We respect your privacy and protect any personal information you share with us. This policy describes the information Custify SRL ("we", "us") collects from you on Custify Academy at custify.com/academy (the "Academy"), and what we do with it. The Custify privacy policy at custify.com/privacy covers the rest of custify.com and the Custify product.
Information recorded and use
A. Information you submit
We collect personal information when you create an account, buy a course, redeem a coupon, post a question under a lesson or leave a review. This is your name, email address, optional company, password (stored only as a hash by our authentication provider) and, when you pay, the billing name, address and VAT number for the invoice. Card details go to Stripe and never reach us. If you sign in with Google, we receive your name and email address from Google and nothing else.
B. Information collected automatically
As you use the Academy we record which lessons you completed, your quiz answers and scores, your questions and reviews, when you last visited, and the technical details of your browser and device. Your IP address is kept for a short time to limit repeated sign-in and coupon attempts.
C. Cookies
The Academy sets only the cookies it needs to work: one that keeps you signed in, one that remembers your light or dark player theme, and two short-lived ones used during Google sign-in. They need no consent. Analytics and advertising cookies are set only after you accept them in the cookie banner. If you decline, nothing but the essential cookies is loaded. You can change that choice at any time from the Cookie settings link in the footer; your choice is kept for 12 months.
D. Third party analytics and tracking
Loaded through Google Tag Manager, only after consent:
- Google Analytics 4 (Google Ireland Limited): how the Academy pages are used. Cookies and usage data. Place of processing: EU and United States. Policy: policies.google.com/privacy.
- Google Ads conversion tracking (Google Ireland Limited): connects a purchase to a Google ad you may have clicked.
- Meta pixel (Meta Platforms Ireland): conversion tracking and audiences for Facebook and Instagram ads.
- LinkedIn Insight Tag (LinkedIn Ireland): conversion tracking and retargeting on LinkedIn.
- HubSpot: connects your visit to a HubSpot contact record if you already are one.
- Microsoft Clarity (Microsoft Ireland): pseudonymised session recordings and heatmaps.
E. Use of collected information
We use the information above to run your account, unlock lessons in order, grade quizzes, issue your certificate, answer your questions, deliver and invoice what you bought, keep the Academy secure, and improve it. We email you when your account is created, when you are enrolled, when your certificate is issued and when you ask for a password reset; these emails are part of the service, not marketing, and Academy accounts are not added to marketing lists. We do not sell your data and make no automated decisions with legal effects about you.
F. Service providers
These companies process data for us, on our instructions: Supabase (database and login, Frankfurt), Vercel (hosting, Frankfurt), Stripe (payments and invoices), Resend (email, Ireland), Adilo by BigCommand (video), Google (sign-in and the tags above), and Meta, LinkedIn, HubSpot and Microsoft for the tags above. Where a provider is outside the European Economic Area, transfers rest on the European Commission's adequacy decisions, including the EU-US Data Privacy Framework, or on Standard Contractual Clauses.
What is public
Your review, with your name, appears on the course page. Your certificate has a public verification page showing your name, company if entered, the course, the date and the score; anyone with the link can view it and it may be found through search engines. That is what makes the certificate verifiable. You can ask us to take the page offline at any time.
How long we keep it
Your account and progress for as long as you keep the account, and 30 days after you ask us to delete it. Certificate records for 10 years, so the certificate stays verifiable. Payment and invoice records for 10 years, as Romanian accounting law requires. Security logs for 30 days.
Use of the Academy by children
The Academy is not intended for people under 18 years of age. We do not knowingly collect personal information from anyone younger.
Information security
Data travels encrypted and is stored encrypted at rest by our providers. Passwords are hashed. Access to the database is limited to the application and to named Custify staff. No system is perfectly secure; if a breach affects your data, we will tell you as the law requires.
Notification of changes to this privacy policy
We may update this policy at any time. Changes are posted on this page with a new date at the top. If we ever intend to use your personal information in a way materially different from the one stated when it was collected, we will notify you by email first.
Owner and data controller
Custify SRL, Zagazului Street No. 4E, Entrance A, First Floor, ap. 1A, District 1, Bucharest, Romania, Tax ID RO38229657. Owner contact email: contact@custify.com.
Change or removal of personal information
You can change your name, company and password on your account page, and edit or delete your review. For anything else, write to contact@custify.com. Under the GDPR you have the right of access, the right to rectification or erasure, the right to restriction of processing, the right to withdraw consent, the right to object, the right not to be subject to a decision based solely on automated processing, the right to data portability, and the right to lodge a complaint with your data protection authority, including ANSPDCP in Romania. The short version, with how to use each right, is on our Your data page at custify.com/academy/your-data.