Privacy policy

Pilot applications

The recruitment form collects your name, email, country, card-count range, the device you use, any optional notes you provide, and approved campaign tags from the application link. Please do not include passwords, card numbers, or sensitive financial details in your notes. Earlier applications may also contain issuer, spending-range, card-selection, motivation, and referral answers; these questions are no longer part of the form. We use these screening details to assess pilot compatibility, review your application, and contact you about the pilot. This form does not collect card numbers, credentials, balances, financial records, income, or government identifiers. Applying does not enroll you or subscribe you to marketing.

Application consent and its version and timestamp are recorded. Founder review uses Certa's existing protected application backend. The current form does not collect page-visit or form-start measurement. Earlier versions offered a separate optional measurement choice for page visits and form starts by approved source and selected country, and counts of submitted and qualified applications. Measurement events contain no email, issuer list, spending range, full URL, or session identifier. Counts represent only visitors who opted in and are not a complete visitor conversion rate. Prior anonymous events cannot be associated with you for removal.

For abuse protection, the website gateway hashes connection addresses with a server secret; short-lived rate-limit records expire within two hours and are cleaned up on subsequent requests. Hosting infrastructure may separately log connection metadata. Applications remain for pilot review until removed by the operator; contact houcine@meetcerta.com to withdraw, correct your information, or request deletion. Recruitment measurement is restricted to a rolling 180-day window. No automatic invitations are sent.

Certa checkout extension

The Certa Chrome extension compares the cards saved in your Certa account when you reach an online checkout. You choose whether to grant access to HTTPS sites. You can revoke site access in Chrome, sign out, disable the extension or uninstall it.

To identify a checkout, Certa examines visible order-summary text, payment-action labels, public payment-frame titles and card-entry field metadata. It reads the merchant name or site hostname, visible order total and checkout currency, including currency settings or metadata associated with the total. It does not read payment-card or address input values. Cart products, full page HTML and full page URLs are not sent to Certa's recommendation service. Site identity may be sent as the merchant descriptor.

Currency and amount may be estimated from available checkout information. Currency can also use a visible Amazon currency preference, known site market, domain suffix or page/browser locale, with USD as a final fallback. An estimated currency does not establish where a purchase occurs or whether issuer bonus conditions apply. If purchase facts remain unavailable, Certa can provide a provisional card comparison and refine it when facts become available. Clicking the Certa toolbar icon can also request this advice on the current page.

Certa sends the merchant descriptor, available amount and currency, category hints, payment-method setting, supported purchase-country evidence, accepted-network setting and browser timezone offset to its API to compare your cards. The extension can identify an explicitly selected ordinary card, Apple Pay, PayPal or Google Pay option from public selection state and bounded control labels. Available buttons alone do not establish a selection. You can choose one of these payment methods for a comparison; this does not select or submit a payment method on the website. That correction stays in the current extension view and resets when checkout evidence changes. The accepted-network setting remains empty. The API uses your wallet, reward preferences and available imported purchase history to evaluate applicable rewards and remaining caps. It does not treat a recommendation or planned card choice as a completed purchase.

Public payment-frame host and path metadata can also help detect a checkout. Frame URLs and their parameters are not sent in comparison requests. Certa does not read payment-card or account input values, payment-frame documents or browser-native payment sheets. Visual card comparisons display the existing service response and do not calculate rewards locally.

Connections to Certa's configured API and authentication service also involve IP connection metadata. Certa's API is configured to create access logs containing a client address, request line and response status; the recorded address may be a proxy address. Within Certa, access to these logs is limited to the operator. Country/timezone context and IP metadata fall within the Chrome Web Store's Location disclosure category, which includes region and IP address. The extension does not request GPS coordinates or read address input values.

Supabase provides the connected account's authentication service. When you connect your wallet, your email and password are sent to that service over HTTPS. Certa's API, hosted on Amazon Web Services (AWS), receives authenticated requests with the limited checkout facts described above and processes your saved wallet for card comparisons. The extension does not save your password. Access tokens remain in Chrome session storage restricted to trusted extension contexts and are not made available to merchant pages. Without choosing remembered sign-in, refresh tokens also remain session-only. Signing out clears these tokens and the wallet fingerprint. Chrome clears session storage when the browser restarts or the extension is reloaded, updated or disabled. Public service configuration remains in local extension storage.

You can also create a Certa account from the extension with your email address and password, using the same account service as the phone app. These details are sent to that service only for the registration or sign-in action you request. Your password is not saved by the extension. A pending email-confirmation address stays only in the open form's memory. You can explicitly request another confirmation email. Verification and authentication remain subject to the account service. New accounts begin with an empty wallet; you manage cards and reward settings in Certa's phone app.

If you select Keep me signed in on this browser, Certa stores a refresh token in this Chrome profile's local extension storage so it can reconnect your wallet after Chrome restarts. The choice is optional and is off by default. The remembered connection can be restored for up to 30 days after sign-in; Certa's authentication service may require you to reconnect earlier. Refreshing the connection does not extend that local 30-day window. Expired records are removed when the extension next checks them. Signing out, signing in again, changing the configured Certa service or an authentication rejection removes the remembered token. Temporary network failures retain it for retry.

