Last updated: 1 November 2026.
This policy explains what personal data CertDirectory collects, why, who it is shared with, how long it is kept, and the rights you have. It applies to certdirectory.io and to the emails we send.
Who we are and how to contact us
CertDirectory (certdirectory.io) is responsible for your personal data as the data controller. We are based in the United Kingdom, and UK data protection law (the UK GDPR and the Data Protection Act 2018) applies. The EU GDPR also applies to members in the European Union.
For anything about your personal data, email privacy@certdirectory.io.
What we collect
When you sign in. You sign in with Google, GitHub or LinkedIn. We receive your name, your email address and whether the provider has verified it, your profile photo, and the provider's id for your account. We never receive your password.
What you add. Everything you put on your profile:
- your headline, bio, links, country and availability;
- your work and education;
- your goals and roadmap;
- your services and Spotlight posts.
Also what you write or do on the site:
- blog posts and comments;
- feed posts, comments and reactions;
- mentoring requests, notes and wrap-ups;
- messages to other members;
- company, school and group memberships, and event RSVPs;
- ownership claims, invitations you send, reports you make;
- your settings.
Your certifications. If you connect Credly, Microsoft Learn or CertDirectory Credentials, we copy the public record of your certifications from them, and refresh it when you sync.
Your devices. For each signed-in device we keep the browser's name, when it signed in and when it was last used. We do not keep your IP address: we keep only a one-way, keyed code made from it, which lets us spot abuse without knowing the address.
Visitors. If you are not signed in, we collect nothing about you, except:
- if you ask a member's AI clone a question (see below);
- a count, with no personal data, when you follow a discount link.
Invitations. If a member invites you to a company, school or group page by email, we keep your email address to send the invitation. It is deleted 30 days after the invitation is used, declined or expires.
How we use it, and why we may
| What we do | Our legal basis |
|---|---|
| Run your account, show your profile and provide the features you use (mentoring, messages, communities, events, the blog, the feed, your AI clone, developer keys) | Providing the service you signed up for (contract) |
| Send emails about your account and activity, such as a new mentoring request or an unread message | Contract, and for optional emails, the choices you make in Settings |
| Keep the site safe: limit abuse, investigate reports, keep an audit record of sensitive actions | Our legitimate interest in a safe and working service |
| Let search engines list your profile, if you allow it | Your choice in Settings, which you can change at any time |
| Count clicks on discount links (no personal data) | Our legitimate interest in knowing which discounts are useful |
We do not sell personal data, show advertising, or use advertising or tracking cookies.
What is public
Your profile is public. That means:
- your name, photo, headline, bio and links;
- your work and education;
- your certifications;
- the other tabs you choose to show.
You decide which optional tabs visitors see. You also decide whether search engines may list your profile.
Never public:
- your email address;
- your messages;
- your private mentoring notes;
- your settings.
Developer API. Developers with an API key can read the certifications on a profile, exactly as a visitor sees them. If you hide your Credentials tab, the API does not return them.
What others see of your activity: posts you publish, comments, feed activity and RSVPs on public events are visible to other members and, for public pages, to visitors.
Your GitHub link: contribution chart and CNCF
If you add a GitHub link to your profile, your profile also shows your public open source activity. All of it comes from public GitHub information, and none of it appears without the link. Remove the link to turn all three off.
- Contribution chart. A picture of your public GitHub contributions over the last year. It is drawn by ghchart.rshah.org, an independent service. When someone opens your profile, their browser loads the picture directly from that service. The service then receives their IP address and browser details, and your GitHub username.
- CNCF DevStats score. Our server asks CNCF DevStats (devstats.cncf.io, run by the Cloud Native Computing Foundation) for your contribution count. We send only your GitHub username, and we keep the answer for up to a day.
- CNCF contributor card. Only when a visitor presses the CNCF button, their browser loads your card from contribcard.cncf.io, also run by the Cloud Native Computing Foundation. That site then receives their IP address and browser details, and your GitHub username.
These services are not our providers and do not act on our instructions. Their own privacy policies apply, and they may keep their own logs or set their own cookies.
Mentoring
Mentoring workspaces are private to the mentor and mentee. Your notes are private to you. An administrator can open a workspace only to deal with a report or a safety concern. They must state the reason each time, and every access is recorded in our audit log.
