CertPing

Legal

Privacy

CertPing is a certificate vault and expiry reminder service for UK trades. This page explains what we collect, why, where it lives, and your rights. Plain English first — the law we follow is UK GDPR and the Data Protection Act 2018.

Last updated: 26 September 2026

Who we are

CertPing is operated by Phil Stone. For data protection, Phil is the data controller — the person who decides why and how your information is processed. Trading address: 2 Hazelgrove Avenue, Craigavon, BT66 7TF, Northern Ireland. Not VAT registered. Contact: hello@certping.co.uk or the contact form. Website: certping.co.uk.

What this policy covers

This policy applies when you use certping.co.uk, sign in, store company records, receive reminder emails, or pay for a plan. It does not cover other websites we link to (for example Stripe’s checkout or philstone.co.uk). Those services have their own policies.

What we collect

We only collect what we need to run reminders, the vault, and billing.

  • Account and sign-in — email address and password (stored by Amazon Cognito; we do not store your password in plain text). Session tokens sit in your browser’s local storage while you are signed in.
  • Company profile — company name, optional logo, plan, reminder settings (lead days, daily overdue pings), billing status, trial dates, and which certificate types you track.
  • People — names, optional email addresses, role, trade, start date, and links to their certificates.
  • Certificates and files — ticket type, reference or number, issued and expiry dates, notes, and files you upload (PDFs, photos). These may contain personal data about your crew — you control what you upload.
  • Reminders — which emails were sent, when, and for which certificate, so we do not spam the same ping twice. Addresses that use one-click unsubscribe are stored so we stop emailing them.
  • Payments — Stripe processes card payments and subscriptions. We store your Stripe customer and subscription IDs, not your full card number.
  • Contact messages — if you use the contact form: name, email, message, and a simple anti-spam check. We use these to reply, not for marketing lists.
  • Technical logs — standard server logs from AWS (IP address, request time, errors) for security and debugging. We do not use them to profile you for advertising.

Demo mode: if you open the vault without signing in, data stays on your device (browser storage) until you clear it. It is not sent to our servers until you create a cloud account.

Why we use your data

  • To provide the service (contract) — store records, show the dashboard and matrix, attach files, send expiry reminders, run billing, and keep your account working.
  • Legitimate interests — keep the site secure, fix bugs, understand aggregate usage, and write back when you contact us. We balance this against your rights; reminder emails go only to addresses you or your company entered for that purpose.
  • Legal obligation — keep records tax and accounting rules may require (for example payment records via Stripe).

We do not sell your list. We do not run third-party advertising on CertPing.

Reminder emails and unsubscribe

Reminder emails go to addresses stored on people records or your company account — at 90, 60, 30, 14, 7, 3, and 1 day before expiry, on the day, and daily after a date has lapsed until you update it. Each message includes a one-click unsubscribe link (List-Unsubscribe). If someone unsubscribes, we stop pinging that inbox for that company; your account holder can still use the vault. Unsubscribe is for reminder mail, not a full account deletion — email us if you want the company removed.

Where data is stored

Signed-in company data is hosted on Amazon Web Services in the EU (London, eu-west-2) — database records and private file storage for certificates. Emails are sent through Amazon SES. Authentication uses Amazon Cognito. Payments use Stripe (Stripe may process data in the UK, EU, or US under their own safeguards).

We choose EU hosting so UK and EEA customer data stays close. Where a processor transfers data outside the UK, we rely on their contractual protections (for example UK IDTA-style terms or adequacy decisions) as applicable.

Who we share data with

We share data only with service providers that help us run CertPing, under contract:

  • Amazon Web Services — hosting, email, authentication
  • Stripe — subscriptions and invoices
  • Cloudflare — cookie-free web analytics on public pages (aggregate page views only)

We may also disclose information if required by law, court order, or to protect rights, safety, and security. We do not share your certificate files with main contractors — you choose when to export or print a pack.

How long we keep data

  • Active accounts — while you use CertPing and have a live or read-only vault we keep your company records and files so the service works.
  • After cancellation — if you cancel and do not return, we aim to delete cloud company data within a reasonable period unless we must keep it for legal, tax, or dispute reasons. Email us to request deletion sooner.
  • Contact form — kept long enough to resolve your message, then deleted or anonymised unless we need a record of support.
  • Server logs — typically rolled off after a short retention window unless needed for a security investigation.
  • Stripe — billing records follow Stripe’s and HMRC’s retention rules.

Security

Files sit in a private bucket scoped to your company. Downloads use short-lived signed links, not public URLs. Traffic is encrypted in transit (HTTPS). Access to production systems is limited to what is needed to operate the service. No system is perfectly secure — use a strong password and do not share sign-in details across the crew.

Your rights

Under UK data protection law you may have the right to:

  • access a copy of your personal data
  • correct inaccurate data
  • delete data in certain circumstances
  • restrict or object to processing in certain circumstances
  • data portability for data you provided, where applicable
  • withdraw consent where processing is based on consent (not usually needed for core CertPing use)

Email hello@certping.co.uk to exercise these rights. We may need to verify you control the account. You can also complain to the Information Commissioner’s Office (ICO) if you are unhappy with how we handle data.

Cookies and local storage

CertPing is not ad-supported. Public pages use Cloudflare Web Analytics, which is cookie-free, collects no personal data, and records aggregate page views only. We use browser local storage for sign-in tokens, your org id, and (in demo mode) vault data on your device. The site may install a service worker so it loads faster as a PWA — that caches static files, not a tracking profile. Stripe checkout may set its own cookies when you pay.

Children

CertPing is a business tool for companies and tradespeople. It is not aimed at under-18s. Do not create an account for a child; certificate records about workers should follow your own HR and legal obligations.

Changes

We may update this policy when the product or law changes. We will post the new date at the top. Significant changes for active customers will be communicated where practical (for example by email or a notice in the app).

Questions

hello@certping.co.uk · Contact · Terms · Help