Privacy Policy
1. Responsible party
Ndlovu Group PTY LTD (Reg No 2026/091534/07), trading as CertPilot AI, is the responsible party under South Africa's Protection of Personal Information Act (POPIA) and, where applicable, the data controller under the EU/UK GDPR. Our Information Officer is reachable at privacy@certpilotai.com.
2. What we collect
| Data | Purpose |
|---|---|
| Email address (waitlist/account) | Service delivery, account access, and opt-in product updates |
| Quiz answers & performance data | Adaptive question selection and readiness scoring |
| Questions pasted into the Exam Decoder | Processed via Anthropic's API to generate your decode |
| Hashed IP address | Rate limiting and abuse prevention |
| Analytics events (pages viewed, referral source, device and browser, approximate location from a truncated IP address, and account sign-ups) | Understanding and improving the product, and measuring how effective our advertising is — collected by Google Analytics 4 and only after you accept analytics cookies |
3. Lawful bases for processing
We process your data based on: your consent (e.g. joining the waitlist, marketing emails, analytics cookies); the performance of our contract with you (e.g. running your account and generating your readiness score); and our legitimate interest in keeping the Service secure and free of abuse (e.g. rate limiting).
4. Third parties & processors
| Processor | Role |
|---|---|
| Supabase | Database hosting, authentication, and file storage |
| Anthropic | Processing pasted questions to generate Exam Decoder results and AI explanations |
| Google LLC (Google Analytics 4) | Website analytics and advertising measurement — pages viewed, referral source, device and approximate location, and account sign-ups — only after you accept analytics cookies |
5. Cross-border transfers
Our infrastructure providers may host and process data outside South Africa. Where we transfer personal information across borders, we rely on POPIA section 72 — either because the recipient is subject to laws or contractual terms that provide adequate protection, or because you have consented to the transfer.
6. Retention periods
- Account and quiz data: retained for as long as your account is active, deleted within 90 days of account closure;
- Waitlist entries (no account created): retained for up to 24 months or until you unsubscribe;
- Decoder submissions: cached content is de-identified where possible and retained to avoid re-processing cost, not linked to your identity unless you are logged in;
- Rate-limiting logs (hashed IP): retained for up to 30 days.
7. Your rights
Under POPIA and, where applicable, the GDPR, you have the right to access, correct, or delete your personal information, object to or restrict its processing, and withdraw any consent you have given. To exercise any of these rights, email us at privacy@certpilotai.com.
You also have the right to complain to South Africa's Information Regulator.
8. Marketing
We only send marketing emails to people who have opted in. Every marketing email includes a one-click way to unsubscribe.
10. Children
The Service is not directed at, and is not intended for use by, anyone under 18 years old.
11. Security
We use industry-standard measures to protect your data, including encryption of data in transit, row-level security policies restricting access to your own records, and access controls limiting who at CertPilot AI can view raw data.
12. Changes & contact
We may update this Privacy Policy from time to time; material changes will be notified by email. Questions? Email privacy@certpilotai.com.