Privacy

The short version

CertChase is a portfolio demo. It is built to run on synthetic vendors and generated certificates, and you should not upload real certificates of insurance or real contact details to it.

What is stored

• Your account: email address and a password hash, held by Supabase Auth.
• Your organisation: its name, requirement templates, vendors and settings.
• Certificates you upload, in a private storage bucket under a path that begins with your organisation’s id. Database policies check that path, so other accounts cannot read your files.
• What was read from each certificate, the rule results, and the chase emails drafted from them.
• An append-only log of every model call (model, prompt version, token counts, latency) and every approval, edit or rejection.

Who processes it

• Supabase hosts the database, authentication and file storage.
• Google Gemini reads certificate images and PDFs. The public demo uses the free tier, whose inputs may be used by Google to improve its products, which is why it must never be given a real certificate.
• Groq may draft chase emails from the rule findings.
• Stripe runs checkout in test mode. No real card is charged and no real payment is taken.
• Resend delivers email only when demo delivery is switched on. By default, outgoing email lands in an in-app outbox and is not sent.
• Vercel hosts the site and records anonymous page-view analytics.

What is not done

• CertChase does not train models on your data.
• Data is not sold or shared for advertising.
• No compliance decision is made by a language model; plain rules make it.

Deleting your data

Demo data may be reset at any time. To have an account and its files removed sooner, open an issue on the GitHub repository without including any personal details, and the maintainer will follow up.

Related

The rules for using the demo are on the terms page.