certo.bio
Register
Privacy & data

Your data, in writing.

What certo keeps, who can read it, how every read is logged, and what is never stored. Each rule here is enforced by the platform, not left to a policy.

  • EU AI Act compliant
  • GDPR
  • Made in the EU
EU AI Act

A model suggests. A person decides.

  • A language model may read a CV you import or an organisation’s reply, and propose what it says.
  • It never records a verdict. A person does, and the passport names who confirmed what.
  • Prompts and answers never reach analytics; only counts, timings and costs do.
  • Your photo is compared with your identity check only after you consent to it.
  • A question you ask the help assistant goes to a language model with the matching help pages, to write the answer. Neither the question nor the answer is kept.
GDPR

Yours to see, export and erase.

  • Contact details, right to work and nationality stay private until you approve a reader.
  • Every read of private data is logged in the same step as the read, and you see which organisation opened it.
  • Download everything certo holds about you, with your photos, documents and certificates, as one zip file.
  • Erase your account: certificates are revoked and your identity, contacts, files and records are deleted. What stays, and why, is listed below.
Made in the EU

Designed and built in the European Union.

  • certo is designed and built in the EU, under EU data-protection law.
  • Each outside provider that handles personal data is listed below, with what it receives.
Who is responsible

The company that decides how your data is used

FreshMint ai OÜ, a private limited company registered in the Estonian e-Business Register under code 16904979, at Sepapaja tn 6, 11415 Tallinn, Estonia, runs certo.bio and is responsible for your data (the data controller).

Write to support@certo.bio for anything about your data: to see it, correct it, take it with you, erase it or object to how it is used. We answer within one month.

You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), or to the data protection authority where you live. www.aki.ee/en

Who reads what

Three levels, each with its own door.

  1. 01AnyoneThe public page: your name, headline and place, a photo matched to your identity check, that your identity was checked (document type, country, date), residence and languages, and your records without their verdicts. Nothing is logged, because there is nobody to name.
  2. 02Readers you approveThe verdicts, plus the contact details and files you chose. Every read is logged as it happens; a read that cannot be logged does not happen. A file opens for ten minutes at a time.
  3. 03You, and certoYour own reads are not logged. certo staff open identity evidence or a reply only on the review desk, and you see each opening as certo.
Data handling

Each kind of data, in detail.

What certo stores, what it never stores, who sees it and how long it is kept, for everything a passport is made of.

Identity check (KYC)

You photograph your document and take a selfie on the identity provider’s page. certo never sees the capture; it receives the result.

What we store
  • The result: passed or not, the level of assurance and the date.
  • Document type, issuing country and expiry date.
  • Your name as the document gives it.
  • Your date of birth, encrypted with a key held outside the database.
  • A one-way digest of the document number, so one document cannot open two passports.
What we never store
  • Images of your document or your face.
  • The document number itself.
  • Your gender.
  • The provider’s full report: it is read once and dropped.
Who sees it

Anyone sees that you were checked: the document type, its country and the date. When a check is held for review, certo staff see the provider’s report, images included, fetched live and never saved; the opening is logged and shown to you.

How long

Until you erase your account. The check is valid for two years. The identity provider keeps the session under its own retention terms.

Profile photo

A photo on a checked passport is shown only once it matches the face your identity check verified. The comparison runs only after you consent to it.

What we store
  • Your photo, private until it matches.
  • The comparison’s outcome and score, which only certo’s systems read.
What we never store
  • The selfie from your identity check: it is held in memory for one comparison.
  • A copy at the identity provider: the comparison keeps neither image and enrols nothing.
Who sees it

Anyone, once it matches. Readers see “photo matched”, never the score.

How long

Until you replace it or erase your account. A matched new photo removes the old one.

Employment

You state the job; certo asks the employer to confirm it.

What we store
  • What you claimed: employer, job title, dates and a note.
  • The answer: which fields the employer confirmed, the team that answered and the date.
  • A signed certificate over the confirmed fields only. Your note is never signed.
  • The address certo asked, and an employee reference if you gave one.
What we never store
  • The person who answered: only their team.
  • Tracking in our e-mails: no open or click tracking.
  • The sender’s address or name in what a language model reads.
Who sees it

Anyone sees the job as you claimed it. What was confirmed, and by whom, opens only to readers you approve. The employer sees only the fields you asked about, your current legal name, and your date of birth if you chose to share it. A language model may read a reply and propose what it confirms; a person decides.

How long

The address asked and the reference: 90 days after the request closes. An address the employer stands behind (on its own domain, or proven by how it answered) is kept as its contact for later requests until it goes 12 months without answering; an address you suggested that it did not prove is never kept. Reply sender, text and what the model read from it: 90 days after the request closes. The original reply: while a confirmation rests on it, and 90 days after that confirmation is withdrawn. Answer-page visits: address and browser 30 days, the rest 12 months.

Education

The same as employment, with the institution asked to confirm.

