Privacy Policy
Version 2026-10-04 · Effective 4 October 2026
Contents
- 1. Who is responsible for your data
- 2. What we collect, why, and for how long
- 3. How your AI score works
- 4. Who receives your data
- 5. Transfers outside the EEA
- 6. Students in a school classroom
- 7. Children and teenagers
- 8. Cookies and similar technologies
- 9. Your rights
- 10. Deleting your account and how long we keep data
- 11. How we protect your data
- 12. Changes to this policy
- 13. Contact
In short
Who: ntagks, the Greek business behind certifyboost, is responsible for your personal data.
What and why: we use your data to run your account, track your progress, score your essays and speaking, take payments and keep certifyboost safe.
AI: OpenAI's models score your essays and speaking answers. The scores can be wrong, and you can ask a person to check them. OpenAI does not use your data to train its models.
Never: we don't sell your data, show ads or use tracking cookies. Analytics and signup tracking only run if you say yes.
Your control: you can see, download, correct or delete your data. You can delete your account yourself in Settings › Account. If you are unhappy with how we handle your data, you can complain to the Greek data protection authority.
1. Who is responsible for your data
The controller of your personal data is ntagks, a sole proprietorship in Greece, which runs certifyboost.
- Owner (legal name of the business): Alexandros Ntagkonikos
- Address: Pavlou Mela 39, Triadi, 57001 Thermi, Greece
- VAT number: EL167681173
- Phone: +30 698 631 0904
- Privacy questions and requests: hello@certifyboost.com
This policy covers www.certifyboost.com and app.certifyboost.com.
2. What we collect, why, and for how long
| Purpose | Data | Legal basis | How long |
|---|---|---|---|
| Your account | E-mail address; password (stored only as a secure hash) or your Google sign-in ID; name; username; date of birth; country; target exam and level; goal date; your time zone (from your browser, so your daily streak follows your local midnight); your settings | Contract (Art. 6(1)(b) GDPR). If you are under 18: your consent, which you give with its own box when you sign up (Art. 6(1)(a) and Art. 8 GDPR; Greek Law 4624/2019, art. 21). Date of birth and country are also used to check the minimum age: legal obligation and legitimate interest (Art. 6(1)(c) and (f)) | While your account exists, plus 30 days after you delete it |
| Optional sign-up answers | Your reason for getting certified and how you heard about us, if you choose to answer | Legitimate interest in improving certifyboost and understanding how people find us (Art. 6(1)(f)). You can leave them empty | While your account exists |
| Learning | Your answers, essays, speaking recordings, transcripts, scores, XP, progress, flashcards and mistakes | Contract (under 18: consent, as above) | While your account exists, plus 30 days. Speaking recordings are deleted 12 months after you make them; their transcripts and scores stay |
| AI assessment | The text of your essay; your speaking recordings, which are turned into transcripts. Both are sent to OpenAI for scoring | Contract | Results are kept with your account. OpenAI keeps API data for up to 30 days for abuse monitoring (nothing for transcription) and never uses it for training |
| Live Interview | Your voice, which streams directly from your browser to OpenAI (so OpenAI also sees your IP address); the transcript and the feedback card | Contract | Transcript and feedback are kept with your account. OpenAI keeps data for up to 30 days for abuse monitoring |
| Purchases and billing | Name, e-mail, billing address, VAT number (businesses), order and payment references, amounts, the boxes you ticked at checkout (with the time and your browser's user agent, as proof), withdrawal requests | Contract, and legal obligation under Greek tax and accounting law (Art. 6(1)(b) and (c)) | At least 5 years from the end of the year in which the relevant tax return is due, and up to 10 years where the law requires it (for example, EU VAT One-Stop-Shop records) |
| Purchases by a parent | The parent's name, e-mail and declaration that they are the parent or guardian, and the learner's first name as shown in that declaration | Contract with the parent, and legal obligation | As for purchases and billing. If the parent never completes the purchase, the request (with the parent's e-mail) is deleted 30 days after the link expires |
| Security and abuse prevention | IP address, browser data, server logs, rate-limit counters, CAPTCHA signals | Legitimate interest: keeping certifyboost secure (Art. 6(1)(f)) | Server and security logs: up to 7 days. Rate-limit counters: 1 day |
