Privacy policy

1. Who we are

V-Cert Inc. (“V-Cert”, “we”) operates v-cert.org. Our office is at 2352 Coney Island Avenue, Brooklyn, NY 11223, United States. For anything in this policy, contact info@v-cert.org.

2. What we collect, and why

Application data

When you submit the application form, we collect what the form visibly asks for: your name, company name, email address, the certifications you are interested in, your product category, an approximate SKU count and your export markets. We use this to prepare and email your quote, to answer your questions, and — if you go ahead — to run the certification itself. We also record the country your request appeared to come from (derived from your IP address by our hosting provider; we do not store the IP address in the lead record), which pricing presentation you saw, and, where present, which campaign or search ad brought you to the site.

Certification records

If your product is certified, the certificate record — company name, brand names, certified scope, certificate ID, status and validity dates — is published on our certificate portal. Public verifiability is the point of certification; this is stated in the certification agreement before anything is published.

Email

If you email us, or opt in to receive a documentation checklist or future publications, we keep the correspondence and the address you used. Every marketing-type email we send includes an unsubscribe link; certification-related correspondence is kept as part of the certification file.

Anti-abuse check

The application form may run an invisible anti-abuse verification (Cloudflare Turnstile) to filter automated submissions. It is not a puzzle CAPTCHA and does not profile you for advertising.

3. Where your data goes

• Lead storage: application submissions are stored in our lead-management records so the V-Cert Certification Team can prepare your quote and follow up. They are not sold, rented or shared with data brokers.
• Email delivery: transactional and opt-in email is sent through Resend, our email delivery provider, which processes recipient addresses on our behalf.
• Hosting: the site is served by our hosting provider, which processes technical request data (such as IP addresses) to deliver pages and maintain security logs.
• Analytics: Google (Google Analytics 4) and Microsoft (Microsoft Clarity) receive data about how the site is used, as described in section 4.
• WhatsApp messaging: if you message us on WhatsApp, or agree to hear from us there, Meta Platforms (the WhatsApp Business Platform) and Twilio Inc. carry those messages, as described in section 8.

We share personal data beyond this only if the law requires it. We never sell personal data.

4. Analytics and consent

We use two analytics tools to understand how the site is used: Google Analytics 4, implemented behind Google Consent Mode v2, and Microsoft Clarity. Clarity captures how visitors interact with our pages — clicks, taps, scrolling and mouse movement — and turns it into behavioral metrics, heatmaps and session replays, which show us where a page helps and where it gets in the way. Clarity does not capture what you type: the contents of form fields and drop-down menus are masked before anything leaves your browser.

Both tools follow your choice in the consent banner. For visitors in the European Economic Area, the United Kingdom and Switzerland, analytics is off by defaultand turns on only if you accept it: until then Google Analytics sets no cookies and Clarity is not loaded at all. We recognize these regions from your browser’s time zone; if yours does not show one, Microsoft’s own regional rule still keeps Clarity’s cookies on this site off until you consent. If you decline, Clarity stays unloaded and Google Analytics keeps its cookies off. To change your choice later, clear this site’s cookies in your browser and the banner will ask again.

Outside those regions there is no banner, and analytics runs by default. You can still opt out: Clarity is not loaded in browsers that send a Global Privacy Control signal, and any browser can block or delete these cookies. Advertising storage is denied for every visitor, and we use no advertising pixels and no remarketing tags.

Microsoft, which provides Clarity, collects and receives personal data from visitors to this site, including through its own cookies on Microsoft domains, which it sets as soon as Clarity loads, and may use it for its own purposes, including to provide Microsoft Advertising. How Microsoft collects and uses data is described in the Microsoft Privacy Statement.

5. Cookies

This site sets the following first-party cookies:

Analytics cookies, set only as described in section 4 — in the EEA, the UK and Switzerland, only after you accept them:

When Clarity loads, Microsoft also sets its own cookies on Microsoft domains, such as CLID and MUIDon clarity.ms and bing.com, for about a year. They are Microsoft’s, not ours: we cannot read or delete them, and they are governed by the Microsoft Privacy Statement linked above.

6. How long we keep data

Application data that never becomes a certification is kept while the enquiry is live and then for a limited follow-up period, after which it is deleted or anonymized. Certification files and the records behind issued certificates are retained for as long as certificate history must remain checkable — a certifier that forgets its own suspensions would be worthless. Email opt-ins are kept until you unsubscribe. Microsoft keeps Clarity session recordings for 30 days and heatmaps for up to 9 months.

7. Your rights

Depending on where you live, you may have rights to access, correct, export, restrict or delete personal data we hold about you, and to object to processing. To exercise any of them — or simply to ask us to delete your data — email info@v-cert.org from the address in question. We acknowledge requests within 2 business days. The records behind issued certificates are subject to the retention rule above, because certificate history is a legal and public-interest record. Clarity data is tied to a random ID, not to your name or email, so we cannot look it up by person; for the data Microsoft holds for its own purposes, use the Microsoft Privacy Statement.

8. WhatsApp messages

We use WhatsApp, through Meta’s official WhatsApp Business Platform, to reply when you start a conversation with us, and to send you updates about your certification file: documents we need or have received, quotes, invoices and payments, audit and certificate dates, and renewals. We message you only with your consent, which you can give in the chat itself, on one of our forms, or when you speak with us.

Two providers carry these messages: Meta Platforms, which operates the WhatsApp Business Platform, and Twilio Inc., through which we send and receive them. The content of the messages, your phone number, your name and any files we exchange are stored in our customer relationship management (CRM) system so the V-Cert Certification Team can serve you, and are kept with your certification file. Meta and Twilio process this information under their own terms and data processing agreements, which may involve transferring it to the United States.

We do not send marketing messages on WhatsApp unless you have separately agreed to receive them, and we never sell phone numbers. To stop our WhatsApp messages, reply STOP at any time; reply START to receive them again. If you write to us again after replying STOP, we can still answer you. You can also email info@v-cert.org and we will stop them for you.

9. Changes

When this policy changes, the date at the top changes with it, and material changes are noted on this page. We do not retroactively expand what we collect without saying so.

18 October 2026: we added WhatsApp messages (section 8, with a line in section 3).

13 October 2026: we added Microsoft Clarity (sections 3 to 7).