Privacy Policy

Clear information about the data GrabCert uses to run your account, protect the service, and deliver your exam preparation access.

Last updated: July 18, 2026

Privacy at a glance

Your information supports your study experience

This Privacy Policy explains how GrabCert collects, uses, discloses, and protects personal information when you visit our website, create an account, purchase exam access, use study features, or contact support. Together, these are the "Services."

We collect the information needed to provide and secure the Services. We do not sell your personal information, and we do not rent it to third parties for their own marketing. Third-party websites and services you choose to visit have their own privacy practices.

Information we collect

The information we collect depends on how you use GrabCert. It can include:

  • Account information. Your email address, optional name, account identifier, role, and authentication status.
  • Purchase and access information. The exam and access period you select, price, coupon code, transaction status, purchase and expiration dates, and payment-related reference identifiers.
  • Study activity. Bookmarks, exam ratings, and other interactions you choose to save while using study features.
  • Support communications. Your contact details, message, screenshots, error information, and anything else you choose to send when asking for help.
  • Technical and security information. IP address, request and login timestamps, browser and operating system details, device type, login result, and approximate region or network information derived from an IP address.

We also receive limited information from providers that help operate the Services. For example, Supabase confirms account and session details, while Stripe returns checkout and payment status information.

Payment card details are entered directly into Stripe's checkout. GrabCert does not receive or store your full payment card number or card security code.

How we use information

We use personal information to:

  • Create, authenticate, maintain, and support your account.
  • Process checkout, confirm purchases, and provide the access you purchased.
  • Save study choices such as bookmarks and ratings.
  • Respond to support requests and investigate reported problems.
  • Detect suspicious activity, prevent abuse, and protect accounts and content.
  • Operate, troubleshoot, measure, and improve the reliability of the Services.
  • Comply with law, maintain required records, and enforce our agreements.

Depending on where you live, our legal basis may be performance of a contract, compliance with a legal obligation, your consent, or our legitimate interests in operating and securing GrabCert. You may withdraw consent where processing relies on consent, without affecting earlier processing.

Cookies and similar technologies

GrabCert uses cookies and comparable browser storage where they are needed to keep you signed in, preserve session state, protect forms, prevent fraud, and complete checkout. Authentication cookies may be set or managed through Supabase.

Cloudflare Turnstile may process a security token, IP address, and limited device or browser signals to distinguish legitimate activity from automated abuse. Blocking essential cookies or security tools may prevent sign-in, purchasing, or other core features from working.

You can remove or block cookies using your browser settings. Those settings are controlled by your browser, and their location varies by provider.

How we share information

We disclose personal information only when it is reasonably necessary for the Services or permitted by law. Recipients can include:

  • Service providers. Supabase for account authentication and sessions, Stripe for checkout and payment processing, Cloudflare Turnstile for abuse prevention, and providers that support hosting, databases, storage, email, and technical operations.
  • Professional advisers. Auditors, insurers, legal counsel, or similar advisers when needed to protect or operate the business.
  • Authorities and safety recipients. When disclosure is required by law, a valid legal process, or reasonably necessary to investigate fraud, security incidents, or threats to rights and safety.
  • A successor organization. In connection with a merger, financing, reorganization, sale of assets, or similar business transaction, subject to applicable confidentiality and notice requirements.
  • Other recipients you approve. When you direct us to share information or give us consent.

We do not sell your personal information or share it with third parties for their own direct marketing.

Data retention and security

We retain account data while your account is active and for a reasonable period afterward. Purchase, tax, fraud-prevention, security, and support records may be kept longer when needed to complete transactions, resolve disputes, enforce agreements, protect the Services, or meet legal obligations. Backup copies may remain until they are replaced through normal backup cycles.

We use safeguards appropriate to the nature of the information, including access controls, encrypted network connections, restricted administrative tools, audit records, and security monitoring. No online service can guarantee absolute security. Protect your sign-in credentials and contact us if you believe your account has been compromised.

Your privacy rights and choices

Privacy rights vary by location. Subject to applicable law, you may ask us to:

  • Confirm whether we process your personal information and provide access to it.
  • Correct inaccurate or incomplete account information.
  • Delete personal information that we are not required to retain.
  • Provide a portable copy of eligible information.
  • Restrict or object to certain processing.
  • Withdraw consent where consent is the legal basis for processing.
  • Appeal a decision or complain to your local privacy regulator, where available.

Send a request to support@grabcert.com. We may need to verify your identity and account relationship before completing a request. We will explain if law allows or requires us to retain certain information. Authorized agents may submit requests where permitted by law, subject to proof of authority and identity verification.

International data transfers

GrabCert and its service providers may process information in countries other than the one where you live. Privacy laws in those countries may differ. Where required, we use contractual or other recognized safeguards for international transfers and take steps designed to protect information as described in this policy.

Children's privacy

GrabCert is not directed to children under 13, and we do not knowingly collect personal information from children under 13. A higher minimum age may apply where local law requires parental consent for online services. If you believe a child has provided personal information in violation of these rules, contact us so we can investigate and take appropriate action.

Changes to this policy

We may update this Privacy Policy as GrabCert changes or legal requirements evolve. We will post the revised version here and update the date at the top. If a change is material, we may also provide notice through the Services, by email, or as otherwise required by law.

Contact us

Questions, concerns, and privacy requests can be sent to support@grabcert.com. You can also use the Contact Us page.