Privacy policy
Last updated: October 2026
ecert.digital ("we") provides certificate issuing and verification software to training institutes ("institutes"). This policy explains what personal data we handle and why. If you have a question, write to privacy@ecert.digital.
Roles
For certificate holders (students), the institute that issued the certificate decides what data to upload and is responsible for it. We process that data on the institute's behalf. For institute staff accounts, we are responsible for the account data.
What we store
- Institute accounts: name, email, password (hashed), institute details, verification email or phone, billing details and payment references.
- Certificate records: holder name, course, dates, certificate ID, any extra columns the institute adds, and optionally the holder's email for delivery.
- Course update opt-ins: if a student clicks "Send me course updates" and confirms, we store their email and the course area.
- Verification counts: we count how many times each certificate is checked per day. We do not store who checked it, their IP address or device.
What verify pages show
Anyone with a certificate ID can see the holder's name, course, validity dates, the issuing institute and the certificate's status. The holder's email and the certificate image are never shown publicly. Verify pages are marked so search engines do not index them.
We send certificate delivery, revocation and expiry emails on behalf of institutes, and course updates only after double opt-in. Every marketing email has an unsubscribe link. Addresses that bounce or complain are blocked from further email.
Where data is kept
Our application runs on a server we operate and uses Cloudflare (website and file storage) and Amazon Web Services (email delivery). These providers process data under their own security commitments.
How long we keep data
Certificate files (PDF and JPG) are deleted from our servers 3 days after they are created; download links in emails work for those 3 days. Only the certificate record is kept after that, so the certificate can still be verified, and the institute can create the files again when needed. Certificate records are kept for as long as the institute's account exists so that certificates remain verifiable. Institutes can revoke certificates at any time. If an institute closes its account, we delete its certificate records within 90 days unless the law requires us to keep them.
Your rights
Students should contact the issuing institute to correct or remove a certificate. You can also write to us and we will pass the request on. Account holders can update their details in the dashboard or ask us to delete their account.