Privacy Policy
CPE Vault keeps your continuing-education records and the certificates that prove them. This policy explains what we collect, why, where it lives, and how to get it back or erase it.
In short
- Free keeps everything on your phone. Nothing is uploaded to us. Uninstalling the app deletes it.
- Pro syncs an encrypted copy to our vault so you can restore it on a new phone and export an audit pack. It is encrypted in transit and at rest.
- We never sell your data and we show no advertising.
- AI parsing reads only a certificate you choose to upload, suggests the fields, and saves nothing until you confirm.
- Delete your account in Settings or from the Delete account page. Everything is erased within 30 days.
Who we are
CPE Vault is published by [COMPANY LEGAL NAME], [COMPANY ADDRESS] ("CPE Vault", "we", "us"). We are the data controller for the personal data described in this policy. You can reach us at support@cpevault.app.
CPE Vault is an independent tracker. It is not affiliated with or endorsed by ISC2, ISACA, PMI, EC-Council, CompTIA or any certification body, and it never sends anything to them on your behalf.
What we collect
What we hold depends on whether you use the Free or the Pro plan. On Free, the data below stays on your device and we do not receive it. On Pro, an encrypted copy is stored in our vault so it can sync and be exported.
| Category | Examples | Where it comes from | Free | Pro |
|---|---|---|---|---|
| Account | Name, email address, profile picture, Google account identifier | Google Sign-In, when you create an account | No account needed | Stored by us |
| Certifications and cycles | Which certifications you hold, cycle start and end dates, credit targets | You enter them | On device | Stored by us |
| Activity entries | Training title, provider, date, hours, categories, which certifications it was credited to | You enter them, or AI parsing suggests them | On device | Stored by us |
| Evidence files | Certificates of attendance, receipts, screenshots, as PDF or image, plus a file hash and the date you logged them | You upload them, or forward them by email | On device | Stored by us |
| Email-to-vault | Emails and attachments sent to your private vault address, including the sender's address | Mail you forward | Not available | Stored by us |
| Purchases | Plan, purchase token, renewal and refund status. We never see your card number. | Google Play Billing | Not applicable | Stored by us |
| Diagnostics | App version, device model, OS version, crash traces | Your device, only if you opt in to crash reporting | Optional | Optional |
| Support | Your messages to us and the address you sent them from | You, when you contact us | If you write to us | If you write to us |
We do not collect your precise location, contacts, call logs, SMS, advertising identifiers or browsing history, and we do not use third-party analytics or advertising SDKs.
How we use it
- To run the service: keep your ledger, allocate credits to each certification's rules, remind you of deadlines, sync between devices and build audit packs. Legal basis: performance of our contract with you.
- To parse certificates (Pro): extract hours, date and provider from a file you submit. Legal basis: contract, and your choice each time you use the feature.
- To bill you (Pro): confirm your subscription with Google Play and unlock Pro features. Legal basis: contract.
- To support you: answer your messages and investigate problems you report. Legal basis: contract and our legitimate interest in running a reliable service.
- To keep the service secure: detect abuse of email-to-vault, protect accounts and keep records of security events. Legal basis: legitimate interest.
- To meet legal obligations: tax and accounting records, and lawful requests from authorities. Legal basis: legal obligation.
We do not use your data for advertising, we do not build profiles for marketing, and we do not make automated decisions that have legal or similarly significant effects on you.
Google account data
If you sign in with Google, Google sends us your name, email address, profile picture and a Google account identifier. We use them only to create and secure your account, label your vault, and contact you about your account.
CPE Vault requests the basic sign-in scopes only (openid, email, profile). It does not request access to your Gmail, Google Drive, Calendar or Contacts. We will update this policy before asking for any further permission.
CPE Vault's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
You can revoke CPE Vault's access at any time from your Google account permissions. Revoking access signs you out but does not delete your vault. To delete it, see Your rights and choices.
AI certificate parsing
On Pro, you can ask CPE Vault to read a certificate and fill in the hours, date and provider for you. When you do, the file or photo you selected is sent to our AI processing partner, [AI PROVIDER], which returns the extracted fields. The file is processed for the duration of the request and is not used by the partner to train its models.
Suggested fields are shown to you first. Nothing is saved to your ledger until you confirm, and you can correct any field before saving. Parsing is never run on a file you have not explicitly submitted.
Email-to-vault
Pro gives you a private, unguessable email address. Any email sent to it is received by our inbound mail processor, [EMAIL PROVIDER], and lands in your vault as a pending entry for you to review. We store the message, its attachments and the sender's address so you can see where a certificate came from.