What we store
  • What you claimed: institution, award, subject, dates and a note.
  • The answer, and a signed certificate over the confirmed fields.
  • Files you add, such as a diploma scan, private, and only on a record not yet confirmed.
What we never store
  • A file beside a confirmation: a scan can never borrow a verdict.
  • Access for a sponsoring university: it pays for the passport and never reads it.
Who sees it

Anyone sees the record as you claimed it. Files and what was confirmed open only to readers you approve; a file opens for ten minutes at a time, and every opening is logged.

How long

As employment. Files: until you remove them or erase your account.

Certifications

Licences and professional certificates, claimed by you or confirmed by the body that awarded them.

What we store
  • Name, issuer, credential number and dates.
  • Files you add, private.
What we never store
  • The credential number or dates on the public page.
Who sees it

Anyone sees the name and issuer. The number, dates and files open to readers you approve.

How long

Until you remove it or erase your account. A certificate expires with the credential.

Contact details and phone

How a reader you approve can reach you, and the mobile number that protects your account.

What we store
  • E-mail addresses, phone numbers and links you add, and how each was verified.
  • Your verified mobile: the number, line type, carrier and country.
What we never store
  • SMS codes: the SMS provider checks them.
  • Contact details on the public page.
Who sees it

Only readers you approve, and only when you include contact details. Every read is logged.

How long

Until you delete them or erase your account.

Personal details

Residence, languages, right to work, nationality and gender, all in your own words and marked claimed.

What we store
  • Each detail as you gave it, with the date.
What we never store
  • Your gender, to anyone: only you see it.
  • Nationality in a general approval: it opens only when you name it.
Who sees it

Anyone sees residence and languages. A language’s level and your right to work open to readers you approve. Nationality only when you tick it; an employer cannot ask for it.

How long

Until you change or remove it. A removed detail leaves the page and stays in your history.

CV and LinkedIn import

A quick start: certo reads your CV once and proposes records for you to check.

What we store
  • Only the lines you keep, as your own claimed records.
What we never store
  • The file.
  • Its text, anywhere: not in a queue, a log or analytics.
Who sees it

A document service turns the file into text and keeps no copy; a language model reads the text and proposes. Nobody at certo sees it.

How long

Nothing is kept from the import itself.

Payments

Subscriptions, credits and sponsorships, paid on the payment provider’s page.

What we store
  • What was bought, the amount, the period and the payment provider’s reference.
What we never store
  • Card numbers or bank details.
Who sees it

You, and certo’s accounting.

How long

For accounting, also after erasure.

Sign-ins and security signals

Used to spot fake accounts and abuse, never to block someone for using a VPN.

What we store
  • The IP address, browser family and country of each sign-in and action.
  • Whether an address is a VPN or proxy, by its hash.
  • Security flags on an account.
What we never store
  • Raw addresses in front of staff.
  • A refusal for using a VPN: certo asks for a mobile number instead.
Who sees it

certo’s systems, and staff resolving a flag.

How long

Raw IP addresses 30 days; a keyed hash and the network 12 months; VPN checks 30 days; security flags 12 months after they are resolved, or raised if never resolved.

Analytics and error reports

Page counts and error reports, in an analytics service hosted in the EU.

What we store
  • Page views. A passport page’s view carries its address, which is built from the name, and whether the viewer is its holder, an approved reader or the public.
  • Error reports, cleaned of e-mail addresses, phone numbers and IPs.
  • How a new account found certo: the campaign codes in the link it arrived by (such as utm_source=linkedin) and the name of the site it came from, never the page. They are kept with the account and sent with three events: the account was created, its identity check passed, a payment went through.
What we never store
  • Cookies, or anything stored on your device.
  • One-time links from invitation, claim and answer pages.
  • A language model’s prompts or answers.
  • Anything from the answer page an employer uses.
Who sees it

certo. You see your passport’s view counts; a site is named only from five views.

How long

Under the analytics service’s retention. The campaign codes on an account until it is erased.

Employer and university accounts

What certo keeps about the organisations that read and sponsor passports.

What we store
  • Members and their roles; invitations, with the link stored only as a digest.
  • Requests to read a passport, with their reason, and credits.
  • From a connected ATS: the application id and the candidate’s name, and the e-mail only while a request waits for a credit.
What we never store
  • The individual recruiter, shown to the candidate: they see the organisation.
  • Who searched the company directory.
Who sees it

The organisation’s own members, and certo staff.

How long

Members, requests and credits while the account exists. An invitation’s e-mail address: 90 days after it is accepted, declined, withdrawn or runs out; a company invitation is then deleted. From an ATS: the candidate’s e-mail only until the invitation is sent, and their name until they erase their certo account.

The access log

Every opening of private data is written down as it happens; a read that cannot be logged does not happen.

What we store
  • Which passport, what was opened, by which organisation and person, through which approval, and when.
What we never store
  • The reader’s IP address or browser.
  • Changes: nobody can edit the log, certo included.
Who sees it

You see each opening as the organisation, or as certo. Employers never read the log.

