CredentialVault Privacy Policy

This Privacy Policy explains how Goldenstandards LLC ("CredentialVault," "we," "us") collects, uses, and protects information when you use the CredentialVault platform at credentialvaults.com (the "Service").

CredentialVault is a credential issuance and verification platform. Because of what the Service does, this policy covers four different groups of people, and what applies to you depends on which group you're in:

• Organization users — administrators and staff at issuing organizations (training providers, schools, certification bodies) who hold accounts on the Service.
• Credential recipients — individuals whose credentials are issued and recorded on the Service by an issuing organization.
• Verifiers — anyone who uses the public verification page to check a credential.
• Prospective customers — people who contact us or request a demo through the Service.

1. Information We Collect

From organization users (account holders):

• Name, email address, and role within your organization
• Organization details (name, contact information)
• Account and subscription details, including billing status
• Actions you take in the Service (credential issuance, revocations, imports, and similar administrative actions), which are recorded in audit logs
• Communications you send us (support requests, feedback)

About credential recipients (provided by issuing organizations):

• Name and email address
• Credential details: credential title and type, issuing organization, issue date, expiration date, and status (including revocation status and reason category where applicable)
• Other recipient details an organization chooses to record (for example, graduation year or an internal ID)

Important: Recipient information is provided to us by the issuing organization, not collected directly from recipients. The issuing organization is responsible for having a lawful basis to share this information with us.

From verifiers (public verification page):

• The verification code entered and the result of the lookup
• Date and time of the verification attempt
• Basic technical information sent by your browser (such as IP address), as collected by our hosting infrastructure

We log verification attempts — including failed ones — so issuing organizations can monitor how their credentials are being checked and detect misuse.

From prospective customers (demo requests and inquiries):

• Name, email, and phone number you provide
• Your organization's name, type, and approximate size
• Anything you tell us about what you're trying to solve

We use this information only to respond to your inquiry and to understand who is interested in the Service. We do not sell it or use it for advertising.

We do not collect: payment card details directly. When a paid subscription is active, payments are handled by our third-party payment processor (Stripe), which collects and processes card details under its own privacy policy; we receive only limited billing information such as subscription status and the last four digits of a card. We do not use advertising trackers, and we do not sell any information.

2. How We Use Information

• To operate the Service: issuing, storing, displaying, and verifying credentials
• To send transactional email on behalf of issuing organizations — for example, delivering a credential and its verification code to a recipient, and sending automated reminders to recipients when a credential is approaching its expiration date
• To create and manage organization accounts, including self-service signup and staff invitations
• To maintain audit trails of administrative actions, which is a core integrity feature of the Service
• To manage subscriptions and billing
• To respond to support requests and demo inquiries
• To secure the Service, investigate misuse, and enforce access controls
• To comply with legal obligations

We do not use your information for advertising, and we do not sell or rent personal information to anyone.

3. Our Role in Handling Recipient Data

For credential recipient information, CredentialVault acts as a service provider processing data on behalf of the issuing organization. The issuing organization decides what recipient data to enter, whom to issue credentials to, when to send them, and when to revoke them. If you are a credential recipient and want your information corrected or removed, your first point of contact is the organization that issued your credential; we will support their instructions. You may also contact us directly (Section 9), and we will route your request appropriately.

4. What the Public Can See

The public verification page displays credential information only to someone who enters a valid verification code. A successful lookup shows: recipient name, credential title and type, issuing organization, issue and expiration dates, and current status (valid, expired, revoked, or restricted). For revoked credentials, the revocation date and a general reason category are shown; internal notes are never displayed publicly.

Sharing a verification code is how a recipient chooses to let someone verify their credential. Anyone who does not have the code cannot look up or browse credentials.

5. Who We Share Information With

We share information only with service providers necessary to operate the platform:

• Hosting and infrastructure: the Service is built and hosted on Base44, which stores application data on our behalf on Google Cloud Platform infrastructure
• Email delivery: transactional and notification emails are sent via Resend
• Payment processing: paid subscriptions are processed by Stripe, which handles card data directly

These providers process data under their own security and privacy commitments and only to provide their services to us. We may also disclose information if required by law, or to protect the rights, safety, or integrity of the Service and its users.

6. Data Retention

• Credential records are retained for as long as the issuing organization maintains them on the Service, because ongoing verifiability is the purpose of the platform.
• Audit logs and verification logs are retained for the life of the associated organization account, as they form the integrity record of the Service.
• Account and billing information is retained while an account is active and for a reasonable period afterward as required for legal, tax, and operational purposes.
• Demo requests and inquiries are retained for a reasonable period to follow up and for our own record of interest in the Service.

When an issuing organization closes its account, we will work with the organization on export and deletion of its data, subject to any legal retention requirements.

7. Security

We take the security of credential data seriously. Measures include role-based access controls, organization-level data isolation (users of one organization cannot access another organization's records), server-side enforcement of all data writes, and audit logging of administrative actions. No system is perfectly secure, but security is a core design requirement of this Service, not an afterthought.

8. Children

The Service is not directed at children under 13, and we do not knowingly collect information from children under 13. Issuing organizations that record credentials for minors (for example, a training program with students under 18) are responsible for ensuring they have the appropriate authority or consent to do so.

9. Your Choices and Rights

Depending on where you live, you may have rights to access, correct, or delete personal information about you, or to object to certain processing. To exercise these rights:

• Organization users and prospective customers: contact us directly at Hello@CredentialVaults.com
• Credential recipients: contact your issuing organization, or contact us and we will coordinate with them

Note that some deletion requests interact with the integrity purpose of the Service: for example, the fact that a credential was issued and later revoked may be retained in audit records even where personal details are removed or anonymized.

10. Where Data Is Processed

The Service is operated from the United States. Application data is hosted on Google Cloud Platform infrastructure through our platform provider, Base44. If you access the Service from outside the United States, you understand that your information may be transferred to and processed in the United States or other locations where our infrastructure providers operate.

11. Changes to This Policy

We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above, and where appropriate we will notify organization account holders by email.

12. Contact

Questions or requests about this policy:

Goldenstandards LLC

Hello@CredentialVaults.com

© 2026 Goldenstandards LLC