Privacy Policy

Who is responsible

ChaseCerts is a private-beta project operated by Tornike Meshvildishvili, an individual based in Tbilisi, Georgia, who is the data controller for the information described here. Contact: hello@chasecerts.com.

What we collect from the public website

When you fill in the form on our home page, we store exactly these fields:

• your name;
• your email address;
• your company name;
• the range of how many vendors you track;
• whether you applied for the validation pilot or joined the software waitlist;
• your requested timeframe for the cleanup, when applicable;
• your non-binding answer about whether you would consider a future $199 pilot;
• your answer to "how do you track COIs today?", if you write one;
• which link brought you here — a short label such as email or linkedin taken from the address you clicked;
• the date and time you submitted it.

The public form has no hidden profiling field, tracking pixel, or third-party advertising script.

What the private beta stores

If you receive an account or vendor upload link, the service also stores:

• account member name, email address, workspace name, role and timezone;
• vendor contact details, notes and assigned insurance requirements;
• original certificate PDFs, text read from them, and the fields extracted or corrected from them;
• compliance results, expiration dates, reminder delivery identifiers and audit events;
• single-use upload-link hashes, expiry and use timestamps.

Supabase Auth handles account passwords; ChaseCerts does not receive or store the readable password. Vendor upload links do not create vendor accounts.

Why we use it

For paid services, we store the workspace-linked checkout identifier, selected plan, accepted terms version, membership status, billing-period dates and a link to manage billing. Whop collects payment details on its checkout; ChaseCerts does not store full card or bank details. We send Whop a random checkout reference to connect the purchase to the correct workspace, not your vendor files.

To reply to you, qualify and deliver a validation pilot, operate the private-beta workspace, collect and review certificates, calculate administrative status, send requested reminders, and maintain an audit trail. This is necessary to take steps at your request and to provide the service, and is also our legitimate interest in developing it. If you would rather we did not contact you, say so and we will stop and delete your lead record.

Analytics

We use Vercel Analytics to count page views and see which pages people read. It is aggregate and cookieless — it does not build a profile of you, does not follow you to other sites, and does not store an identifier on your device. Because we set no tracking cookies, this site does not show a cookie banner.

Who else touches the data

We keep the list short and name everyone:

• Vercel — hosts the website and its server logs.
• Supabase — provides authentication, the database and private PDF storage.
• Resend — delivers account, request and reminder email.
• Whop — operates checkout, payment processing and subscription management under its own terms and privacy policy.
• OpenAI — only when the optional scanned-PDF extraction fallback is configured, receives the certificate PDF to return candidate fields for human review. The API request is made with response storage disabled.

Our infrastructure providers process data to deliver the service; Whop also processes payment information under its own policies. We do not sell your information, we do not share it for advertising, and we do not hand it to anyone else unless the law requires it.

Where it is stored

On servers operated by the providers above, which may be in the United States or the European Union. Where personal data leaves the European Economic Area, our providers rely on standard contractual clauses.

How long we keep it

Waitlist entries stay until you ask us to remove them or they are no longer useful for validation. Private-beta account records and source PDFs are kept while the workspace is active so its audit trail remains available, then deleted or returned according to the agreed offboarding instructions, legal needs and valid deletion requests.

Your rights

You can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Email hello@chasecerts.com and we will do it within 30 days — usually the same week, because the list is small and a person reads it. You do not have to explain why, and you can complain to your local data protection authority if you are unhappy with how we respond.

Data your vendors send you

Certificates you provide for a pilot, or that vendors upload through a single-use link, may contain personal information. For that data you are the controller and we are the processor: we hold and process it to provide the service on your instructions, and for no other purpose. The private-beta owner remains responsible for deciding whether a vendor is acceptable and for honoring data-subject requests relating to its source data.

Children

ChaseCerts is a business tool and is not intended for anyone under 18.

Changes

If we change this policy we will update the date at the top, and email you if the change is significant.