How long

24 months, also after erasure.

What we keep

Kept only as long as it is needed.

WhatHow long
Who opened your passport24 months, then deleted. Nobody can edit it, certo included.
The IP address your account acts fromThe address 30 days; a keyed hash and the network 12 months.
An organisation’s reply e-mailSender, subject, text and what the model read from it: 90 days after the request closes. The original message: while a confirmation rests on it, and 90 days after that confirmation is withdrawn. All of it at once if you erase your account.
The address a confirmation was asked from90 days after the request closes. If the organisation stands behind the address (its own domain, or proven by how it answered), it is kept as its contact until it goes 12 months without answering.
Visits to an answer pageAddress and browser 30 days; the rest of the visit 12 months.
Your date of birthEncrypted with a key held outside the database. Shown only where you choose to share it; every reader you approve learns only over 18 and over 21, yes or no.
PaymentsKept for accounting, also after erasure.
An invitation’s e-mail address90 days after the invitation is accepted, declined, withdrawn or runs out; at once if the invited account is erased.
Security flags on an account12 months after they are resolved, or after they were raised if never resolved; at once on erasure.
What we never keep

Some things are never stored at all.

  • Your CV: not the file, not its text.
  • Document numbers from your identity check: only a one-way digest.
  • Your gender: never taken from the identity check.
  • SMS codes: the SMS provider checks them, certo never sees them.
  • Your photo at the identity provider when it is compared: the comparison keeps neither image and enrols nothing.
  • Tokens from Google, GitHub, LinkedIn or GitLab sign-in.
  • Analytics cookies: page counts run without them.
Export and erasure

Leaving takes one step.

The export

One zip file. Inside, a JSON file of everything certo holds about you: your account, passport, identity and date of birth, records, confirmations, certificates, verification requests and their trail, who asked to read your passport, invitations sent to your e-mail, approvals, who opened it, entitlements, payments, identity and photo checks, holder keys, mobile and sign-in trail. Beside it, your photos, documents and signed certificates. The trail names an organisation’s role and domain, never a person’s address.

Erasure deletes
  • Your identity, name history, document digest and date of birth.
  • Contact details, mobile, photos and files.
  • Records without a certificate; records with one are emptied.
  • Identity check sessions, the sign-in trail and security flags.
  • The replies organisations sent about your records, and every original reply message.
  • Your address on invitations sent to you; open employer invitations are declined and the credit goes back to the employer.
Erasure keeps, and why
  • Payments and credits, for accounting.
  • The access log, for its 24 months.
  • Revoked certificates without your name, so a checker sees they were revoked.
  • Confirmations on certified records, with how they were checked (the sender’s domain, signature checks), never the reply itself.
  • Organisations’ requests to read your passport, declined, because their credits are accounted against them; their own ATS records, without your name.
  • An organisation’s own contact address for verification, until it goes 12 months without answering.
  • Your retired passport addresses and the passport’s history of events (created, claimed, renamed, never the content), so an address is never given to anyone else.
Your controls

Everything you can do, from your account.

  • SeeEvery organisation that opened your passport, and when.
  • Approve and endChoose who reads what, and end an approval. An employer that sponsored your passport reads it for its 12 months.
  • RemoveTake any record off your passport. It leaves the page; a sponsor whose 12 months cover it still reads it.
  • ExportDownload your account, passport, records, date of birth, approvals, who asked and who opened it, payments, and your files and certificates, as one zip file.
  • EraseType your e-mail to erase the account. Certificates are revoked; what stays, and why, is listed above.
Who processes data for us

Every outside provider, and what it receives.

ProviderWhat it does
Identity providerRuns the identity check and, with your consent, the photo comparison.
PaymentsTakes card payments; certo never sees a card number.
E-mail and SMSSends e-mails and verification texts, and checks that a number is a mobile.
Language modelsRead an imported CV or a reply and propose, and answer questions in the help center; a main provider and a fallback.
PDF renderingTurns your PDF CV or an ATS report into a file, and keeps no copy.
Network reputationSays whether an address is a VPN or proxy. certo then asks for a mobile number, and never blocks.
Analytics and error reportsCookieless page counts, and error reports cleaned of e-mail addresses, phone numbers and IPs. Hosted in the EU.
ATS connectorDelivers the identity note and report to a company’s own ATS, when the company connects one.
Database and hostingStores the data and runs the site.
AI assistant connectionRuns the server an approved organisation's AI assistant connects to. What the assistant reads passes through it, in the United States, and certo's server stores none of it.

The named list of sub-processors is available on request.

How it is protected

Built so a mistake cannot leak it.

  • Certificates are signed with a key that is never in the database.
  • Every query on a sensitive table also lands in the database’s own audit log.
  • Payments, identity and ATS messages are accepted only with a valid signature.
  • Staff actions are checked twice: in the service and again in the database.
  • An unusual sign-up is asked to verify a mobile number, never blocked for using a VPN.