Privacy Policy

CertAware is a training tool provided to you through your credit union. In most cases your credit union is the party that decides why your data is processed (the “controller”) and CertAware operates the platform on its behalf. If you have questions about your credit union’s specific practices, contact them directly.

Your credit union has entered into a Master Subscription Agreement and related order form(s) with CertAware AI, Inc. that govern, among other things, how CertAware AI handles data submitted through the Service on your credit union’s behalf (the “Institutional Agreement”). This Privacy Policy describes our practices in plain language; the Institutional Agreement is the controlling legal document between CertAware AI and your credit union regarding data handling commitments. If you are a credit union member with questions about your specific credit union’s data practices, contact your credit union directly.

• Your name and email address — used to sign you in, address you, and put your name on the certificates you earn.
• Your credit-union association (organization) — so we can give you the right training content and report completion to your credit union.
• Training progress and assessment results — which modules you have started or finished and your scores, so we can track completion and decide whether to issue a certificate.
• Certificates — the credentials you earn, including the certificate name, score, date, and a verification code.
• A device identifier — a per-device value used to keep your account secure, associate your sign-in session, and send notifications. It is not used for cross-app advertising tracking.
• Scam-checker submissions— if you use the scam checker, the message text you paste in is processed to analyze it (see “The scam checker” below).
• Voice recordings and synthetic voice models— for a limited set of designated individuals whose credit union has enabled deepfake voice drill simulations, and only with that individual’s separate, specific written consent, we may process voice recordings and create an AI-generated voice model for use strictly in training simulations. This is governed by a separate consent agreement with that individual, not by this Policy alone, and is deleted upon expiration or revocation of that consent as described in that agreement.

We do not collect precise location, contacts, photos, or advertising identifiers.

We use the data above only to run the service you and your credit union signed up for:

• To deliver training modules and assessments to you.
• To issue, display, and verify the certificates you earn.
• To secure your account, sign you in, and prevent unauthorized access.
• To report training completion and certification status to your credit union.

Our legal basis for this processing is the performance of the training and certification service under our agreement with your credit union, our legitimate interest in keeping accounts secure, and, where required, your consent (for example, before enabling optional features). We do not process your data for unrelated purposes. We do not use your personal data to train artificial intelligence or machine learning models for the benefit of any party other than your credit union, except with your credit union’s prior written consent.

You can optionally turn on biometric sign-in (such as Face ID, Touch ID, or Android biometrics) as a second factor. This is handled entirely by your device’s operating system. Your fingerprint or face data never leaves your device and is never sent to or stored by CertAware. The app only receives a simple pass/fail result from the operating system. We do not collect, store, or transmit biometric data. (Separately, see “Voice recordings and synthetic voice models” above regarding voice biometric data, which is handled differently and only with a designated individual’s specific written consent.)

The app includes a scam checker where you can paste a suspicious message, email, or text and get a plain-English explanation of warning signs. When you use it, the text you submit is sent to a third-party artificial-intelligence provider that analyzes the content and returns a result. Please avoid pasting sensitive personal or account information into the checker. We use the AI provider only to analyze the submission and do not use your submissions to sell products, target advertising, or train AI models for any party other than in connection with providing this feature to you.

We do not sell your personal data, and we do not share it with third parties for advertising. We share data only as needed to run the service:

• With your credit union, which receives your training and certification status.
• With service providers who operate the platform on our behalf (such as hosting, email delivery, and the AI provider that powers the scam checker), under contracts that limit their use of the data to providing those services. A current list of these service providers is available upon request by emailing privacy@certaware.ai.
• Where legally required, such as to comply with a valid legal request.

We keep your training records and certificates while your account is active and for as long as your credit union needs them for compliance and record-keeping. You can delete your account from within the app, which removes your personal profile data. Some records may be retained for a limited period where required for legal, security, or audit reasons, and certificate verification records may be retained so previously issued certificates can still be validated. Scam-checker submissions are used to produce your result and are not kept as part of your profile.

You sign in with your email and a password, and you can add multi-factor authentication — biometric verification on your device (such as Face ID or Touch ID) and, for administrators, an authenticator-app code. If you have not set a password yet, we can email you a one-time link so you can sign in and set one. Passwords are stored only as a secure one-way hash, never in plain text. We use encryption in transit and access controls to protect your data. No system is perfectly secure, but we work to keep your information safe. In the event of a security incident affecting your personal data, we will notify affected users and your credit union without undue delay, consistent with our contractual commitments to your credit union and applicable law.

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal data. If you are a California resident, the California Consumer Privacy Act (CCPA), as amended, gives you the right to know what personal information we collect, request deletion, correct inaccurate information, and opt out of the sale or sharing of personal information — though as noted above, we do not sell or share your personal information for advertising purposes. We honor Global Privacy Control (GPC) signals as a valid opt-out request where applicable. Other states have similar laws that may apply to you. You can update your profile and delete your account in the app, or contact us using the details below to exercise these rights. We will not discriminate against you for exercising them.

CertAware is designed for use by U.S. credit unions and their members and employees. We process and store data in the United States. If you access the Service from outside the United States, you understand your information will be transferred to and processed in the United States.

CertAware is intended for credit-union members and employees and is not directed to children. Consistent with our Terms of Service, the Service is intended for use by individuals who are at least 18 years old, and we do not knowingly collect data from anyone under 18.

If we make material changes to this policy, we will update the “Last updated” date above and, where appropriate, notify you in the app.

Questions about this policy or your data? Email us at privacy@certaware.ai, or write to us at:

CertAware AI, Inc.
112 North Flowers Mill Road, Suite 472
Langhorne, PA 19047

If your question is about your credit union’s use of your data, please contact your credit union directly.