keep it

• Participant data and rendered certificates are kept for as long as the event they belong to exists on CertPulse. When an organizer deletes an event, it stops being shown straight away, including its public verification pages, and its participant data and certificates are permanently deleted within 60 days. Until then the organizer can ask us to restore it.
• A single participant removed by an organizer has their certificate file deleted straight away. Their record stays with the event until the event itself is deleted, or until you ask us to erase it (see "Your rights" below).
• Organizer/admin accounts are kept while active. There is no self-serve account deletion yet: contact us and your account is removed from the service straight away (you can no longer sign in, and events only you manage stop being shown). It is then permanently deleted, together with those events, their participant data and certificates, within 60 days, or at once if you ask. Events you manage together with another organizer stay with them. Your email address is free to sign up again straight away.
• Blocked email addresses. If we block an address from using CertPulse, for example after abuse, we keep a one-way fingerprint of it (the address can't be recovered from it) and a masked hint such as j***@gmail.com, so the block keeps working after the account's data is deleted. We keep this as a record even after a block is lifted.
• Email delivery status is kept alongside the participant record it belongs to, and deleted with it.
• Enquiry submissions are kept indefinitely as our sales pipeline record, unless you ask us to delete yours (see "Your rights" below).
• Backups. Deleted data can remain in backup copies of our database for up to 60 days after it's deleted, after which those copies are removed too. We only restore from backups to recover from an incident, never to bring back data you asked us to delete.

Your rights

If you are in India, the Digital Personal Data Protection Act, 2023 gives you the right to access, correct, and request erasure of your personal data, and to file a grievance with us before escalating elsewhere. Whoever you are, if you want to know what data we hold about you, correct it, or have it deleted, contact us at [email protected] and we will act on it directly, completing any erasure request within 60 days. If you're a participant, your event organizer is usually the fastest path to a correction, since they control the underlying roster data.

Security

Passwords are stored using industry-standard hashing, never in plain text. Access to an event's data is scoped per admin and checked on every request. All traffic to our sites and API is encrypted in transit. No system is perfectly secure, and we treat any suspected breach as a priority to investigate and disclose.

Changes to this policy

We may update this policy as CertPulse evolves. Material changes will be reflected here with an updated "Last updated" date above.

Contact

Questions about this policy or your data? Reach out directly.

This policy describes CertPulse's actual data practices as of the date above but is not a substitute for legal advice.