Privacy

Controller

Proposed controller label: Zeqron Academy (legal entity name pending counsel). Override with NEXT_PUBLIC_CERT_CONTROLLER when the legal trade name is finalized. Contact: privacy@zeqron.io.

What we store

• Account identity used to sign in (e.g. email or OAuth subject), role, and progress records needed to deliver courses.
• Certificate registry rows: credential ID, course, issue time, integrity fingerprint inputs, optional display name used on the PDF face, revocation status, and an explicit publishHolderName flag (default off).
• Ordinary web logs (IP, user agent) for security and reliability.

What the public verify URL shows

Anyone with a credential ID can open /verify/{code} or scan the QR. The public response includes: credential ID, course title, issue date, status, seal mark, integrity fingerprint, and attestation text. Internal learner IDs are never published. Holder display names appear only when the learner opts in on the certificate viewer.

Retention (proposed)

• Account + progress: while the account is active; deletion on verified request where the law provides.
• Certificate registry: retained so third parties can verify originality; soft-revoke does not erase the row. Full erasure on verified request may leave a tombstone status for that ID (counsel to confirm).
• Security logs: short rolling window (ops to set; counsel to confirm).

Subprocessors (proposed list)

Hosting / edge (e.g. Vercel), Postgres (e.g. Azure Flexible Server), email / OAuth identity providers configured for Auth.js. Exact legal names and DPAs to be attached by counsel before production claims.

Legal context

If we process personal data of individuals in Argentina, Ley 25.326 and AAIP guidance apply. If we offer services to people in the EU under GDPR Art. 3 conditions, GDPR may also apply. Cross-border transfer mechanisms are pending counsel.

Your rights

You may request access, correction, or deletion of account and certificate-registry data where the law provides. Contact privacy@zeqron.io. Revoking a credential does not delete your learning account unless you ask. You can turn off public name publication anytime from the certificate viewer.

Certificates are private formation credentials

A Zeqron Academy Certificate of Completion is a private formation credential. It is not Open Badges / W3C VC conformity by itself, and it does not grant official academic or professional recognition. See specimen verify and project docs for claim hygiene.