| Support and messages | Your messages and contact details when you write to us or use the contact form | Contract, or legitimate interest in answering you | Up to 24 months after the conversation ends (longer only if needed for a legal claim) |
| Service e-mails | Your e-mail address and the message: account e-mails, grading results, purchase confirmations, renewal reminders, withdrawal acknowledgements | Contract, or legal obligation | Delivery logs: 30 days |
| Streak reminder e-mails | Your e-mail address and streak status | Consent (Art. 6(1)(a) GDPR; Law 3471/2006 art. 11) | Until you opt out in Settings › Notifications |
| Exam Pass expiry reminders | Your e-mail address and the date your Pass ends | Legitimate interest: you are an existing customer (Law 3471/2006 art. 11(3)). Every e-mail has a one-click unsubscribe link | Until you unsubscribe |
| Analytics | Vercel Web Analytics: pages visited (without their query strings, except campaign tags such as utm_source on our website), referring site, country, device type. No cookies; a daily pseudonymous hash that is discarded within 24 hours | Consent, through the cookie banner | Only anonymous totals are kept |
| Signup attribution | The cb_attrib cookie: the campaign link you arrived on, the referring site and the landing page. If you then sign up, it is saved on your profile as your signup source | Consent, through the cookie banner | Cookie: 90 days. On your profile: while your account exists |
| Leaderboards | Your random two-word name, its avatar and your XP | Contract. You can hide yourself at any time | While your account exists |
| Records of what you accepted | Which version of the Terms you accepted, the consents you gave or withdrew, and when | Legal obligation, and legitimate interest in being able to prove it | What you accepted at checkout is kept with the purchase record (see purchases and billing). Your other acceptance and consent records are deleted with your account |
If you are under 18: wherever this table says "Contract" for your own account and learning (including AI assessment, the Live Interview, leaderboards, support and service e-mails), the legal basis is your consent instead (see section 7).
What you must give us. The required registration fields are needed to create your account and run the service; without them we can't provide it. Some data is required by law, such as billing records. Everything else is optional: the two optional sign-up questions, streak reminder e-mails, analytics and signup attribution. Saying no never limits what you can do in certifyboost.
3. How your AI score works
- Each essay or speaking answer is scored against a rubric of four criteria, worth 25 points each (100 in total), written for each exam level.
- An OpenAI model applies the rubric (currently gpt-4o). For speaking, another model (currently gpt-4o-mini-transcribe) first turns your recording into text. In the Live Interview, the examiner is an OpenAI realtime model (currently gpt-realtime-2.1-mini) and the feedback card with its practice score is written by gpt-4o-mini from the transcript.
- Speaking is judged from the transcript, so your pronunciation is not judged.
- No person checks the score, unless you are in a school classroom and ask your teacher to (next point). It can be wrong.
- If your school has invited you to its classroom, you can press "Ask your teacher to review" under your AI feedback (essays, speaking sections, Live Interview reports). For that one score, your teachers see your work, the AI score and its feedback, and answer you in the app. The review is done by your school, not by us (see section 6).
- AI-generated scores and feedback are labelled as AI-generated in the app, and feedback created since 4 October 2026 carries a machine-readable marker saying so.
- The recorded voices you hear (examiners, listening speakers, video narration) are AI-generated, and the Live Interview examiner is an AI, not a real person. We tell you before and when it starts. The audio files carry a machine-readable marker saying they are AI-generated, and the pictures in the mock exams are AI-generated too.
Automated assessments are used for educational feedback and progress tracking and are not used, on their own, for decisions producing legal effects concerning the user or similarly significantly affecting them. Where Article 22 GDPR applies, the safeguards it provides for are applied.
We never use AI to guess your emotions. We use your scores to show your progress and to suggest what to practise next. This counts as "profiling" under the GDPR, and we use it only for those purposes.