Only forward mail that belongs to you. You can regenerate your vault address at any time in Settings, which stops delivery to the old one. Emails that arrive after you delete your account are rejected.
Where your data lives
Free
Everything stays in the app's private storage on your phone. We have no copy. If you uninstall the app, or your phone is lost, the data is gone unless you exported it or your device backup includes it. Your device's own backup service, such as Google's Android backup, is governed by that service's terms.
Pro
Your vault is stored with our hosting provider, [CLOUD PROVIDER], in [REGION]. Data is encrypted in transit using TLS and encrypted at rest. Access inside our team is limited to the people who operate the service and is logged.
Audit packs are generated on your request, delivered to your device, and shared only where you choose to send them.
Who we share it with
We do not sell personal data, and we do not share it with advertisers or data brokers. We share it only with the providers below, who act on our instructions, and with authorities when the law requires.
| Provider | What they do for us | What they receive | Location |
|---|---|---|---|
| Google LLC (Play Billing, Sign-In) | Processes subscriptions and signs you in | Purchase tokens; your Google profile at sign-in | United States and global |
| [CLOUD PROVIDER] | Hosts the encrypted vault and sync service | Your account record and encrypted vault data | [REGION] |
| [AI PROVIDER] | Extracts fields from certificates you submit for parsing (Pro) | The file or image you submit, for the duration of the request | [AI PROVIDER REGION] |
| [EMAIL PROVIDER] | Receives mail sent to your private vault address (Pro) | Incoming emails and attachments addressed to your vault address | [REGION] |
| [CRASH REPORTING PROVIDER] | Collects crash diagnostics, only if you opt in | Device model, OS and app version, stack traces | [REGION] |
We may also disclose data if required by law or a valid legal process, to protect the rights and safety of our users, or as part of a merger or acquisition, in which case this policy continues to apply and we will tell you before your data is handled under a different one.
How long we keep it
- Your vault (Pro): for as long as your account exists. If your subscription lapses, the vault is kept so you can export or resubscribe, and is deleted [12 months] after the lapse unless you delete it sooner.
- After you delete your account: all account data, entries, evidence files, email-to-vault messages and parsing results are erased within 30 days. Encrypted backups that contain your data expire within a further 30 days.
- Purchase records: kept as long as tax and accounting law requires. Google keeps its own records under its policies.
- Support messages: [24 months] after the conversation closes.
- Crash diagnostics: [90 days].
Your rights and choices
Wherever you live, you can:
- See and export your data. Export an audit pack or a CSV of your ledger from the app at any time, or ask us for a copy.
- Correct it. Edit any entry or certification in the app.
- Delete it. Delete individual entries and their evidence in the app, or delete your whole account from Settings or the Delete account page.
- Withdraw consent. Turn off crash reporting in Settings, and revoke Google Sign-In from your Google account.
- Object or restrict. Ask us to stop or limit a particular use of your data.
If you are in the European Economic Area, the United Kingdom or Switzerland, these are your rights under the GDPR and UK GDPR, and you may also complain to your local supervisory authority. If you are a California resident, you have the rights to know, correct and delete under the CCPA, and we do not sell or share personal information as those terms are defined there. If you are in India, you have the rights set out in the Digital Personal Data Protection Act, 2023; our grievance officer can be reached at the address below.
To exercise a right, email support@cpevault.app from the address on your account. We will confirm your identity by replying to that address and respond within 30 days.
Security
We protect your data with encryption in transit and at rest, per-account isolation in the vault, access controls and logging for our staff, and regular dependency and infrastructure updates. Evidence files are stored with a content hash so you can prove a certificate has not changed since you logged it. No system is perfectly secure; if we ever learn of a breach affecting your data, we will notify you and the relevant authorities as the law requires.
To report a security issue, email support@cpevault.app with "Security report" in the subject line.
Children
CPE Vault is a professional tool and is not directed to children under 16. We do not knowingly collect data from anyone under 16. If you believe a child has created an account, contact us and we will delete it.
International transfers
Our providers may process data outside your country, including in the United States. Where data leaves the EEA, the UK or Switzerland, we rely on the European Commission's Standard Contractual Clauses, the UK Addendum, or an adequacy decision, together with the technical measures described above.
Changes to this policy
We will post any changes here and update the date at the top. If a change materially affects how we use your data, we will tell you in the app or by email at least 14 days before it takes effect.
Contact
[COMPANY LEGAL NAME]
[COMPANY ADDRESS]
Email: support@cpevault.app
Grievance officer (India): [NAME], support@cpevault.app