Messages
Messages are stored with our hosting provider in the United Kingdom, and only the two members in a conversation can read them. If you report a conversation, the messages you report are kept for the review.
Your AI clone, and asking another member's clone
If you set up an AI clone, it answers visitors' questions about your public profile. The questions and answers go to the AI provider you chose, using your own key, under that provider's terms. Your key is stored encrypted, and is never shown or exported.
If you ask a member's clone a question:
- the question and answer are kept for 30 days so you can rate or report the answer, then deleted;
- a reported answer is kept until it is reviewed;
- the member sees a question only if it was reported, and never who asked;
- to apply the daily limit fairly, we use a random id in a cookie and a keyed code made from your address (never the address itself).
Do not share personal information with a clone.
Who we share data with
We use these service providers to run the site. They process data only on our instructions:
- A cloud hosting provider: hosting, the database, file storage, messages and logs, in the United Kingdom.
- An email delivery provider: sending email, in the United Kingdom.
Separately:
- Sign-in providers (Google, GitHub, LinkedIn) are independent of us. Their own privacy policies apply to your account with them.
- AI providers: when you use your AI clone, the provider you chose processes the questions under your own account with them.
- Open source activity services (ghchart.rshah.org, CNCF DevStats and contribcard.cncf.io): only if you add a GitHub link. They receive your GitHub username, and visitors' browsers connect to the chart and the card directly. See Your GitHub link.
We share personal data with others only if the law requires it.
Where your data is stored. Your data is stored in the United Kingdom. Our providers may access it from elsewhere for support or security. Where they do, they protect it with safeguards approved under UK law, such as the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.
How long we keep data
| Data | How long |
|---|---|
| Your account and profile | Until you delete your account |
| Signed-in devices | Until you sign out, or at most 30 days (7 days without a visit) |
| Questions to AI clones | 30 days, unless reported |
| In-app notifications | 90 days after you read them |
| Emails we sent you | The content: 30 days. A record of which email was sent: 1 year |
| Invitations by email | 30 days after they are used, declined or expire |
| Messages | Until both people delete the conversation, or 30 days after either account is deleted |
| Audit record of sensitive actions | 12 months; then the member ids in it are replaced by random ids, and it is deleted after 36 months |
| Server logs | 30 days (they contain no IP addresses, email addresses or message text) |
| Backups | Up to 14 days |
Downloading your data
In Settings > Account, Download my data gives you a ZIP of your personal data as JSON files, with the photos and images you uploaded. It includes the messages you sent. Messages others sent you are not included: they are theirs.
Deleting your account
In Settings > Account, Delete my account:
- At once: your profile is hidden and every device is signed out.
- After 14 days: your account and data are deleted. If you sign in again before then, the deletion is cancelled.
What happens to each kind of data when the deletion completes:
- Your profile, photos, certifications, posts, comments, reactions, memberships and settings are deleted.
- In a mentorship, your private notes and messages are deleted. The other person keeps their own record of the mentorship, and you are shown as "Former member".
- Conversations with you are removed for both people 30 days after the deletion.
- The audit record keeps the actions, but your member id is replaced by a random id.
- Your old profile address answers that the profile was deleted.
You can also ask us to delete your account by emailing privacy@certdirectory.io.
Your rights
You have the right to:
- Access your data. The download in Settings covers most of it; ask us for anything else.
- Correct it. Most of it you can edit yourself.
- Delete it.
- Restrict how we use it, or object to our use based on legitimate interests.
- Take it with you: the download is in a machine-readable format.
- Withdraw consent where we rely on it, for example by turning off search listing or optional emails.
Email privacy@certdirectory.io to use any of these rights. We answer within one month.
If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to put it right first.
Cookies
We use only the cookies the site needs, plus one that remembers your theme. Content that profiles load from other sites (the GitHub contribution chart and the CNCF card) comes with those sites' own terms. See the cookie notice.
Children
CertDirectory is for people aged 16 and over. If you are under 16, please do not create an account.
Security
- Sessions are kept on our servers, and your browser holds only a random token.
- The site is served over HTTPS only.
- AI clone keys are encrypted, and the keys that protect them are held in a separate, access-controlled key management service.
- Access to the systems is limited and logged.
No system is perfectly secure. If a breach affects your data, we will tell you and the ICO as the law requires.
Changes to this policy
When we change this policy, we update the date at the top. If a change affects how we use your data in a significant way, we tell members by email or on the site before it takes effect.