Local extension storage is not synchronized to other browsers or devices. It is restricted to trusted extension contexts, but it is not an encrypted password vault. Anyone able to use your signed-in Chrome profile may be able to access your connected Certa wallet. Sign out when using a shared device. Uninstalling the extension removes its browser storage.

If you choose Hide on this site today or Pause on this site, Certa saves that exact site hostname and the pause expiry, or an indefinite pause choice, in trusted local extension storage. These preferences remain in this browser across restarts and sign-out; they are not uploaded or synced to your Certa account. Today expires at the next local midnight. Open Certa from the toolbar and choose Resume on this site to remove a pause, or uninstall the extension to clear its local preferences. Toolbar indicators use local sign-in, site-access and pause state and do not send browsing activity to an analytics service.

You can also save whether a website should start with expanded or minimized advice and a preferred left or right popup side. These exact-host preferences stay in trusted local extension storage in this Chrome profile, separate from account reward settings, and are not sent to Certa's API. Pointer coordinates used while dragging are transient and are not saved or sent to the API. Manage sites lets you resume a website or reset its local pause, display and position preferences. Removing the extension or clearing its local data removes these preferences.

A minimized panel can temporarily display a recently recommended card name in trusted extension UI memory. The label expires and is cleared when observed checkout, wallet or account evidence changes. It is not saved as browsing or purchase history and does not verify a purchase or savings. Wallet and advice polling stop while the panel is minimized.

While a checkout panel is visible, Certa periodically retrieves your saved wallet to detect changes. Owned-card identifiers, a hash of wallet card identifiers, point valuations and reward preferences, an opaque revision, and the last successful wallet-read timestamp stay in trusted session storage. Sanitized checkout context, panel layout state, site snoozes, fixed toolbar-detection statuses and counts of prompts, edits, dismissals and planned choices also stay in this browser session. Checkout context is removed when its tab closes; sign-out preserves only sanitized tab context and panel dimensions. This version sends no remote pilot activity analytics and has no issue-report download or automatic feedback upload.

Certa reads the connected account's saved reward settings through its existing authenticated service so it can display selected categories, saved membership/condition flags and saved activation periods. Bounded display labels are used in the extension interface; they are not made available to merchant scripts or added to checkout comparison requests. These labels describe saved settings, not issuer verification. The wallet freshness indicator records when the extension last successfully read the wallet. It does not prove when a phone save occurred or that a purchase or reward was verified. Failed reads retain the earlier check time and identify earlier advice.

Certa's API retrieves indicative exchange-rate tables when needed for currency comparisons. Those provider requests contain no checkout or user/account information. Card artwork is retrieved from Certa's API without sign-in credentials. Certa caches public card pictures in the extension's browser storage for up to seven days, with at most 24 image entries. The cache contains image URLs and image bytes, not your wallet, account, payment information or recommendation history. Stale entries are removed or replaced when accessed; uninstalling clears the cache. This extension release contains no advertising or affiliate-link functionality and does not enter payment details, submit orders or verify purchases or earned rewards.

Reward-settings links open Certa's native app route and may include the public catalog identifier of the selected card. Phone handoff QR images are generated locally and contain a Certa website link with an optional public catalog card identifier in the fragment. They contain no authentication token, account identifier, email, purchase amount, merchant or checkout URL. The identifier is not included in the handoff page's HTTP request. No external QR-generation service is used.

The handoff page opens the existing Certa app route only when you tap Open Certa. It does not transfer sign-in from Chrome to the phone, collect form data, make API calls, persist settings or send analytics. Ordinary website hosting and network processing remain governed by this policy. The installed app uses its own signed-in account; use the same account as the extension. Changing a saved setting still happens in Certa, followed by Refresh in Chrome.

The account and service-security practices described elsewhere in this policy also apply to the connected Certa account. Service and authentication logs are separate from the browser's session state, account records, and mobile location/analytics records covered by the retention periods above; clearing the browser session or deleting an account does not establish deletion of all infrastructure logs. For extension privacy questions or requests, contact houcine@meetcerta.com.

Chrome Limited Use

Certa's use of data obtained through the Chrome extension complies with the Chrome Web Store User Data Policy, including its Limited Use requirements. Certa uses that data only to provide or improve the extension's card-comparison purpose and related operational needs. Certa does not use or transfer it for personalized advertising, data-broker sales, credit-worthiness or lending decisions.

Certa transfers extension data only when necessary to provide or improve that purpose, to comply with applicable laws, to protect against malware, spam, phishing or other fraud or abuse, or as part of a merger, acquisition or asset sale after obtaining the user's explicit prior consent. Human reading of extension user data is limited to specific data with the user's explicit consent, aggregated and anonymized data used for internal operations, circumstances necessary for security, or compliance with applicable laws. These restrictions also apply to access by Certa's operator.