Privacy Policy

1. Who we are

ReadyCert ("we", "us") provides a web application at app.readycert.co.uk that helps UK small businesses prepare for Cyber Essentials certification. For the personal data described here, ReadyCert is the data controller. You can reach us about anything in this policy at support@readycert.co.uk.

ReadyCert is a trading name of Sacdi Mohamed, a sole trader, of Unit A, 82 James Carter Road, Mildenhall, IP28 7DE.

2. What we collect

We only collect what the service needs:

• Account details — your email address, and (if you use Google sign-in) your name and profile basics from Google.
• Business information you enter — your organisation's name, size and sector, and your own descriptions of your IT setup (devices, cloud services, how you work). We store your descriptions, not credentials or access to your live systems.
• Your answers and documents — your readiness-check and answer-pack responses, the gaps we identify, and the policy documents generated from them.
• Billing information — if you subscribe, your plan and subscription status. Payment card details are collected and stored by Stripe, our payment processor — we never see or store them.
• Technical and usage data — basic, privacy-preserving analytics about how the app is used (see section 8), and standard server logs.
• How you found us — if you create an account after visiting readycert.co.uk: which kind of site first brought you to it, the first page you visited, any campaign tag on the link, and a partner’s code if a partner referred you (see section 8).
• Newsletter subscriptions — if you subscribe to email updates on readycert.co.uk, your email address, which list you subscribed to, and the date. You don't need a ReadyCert account to subscribe, and subscribing doesn't create one.

3. Why we use it (legal bases)

• To provide the service (performance of our contract with you) — running your account, generating your guidance and documents, taking payment.
• To keep the service secure and working (our legitimate interests) — preventing abuse, fixing faults, understanding usage in aggregate.
• To send you service emails (contract / legitimate interests) — sign-up confirmation, password resets, a one-off welcome email when your account is created, and — if you switch them on — renewal and re-check reminders. You can turn reminders off at any time.
• To send you the newsletter you subscribed to (consent) — updates on Cyber Essentials and the other certifications small businesses get asked for. It's separate from the service emails above: we record which list you joined so you only get what you asked for, and unsubscribing doesn't affect your account.

We do not run advertising and we do not sell your data.

4. Who we share it with

We use a small number of trusted processors to run the service. They only handle your data to provide their part of it:

• Supabase — database, authentication and hosting (data held in the EU/UK region).
• Vercel — hosts and serves the application, and provides cookieless usage analytics.
• PostHog — privacy-first product analytics, processed in the European Union. Configured without cookies, without session recording, and without account identifiers — events are anonymous and not linked to you across visits.
• Stripe — payment processing and card storage.
• Resend — sending our account, reminder and newsletter emails.
• Cloudflare — Turnstile, a check on the app\'s sign-up, sign-in and password-reset forms that confirms a person rather than a bot is using them. It runs in your browser on those pages and receives technical details such as your IP address.
• Google — sign-in for the app. Google's sign-in script loads on the app's sign-in and sign-up pages, and your Google account is used only if you choose "Continue with Google".
• Google Fonts — serves the typefaces on readycert.co.uk. Your browser fetches them from Google (fonts.googleapis.com and fonts.gstatic.com), so Google receives your IP address when a page loads.

We may also disclose data if the law requires it. If ReadyCert is ever part of a business sale, we'll tell you before your data moves and this policy continues to apply.

5. Where your data is stored

Your account and business data are stored in the UK/EU (Supabase's London/EU region). Some processors (such as Stripe) may process limited data outside the UK/EU under appropriate safeguards like the UK International Data Transfer Agreement or equivalent contractual protections.

6. How long we keep it

We keep your data for as long as you have an account. If you delete your account (Billing → delete business), we remove your organisation and its data — assets, answers, gaps and generated documents — and delete your login. Some records may persist briefly in encrypted backups before rotating out, and we keep minimal billing/transaction records where the law requires. You can also ask us to delete your data at any time at support@readycert.co.uk.

Newsletter subscriptions work differently, because you don't need an account to have one: we keep your address until you unsubscribe or ask us to delete it. Every newsletter carries an unsubscribe link, and you can email us instead.

7. How we protect it

Security is built in, not bolted on. Every table holding your data has row-level security so one business can never see another's. Data is encrypted in transit and at rest, access is least-privilege, and — by design — we store your descriptions of your setup rather than credentials or live access to your systems. No system is perfectly secure, but we take this seriously because it's the whole point of the product.

8. Cookies and analytics

To keep you signed in, the app keeps your login session in your browser's local storage — the app doesn't work without it. It also stores a few display settings on your device. To understand usage in aggregate we use two privacy-friendly analytics tools: Vercel Web Analytics and PostHog (EU-hosted). Both are configured without cookies; PostHog additionally runs without session recording and without any account identifier, so analytics events are anonymous and not linked to you across visits. Neither tracks you across other websites or builds an advertising profile. We do not use advertising or third-party tracking cookies.

On readycert.co.uk, your browser's session storage remembers what kind of site referred your visit (for example search or social), the first page you arrived on, and any campaign tag or partner code on the link you arrived by. It holds no identifier and is cleared when you close the tab. When you create an account, we save with it which kind of site first brought you to readycert.co.uk, the first page you visited, any campaign tag on the link, and a partner’s code if a partner referred you. We use this, under our legitimate interests, to see which pages and partners bring customers and to pay referral fees. It is deleted with your business. If you use our free checklist, your ticks are saved in your own browser so they're there when you come back; they're never sent to us.

9. Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you;
• correct anything that's wrong;
• delete your data ("right to erasure");
• export your data in a portable form;
• object to or restrict certain processing, and withdraw consent where we rely on it.

To exercise any of these, email support@readycert.co.uk. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint, though we'd appreciate the chance to put things right first.

10. Children

ReadyCert is a tool for businesses and isn't intended for anyone under 18. We don't knowingly collect data from children.

11. Changes to this policy

If we make material changes we'll update the date at the top and, where appropriate, let you know by email. Continuing to use ReadyCert after a change means you accept the updated policy.

12. Contact

Questions, requests or complaints about your data: support@readycert.co.uk.