Privacy Policy
Last updated: July 2026
This Privacy Policy explains how Certo ("we", "us", "our"), operated by Victor Taiwo, collects, uses, and protects your information when you use getcerto.io.
1. Who we are
Certo is a language learning tool available at getcerto.io. For the purposes of UK data protection law, we are the data controller.
Contact: contact@getcerto.io
2. What information we collect
If you create an account
- Your email address, used to create and manage your account.
- We do not store your password — authentication is handled securely by Supabase.
When you use the translation, Dictionary, and Tutor features
- Text you submit for translation, Dictionary look-ups, or Tutor conversations is sent to Anthropic's Claude API and/or Google's Gemini API to generate the response.
- Translated results may be cached in our database (Supabase) to improve performance on repeat queries. Cached translations are stored without any link to your account or identity.
- Images you upload for translation are processed by Google's Gemini API for text extraction and are not stored by us.
- Tutor conversations are not stored in our database — they exist only for the duration of your session.
Usage data (free tier)
- If you use Certo without an account, we track your daily usage count (translations, Dictionary look-ups, conjugations) locally in your browser using localStorage. This data never leaves your device.
Payment information
- If you subscribe to Certo Pro, payments are processed by Stripe. We do not store your card number or payment details — these are handled entirely by Stripe.
- We retain a record of your subscription status and payment history via Stripe.
Automatically collected data
- Basic server logs (IP address, browser type, pages visited) may be recorded by our hosting infrastructure for security and performance purposes. These are not used for tracking or advertising.
3. How we use your information
| Purpose | Legal basis |
|---|---|
| Providing the translation, Dictionary, conjugation, and Tutor services | Performance of a contract |
| Managing your account and sending account-related emails | Performance of a contract |
| Processing subscription payments | Performance of a contract |
| Improving performance via translation caching | Legitimate interests |
| Preventing abuse and maintaining security | Legitimate interests |
We do not use your data for advertising. We do not sell your data to third parties.
4. Third-party processors
We share data with the following processors to deliver our service:
| Processor | Purpose | Privacy policy |
|---|---|---|
| Anthropic | Powers translations, Dictionary entries, and Tutor conversations via Claude | anthropic.com/privacy |
| Google (Gemini) | Powers image-to-text extraction and verb conjugation | policies.google.com/privacy |
| Supabase | Database and authentication | supabase.com/privacy |
| Stripe | Payment processing | stripe.com/gb/privacy |
| Resend | Transactional email (e.g. sign-in links) | resend.com/privacy |
Text you submit is transmitted to Anthropic and/or Google for processing. Please do not submit sensitive personal information in the translation, Dictionary, or Tutor fields.
5. International transfers
Some of our processors are located outside the UK (for example, in the United States). Where your data is transferred internationally, we rely on appropriate safeguards under UK data protection law, such as the UK–US Data Bridge (where the processor is certified) or the UK International Data Transfer Agreement / UK Addendum to the EU Standard Contractual Clauses.
6. Data retention
- Account data: Retained while your account is active. Deleted within 30 days of account deletion upon request.
- Cached translations: Stored without any link to user accounts and periodically reviewed; we delete cached entries that are no longer needed for performance purposes.
- Tutor conversations: Not stored — they end with your session.
- Payment records: Retained for 7 years in accordance with UK financial regulations.
- Server logs: Retained for up to 90 days.
7. Your rights under UK GDPR
You have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Delete your data ("right to be forgotten")
- Restrict or object to our processing
- Data portability — receive your data in a machine-readable format
- Withdraw consent at any time, where any processing is based on consent (currently none of our processing relies on consent; this will apply if we introduce optional features such as marketing emails)
To exercise any of these rights, email us at contact@getcerto.io. We will respond within 30 days.
If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
8. Cookies
Certo uses only essential cookies required for authentication (e.g. session tokens). We do not use tracking, analytics, or advertising cookies.
9. Children's privacy
Certo is not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
10. Changes to this policy
We may update this policy from time to time. We will notify registered users by email if we make material changes. The "last updated" date at the top of this page will always reflect the current version.