This agreement is between CertiFlyers LLC and the Company, and is part of the Company terms. It covers the personal data about the Company's people that CertiFlyers handles for the Company.
1. Roles
For the training the Company organises (its people's places in the Company, teams and roles, invitations, the courses it assigns, their progress and quiz results, the team record, and the delivery status of its emails), the Company is the controller and CertiFlyers the processor. Under US state privacy laws, the Company is the business and CertiFlyers its service provider.
CertiFlyers is responsible on its own account for each person's own account and sign-in, their certificates and the check pages (which stay with the person), their own purchases, billing and tax records, and security logs.
2. The people and the data
People: the Company's managers, QA reviewers, team leads and technicians, and the people it invites. The trial's sample technicians are made up and are not people.
Data: name; email address (none for technicians on a sign-in card); team and role; invitation dates and status; courses assigned, progress and quiz results; certificate numbers, issue and expiry dates; whether each email was sent, delivered or bounced (kept 90 days); and the log of actions taken on the Company's account.
Not collected: phone numbers, IP addresses on sign-ins, card numbers (Stripe holds them), whether an email was opened, and sensitive data such as health information.
Purpose: giving the Company and its people the training service, support, security and billing.
Duration: while the Company uses CertiFlyers, then as section 9.
3. What CertiFlyers does
Handles the data only on the Company's instructions: these terms and the choices its managers make in the hub, unless the law requires otherwise, in which case we tell the Company first unless the law forbids it.
Does not sell the data, use it for advertising, or use it to train AI models.
Makes sure everyone at CertiFlyers who can access the data is bound to keep it confidential. Staff access a Company's account only to support it, with a reason, recorded in a log that cannot be edited.
Helps the Company, as far as it reasonably can, with requests from people (section 8), with security, with breach notices, and with any impact assessment the law requires.
4. Security
CertiFlyers keeps the security measures in Annex A, at the end of this agreement. We keep them up to date and never make them weaker during the Company's term.
5. Breaches
If CertiFlyers becomes aware of a breach affecting the Company's data, we tell the Company's managers without undue delay, and within 72 hours, with what we know: what happened, which data and people are affected, what we have done and will do, and who to contact. We add to it as we learn more.
6. Subprocessors
The Company agrees that CertiFlyers uses these providers, each bound by a contract that limits it to its service and protects the data at least as this agreement does. They are the providers in the Privacy policy (section 4); all are in the United States.
Google Cloud: hosting, database and file storage. All the data.
Postmark: sending email. Email addresses and the emails we send.
Stripe: card payments. The buyer's payment and billing details; none of the people's training data.
Sentry: error reports, with a person's internal user number and account type.
OpenAI: the course assistant. The question a person types, with the course's content; never their name or email address.
Anthropic: the help desk's automatic first answer, once it is switched on. The question typed and what is needed from the person's own account to answer it.
Apple and Google: only when a person chooses to sign in with them.
We email every manager at least 30 days before adding or replacing a subprocessor, saying who it is and what it does.
Where the Company's people's data is covered by EU or UK data-protection law, the Company may object to the change within those 30 days, giving its reasons. We discuss the objection in good faith; if we cannot address it, the Company may end these terms before the change applies to its data. CertiFlyers stays fully responsible to the Company for each subprocessor's handling of the data.
7. Transfers outside the EU and the UK
The data is stored in the United States. For people in the EU, the UK or Switzerland, CertiFlyers and the Company use the European Commission's standard contractual clauses (controller to processor), with the UK addendum and the changes Switzerland requires, as the Privacy policy says, and CertiFlyers has the same protection in place with its subprocessors. Where a subprocessor is certified under the EU-US Data Privacy Framework (and its UK and Swiss extensions), CertiFlyers also relies on that certification.
8. Requests from people
People can see and correct their own details in their account, and delete their account, as the Privacy policy says.
If CertiFlyers receives a request about data the Company controls, we pass it to the Company without undue delay and do not answer it ourselves unless the Company asks us to. Requests about a person's own account or certificates we answer ourselves.
We help the Company answer requests, for example by exporting a person's training record.
9. Deletion at the end
When someone leaves: their place in the Company ends. Their account and certificates stay theirs; the Company keeps the record of training done while they were with it (Company terms, section 11).
A trial that ended without a plan: the Company's record is deleted 90 days after the trial ended, with a notice to the managers 30 days before (Company terms, section 3).
When a Company closes its account: within 30 days of the request, CertiFlyers deletes the Company's data (places, teams, invitations, assignments, the team record and the action log), after giving the managers a chance to export the team record. We keep only what this agreement and the Privacy policy allow: people's own accounts and certificates, purchase records for 7 years as tax rules require, and backups until they are overwritten within 30 days.
Email delivery records: deleted after 90 days.
10. Audits and information
CertiFlyers gives the Company the information it reasonably needs to show this agreement is kept: this agreement, the security measures in Annex A, and answers to a reasonable security questionnaire once a year. An audit at CertiFlyers takes place only where the law requires it, with 30 days' notice, during business hours, under a confidentiality agreement and at the Company's cost.
11. Which document applies
On personal data, this agreement applies over the Company terms, and the Company terms apply over the Terms of use.
A Company that asks gets a copy of this agreement signed by CertiFlyers. The text is the same as the one accepted online.
Annex A: security measures
What CertiFlyers does today:
The platform runs on Google Cloud in the United States, with Google's encryption of stored data; all traffic uses HTTPS.
Passwords are stored only as bcrypt hashes. Sign-in sessions and invitation links are stored only as hashes. A sign-in card's starting code is kept encrypted (AES-256-GCM) for 10 minutes at most and dropped once used.
Repeated wrong passwords or codes pause sign-in for 15 minutes after 5 tries.
Course files are served by short-lived links, only to people enrolled in the course.
Error reports leave out what people typed, sign-in headers and web-address details.
Backups are kept for up to 30 days, then overwritten.
Access to the servers is limited to named CertiFlyers people, and who has access is reviewed every 90 days.
Everyone at CertiFlyers with access to the data does security training once a year.
Every release is checked so that no source files or secret keys are published.