Privacy Policy

CertOnyx ("we," "us," "our") operates certonyx.com. This Privacy Policy explains how we collect, use, and protect your personal data.

Data controller: CertOnyx, operated by Jermouni Souhail.
Contact: support@certonyx.com

• Account data: email address, hashed password (via Supabase Auth).
• Usage data: your practice question attempts, correct/incorrect answers, mock exam scores, spaced-repetition progress.
• Preference data: language preference, timezone, notification settings.
• Billing data: payment processing for purchases is handled by Whop and its financial partners — we do not directly store your full payment-card details (see Section 5a).
• Technical data: IP address, browser type, and similar data collected automatically for security and analytics purposes.
• Google Sign-In data: If you choose to sign in with Google, we receive basic information from your Google account, such as your email address, name, profile picture (if available), and Google account identifier, as necessary to authenticate you and create or access your CertOnyx account. We do not access your Gmail, Google Drive, contacts, or other Google services.

• Contract performance: account data and usage data are necessary to provide the service you've signed up for.
• Consent: marketing emails and study reminder notifications are sent only with your explicit opt-in, which you can withdraw at any time.
• Legitimate interest: basic technical/analytics data helps us maintain and improve the service.

• To provide and personalize your practice sessions and progress tracking.
• To process your subscription and billing (via Whop and its financial partners).
• To send service-related emails (account confirmation, password reset).
• To send study reminders and marketing emails, only if you've opted in.
• To improve our content and identify commonly-missed questions in aggregate (anonymized/aggregated, not tied to your individual identity in reporting).

• Supabase (database and authentication hosting).
• Whop and its financial partners — used to process purchases made on certonyx.com (see Section 5a below).
• Vercel (application hosting).
• Google: used as an optional authentication provider when you choose ‘Continue with Google.’

We do not sell your personal data to third parties.

When you make a purchase on certonyx.com, the transaction is processed by Whop and its financial partners. Whop collects and processes the purchaser, payment, and order information it needs to run the checkout — for example your name, email address, billing address, and payment-method details — and to carry out payment processing, fraud prevention, invoicing, refunds, and, where enabled and supported, applicable transaction-tax calculation, collection or remittance, together with related transaction compliance.

Whop processes this information in accordance with Whop's own privacy policy and applicable privacy obligations. CertOnyx does not receive or store your full payment-card details; we receive only the transaction and customer information Whop provides that is necessary for us to grant account access/entitlement, provide support, reconcile orders, and operate our business — such as your order reference, the plan purchased, order status, and the email address associated with the order.

Your data is stored on Supabase infrastructure (EU region, Europe/Frankfurt or similar). If any data is transferred outside the EU/EEA (e.g. via Whop or Vercel's infrastructure), such transfers rely on appropriate safeguards as required under GDPR (e.g. Standard Contractual Clauses).

If you are located in the EU/EEA (or another jurisdiction with similar protections), you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate data.
• Erase your data (“right to be forgotten”) — available via account deletion in settings, or by contacting us.
• Restrict or object to certain processing.
• Data portability — receive your data in a portable format.
• Withdraw consent at any time for marketing/notification emails.

To exercise these rights, contact support@certonyx.com or use the relevant controls in your account settings.

We retain your account and usage data for as long as your account is active. If you delete your account, we will delete or anonymize your personal data within 30 days, except where retention is required for legal or billing compliance (e.g. transaction records).

CertOnyx uses the following categories of browser storage and measurement technologies:

• Essential: required for authentication and core site functionality (e.g. keeping you signed in). These are always active and cannot be turned off, since the service cannot function without them.
• Analytics (Google Analytics): helps us understand how CertOnyx is used, and how visitors reach the site (campaign and referral attribution), so we can improve it. This runs from your first visit and does not require you to accept it first.
• Advertising measurement (Meta Pixel): helps us measure the performance of our advertising. This runs from your first visit on our public and legal pages.

A short, informational notice about these technologies is shown on your first visit; it does not offer a way to disable Google Analytics or Meta Pixel. You can reopen it at any time from the "Cookie information" link in the site footer, or from Cookie information in your Account Settings if you're signed in, or read our Cookie Policy for full detail.

CertOnyx does not enable Google's advertising-related consent signals (ad storage, ad user data, or ad personalization) for Google Analytics — those remain off. Other than Meta Pixel, CertOnyx does not use advertising, remarketing, or ad-personalization cookies of any kind.

CertOnyx is not directed at children under 16. We do not knowingly collect data from children under this age.

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a notice on the platform.

Questions or requests regarding this Privacy Policy: support@certonyx.com

You also have the right to lodge a complaint with your local data protection authority (e.g. the CNIL in France) if you believe your data protection rights have been violated.