Privacy Policy

myCertGate is operated by Abdul Moeed, trading as myCertGate, who is the data controller for account, website, billing-contact and support data described here. For data your workspace uploads about your vendors, you are the controller and we process it on your behalf.

• Account data — name, email, company and role of workspace users.
• Compliance documents — COIs, licenses, lien waivers and W-9s uploaded by you or your vendors.
• Tax IDs — stored masked; only the last four digits are kept visible.
• Activity records — audit history of changes, approvals and sends.
• Support data — tickets and messages you send us.
• Usage and device data — pages visited, browser type, device identifiers and IP address, used for security and to understand how the site is used.

• To run the service: read documents, check compliance rules and control payment holds.
• To send emails you trigger — or Auto Alerts only if your workspace turns them on.
• To provide support and keep the platform secure.
• We never sell your data or use it for advertising.

Uploaded certificates are read by AI on our servers, never on your device. Extracted results are stored with the document for your review; nothing is approved automatically.

• Service providers — hosting, storage, email delivery, analytics and AI processing, bound by confidentiality and security obligations.
• Paddle (Merchant of Record) — Paddle.com sells our subscriptions and handles payments, subscription management, tax compliance and invoicing. Paddle processes your billing data under its own privacy notice.
• Professional advisers — such as lawyers and accountants, where needed.
• Authorities — only where required by law.

Workspaces are isolated at the database level, data is encrypted in transit and at rest, and staff access requires two-step verification and is logged. See our Security page for details.

Compliance records are kept for as long as your workspace exists, because they may be needed as legal evidence. You can request export or deletion of your workspace data by contacting us. Account and support data are deleted or anonymised once no longer needed for the service, security or legal obligations.

Depending on where you live, you may have rights to access, correct, export, restrict or delete your personal data, object to processing, withdraw consent, and complain to your local data protection authority. We respond within one month. Vendors should contact the business that invited them first.

We use essential cookies and local storage to sign you in and keep your session secure, and analytics cookies (Google Analytics) to count visits and see which pages are useful. We do not use advertising cookies. You can block or delete cookies in your browser settings; essential cookies are needed for sign-in to work.

Where these laws apply, we process account data to perform our contract with you, security and audit data under our legitimate interest in protecting the service, and marketing contact data only with your consent. Vendor data in your workspace is processed on your instructions under a data processing agreement, available on request.

• Cloud hosting & database — application hosting, storage and backups.
• Edge network — content delivery and DDoS protection.
• Email delivery — sending emails you trigger or opt into.
• AI model providers — reading uploaded certificates; data is not used to train their models.
• Payments (when billing goes live) — card processing; we never store card numbers.

Data may be processed in the United States and other countries. Where required, we rely on Standard Contractual Clauses or equivalent safeguards.

California residents may request to know, correct or delete personal information and to opt out of sale or sharing. We do not sell or share personal information for cross-context advertising, and we will not discriminate against you for exercising these rights.

myCertGate is a business service and is not directed to anyone under 16. We do not knowingly collect children's data.

If a breach affects your data, we will notify affected workspace admins without undue delay and as required by law.

We will post updates here with a new date and notify workspace admins in the app of material changes. Each sign-up records which version was accepted.

Privacy questions: privacy@mycertgate.com.