Privacy Policy

1. Who we are

ReadyCert ("we", "us") provides a web application at app.readycert.co.uk that helps UK small businesses prepare for Cyber Essentials certification. For the personal data described here, ReadyCert is the data controller. You can reach us about anything in this policy at mail@readycert.co.uk.

2. What we collect

We only collect what the service needs:

• Account details — your email address, and (if you use Google sign-in) your name and profile basics from Google.
• Business information you enter — your organisation's name, size and sector, and your own descriptions of your IT setup (devices, cloud services, how you work). We store your descriptions, not credentials or access to your live systems.
• Your answers and documents — your readiness-check and answer-pack responses, the gaps we identify, and the policy documents generated from them.
• Billing information — if you subscribe, your plan and subscription status. Payment card details are collected and stored by Stripe, our payment processor — we never see or store them.
• Technical and usage data — basic, privacy-preserving analytics about how the app is used (see section 8), and standard server logs.
• Newsletter subscriptions — if you subscribe to email updates on readycert.co.uk, your email address, which list you subscribed to, and the date. You don't need a ReadyCert account to subscribe, and subscribing doesn't create one.

3. Why we use it (legal bases)

• To provide the service (performance of our contract with you) — running your account, generating your guidance and documents, taking payment.
• To keep the service secure and working (our legitimate interests) — preventing abuse, fixing faults, understanding usage in aggregate.
• To send you service emails (contract / legitimate interests) — sign-up confirmation, password resets, and — if you switch them on — renewal and re-check reminders. You can turn reminders off at any time.
• To send you the newsletter you subscribed to (consent) — updates on Cyber Essentials and the other certifications small businesses get asked for. It's separate from the service emails above: we record which list you joined so you only get what you asked for, and unsubscribing doesn't affect your account.

We do not run advertising and we do not sell your data.

4. Who we share it with

We use a small number of trusted processors to run the service. They only handle your data to provide their part of it:

• Supabase — database, authentication and hosting (data held in the EU/UK region).
• Vercel — hosts and serves the application, and provides cookieless usage analytics.
• Stripe — payment processing and card storage.
• Resend — sending our account, reminder and newsletter emails.
• Google — only if you choose "Continue with Google" to sign in.

We may also disclose data if the law requires it. If ReadyCert is ever part of a business sale, we'll tell you before your data moves and this policy continues to apply.

5. Where your data is stored

Your account and business data are stored in the UK/EU (Supabase's London/EU region). Some processors (such as Stripe) may process limited data outside the UK/EU under appropriate safeguards like the UK International Data Transfer Agreement or equivalent contractual protections.

6. How long we keep it

We keep your data for as long as you have an account. If you delete your account (Billing → delete business), we remove your organisation and its data — assets, answers, gaps and generated documents — and delete your login. Some records may persist briefly in encrypted backups before rotating out, and we keep minimal billing/transaction records where the law requires. You can also ask us to delete your data at any time at mail@readycert.co.uk.

Newsletter subscriptions work differently, because you don't need an account to have one: we keep your address until you unsubscribe or ask us to delete it. Every newsletter carries an unsubscribe link, and you can email us instead.

7. How we protect it

Security is built in, not bolted on. Every table holding your data has row-level security so one business can never see another's. Data is encrypted in transit and at rest, access is least-privilege, and — by design — we store your descriptions of your setup rather than credentials or live access to your systems. No system is perfectly secure, but we take this seriously because it's the whole point of the product.

8. Cookies and analytics

We use a single essential cookie to keep you signed in — the app doesn't work without it. We use Vercel's privacy-friendly analytics to understand usage in aggregate; it is cookieless and does not track you across other websites or build an advertising profile. We do not use advertising or third-party tracking cookies.

9. Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you;
• correct anything that's wrong;
• delete your data ("right to erasure");
• export your data in a portable form;
• object to or restrict certain processing, and withdraw consent where we rely on it.

To exercise any of these, email mail@readycert.co.uk. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint, though we'd appreciate the chance to put things right first.

10. Children

ReadyCert is a tool for businesses and isn't intended for anyone under 18. We don't knowingly collect data from children.

11. Changes to this policy

If we make material changes we'll update the date at the top and, where appropriate, let you know by email. Continuing to use ReadyCert after a change means you accept the updated policy.

12. Contact

Questions, requests or complaints about your data: mail@readycert.co.uk.