Privacy policy

Last updated: 4 October 2026

In short: your spreadsheet and the certificates are processed in your browser and are not sent to us. If you turn on online verification for a batch, we store only each certificate’s ID, recipient name, title, issuer and date.

Who we are

CertSheet is operated by Stephen Lue-Yen, Kingston, Jamaica. Contact: support@certsheet.com.

Data that stays on your device

Spreadsheets, backgrounds, field layouts and the generated PDFs are handled entirely in your browser. Your design settings, licence key and issuer name are saved in your browser’s local storage so the app remembers them; you can clear them with your browser’s site data settings or the “Remove key” button.

Data we store

Online verification (opt-in, per batch, paid plans). For each certificate in a batch you publish: certificate ID, recipient name, title, issuer name and date. For the batch: a one-way hash (SHA-256) of the licence key used, so only that key can list or revoke it, plus the batch title, certificate count and publish time. These details are shown publicly to anyone who has a certificate’s ID or QR code. Verification pages ask search engines not to index them.
Issuing confirmations (paid plans). Before each batch you tick “I'm issuing these for my own course or event, or I'm authorized by the organization named on them.” For paid plans we store that you ticked it: the statement, the time (from your browser and our server), the number of certificates, the issuer name you entered and the licence key hash. No recipient data is included. On the Free plan the tick isn't sent anywhere.
Misuse reports and enforcement. If you email a report, we keep it and our reply to investigate. If an account is ended under our acceptable use rules, we keep the licence key hash on a blocklist so the key stays disabled.
Licence checks. When you enter a licence key, our server sends it to Polar to confirm it is valid. We cache the result against a SHA-256 hash of the key, not the key itself.
Welcome and licence key emails. After you buy, our server fetches your licence key and email address from Polar and emails you the key through Resend. If you use the Lost your key? form, we look the address up in Polar the same way. We don't keep your address or key: we log only Polar's ID for the key and when the email was sent, plus hashed counters (of your IP address and the email typed) to limit repeat requests. The welcome page after checkout shows your key and saves it in your browser.
Server logs. Our host, Cloudflare, processes standard request data (such as IP address, browser type and the page requested) to deliver and secure the site. We use these logs only for operations and security. We do not use advertising or analytics cookies.

Payments

Polar is our merchant of record. When you buy, Polar collects your name, email, billing address and payment details under Polar’s privacy policy. We can see your order and email in Polar so we can provide support and refunds. We never see your full card details.

Processors

Cloudflare, Inc.: hosting, the verification database (D1) and network security.
Polar Software, Inc.: payments, licence keys and receipts.
Resend (Plus Five Five, Inc.): sending welcome and licence key emails.

Retention and deletion

Verification records are kept so certificates keep verifying, until you ask us to delete them. Issuing confirmations are kept for as long as any batch they cover is on record, and for at least 2 years, so misuse reports can be investigated. Revoking a batch marks it revoked but keeps the record, so the page can say the certificate was revoked. Issuers can have records deleted by emailing support@certsheet.com from the purchase email address, saying which batch or certificate IDs. Cached licence results are overwritten at each re-check.

If you are named on a certificate

Anyone named on a certificate can have its verification record removed. Email support@certsheet.com with the certificate ID (printed on the certificate, or the code after /v/ in the QR link). We delete the record, so the verification page stops showing your details, and we tell the issuer that it was removed at the recipient’s request. The PDF certificate you were given isn’t affected.

Your rights

Depending on where you live, including under Jamaica’s Data Protection Act, 2020, you may have rights to access, correct or delete personal data about you, and to object to its processing. If you are a certificate recipient, you can have your verification record removed as described above; to correct a certificate, contact the organisation that issued it.

Children

CertSheet is a tool for organisations and adults. Issuers who publish certificates for minors for online verification are responsible for having appropriate consent.

Changes

We will post any changes on this page and update the date above.