4. Who receives your data
We share personal data only with the following recipients, and only for the purposes in section 2. We do not sell your data.
| Recipient | What they do | Where, and the safeguard |
|---|---|---|
| Supabase (Supabase Pte. Ltd., Singapore) | Database, login, file storage and the server functions that run the AI scoring | Data stored with AWS in Dublin, Ireland (EU); server functions run in the EU (Frankfurt). Support staff in the US. Standard Contractual Clauses |
| Vercel Inc. (US) | Hosting, server functions (in Dublin, Ireland), logs, and analytics if you consent | EU-US Data Privacy Framework and Standard Contractual Clauses |
| OpenAI Ireland Ltd, with OpenAI OpCo LLC (US) | AI scoring, transcription and the Live Interview | US. Standard Contractual Clauses |
| Stripe Payments Europe Ltd (Ireland) | Payments. Stripe processes payments for us and is an independent controller for fraud prevention and its own legal obligations: see stripe.com/privacy | EU. Transfers to the US: Data Privacy Framework and Standard Contractual Clauses |
| Resend (Plus Five Five, Inc., US) | Sends our e-mails | E-mail content and logs stored in the US for 30 days. Data Privacy Framework and Standard Contractual Clauses |
| Cloudflare, Inc. (US) | Our domain's DNS; the Turnstile anti-bot check on the sign-in, sign-up, password-reset and e-mail-resend forms, which sets no cookies. Cloudflare also uses the Turnstile signals as an independent controller to improve its bot detection | Data Privacy Framework and Standard Contractual Clauses |
| Mux, Inc. (US) | Streams the course videos. Receives your IP address, browser and approximate location | Data Privacy Framework, with Standard Contractual Clauses as a fallback |
| Google Ireland Ltd | Sign in with Google, if you choose it. Google is an independent controller | Google's own terms |
| Zoho (Zoho Mail) | Hosts our support inbox, so messages you send us are stored there | Stored in Zoho's EU data centre. Standard Contractual Clauses for any access from outside the EEA |
| Your school | Only if you join a school's classroom: see section 6 | EU |
| An accountant (Greece), if we engage one | Would keep our accounting and tax records (invoices, payments). Today we keep them ourselves | EU |
| Authorities and courts | Only when the law requires it | — |
5. Transfers outside the EEA
Some providers may process data outside the EEA. In that case the transfer mechanism required by law and appropriate safeguards apply, and the relevant information is provided in this Privacy Policy.
In practice, some of our providers are in the United States or Singapore (see the table above):
- For US providers certified under the EU-US Data Privacy Framework, transfers rely on the European Commission's adequacy decision (EU) 2023/1795.
- Otherwise, and as a fallback, transfers rely on the Standard Contractual Clauses approved by the European Commission (decision (EU) 2021/914).
You can ask us for a copy of these safeguards at hello@certifyboost.com.
6. Students in a school classroom
If your school invites you to its certifyboost classroom:
- Your teachers and the school's account owner can see: your name, the e-mail address they invited, your class, your progress on the courses assigned to you, for each mock exam assigned to you your latest attempt with its overall score (marked as an AI estimate) and whether it passed, and your class's weekly XP ranking with names. Your classmates see that ranking only with the random two-word names. The school's account owner can also see your Live Interview minute balance (including any minutes you bought yourself).
- They cannot see: your essays, your recordings, the text of your AI feedback, your date of birth or your country — except for a score you ask them to review: then they see that one essay or recording (or Live Interview transcript), its AI score and its feedback.
- Who decides, for managing the classroom: for the roster and invitations, classes, assignments, the teachers' reports, the reviews you ask your teachers for and the Live Interview minutes a school gives you, the school decides how your data is used and we act on its behalf as its processor, under a data processing agreement (Art. 28 GDPR).
- Who decides, for your own learner account: for your learning, AI scoring, XP and any purchases of your own, we are an independent controller, as described in this policy.
- Where the two meet: when your teachers see your progress and the class ranking, the school and we act as joint controllers (Art. 26 GDPR). In short: the school is responsible for having a legal basis for using certifyboost in class and for informing you and your parents; we are responsible for running the platform securely and for handling requests about the data in it. You can exercise your rights with either the school or us; whichever of us you contact passes on to the other what they need to handle your request.
- Where we got your e-mail: if a school invited you, we received your e-mail address from the school.
- To leave a class or a school, ask your teacher or write to us at hello@certifyboost.com, which is also the contact point for the arrangement between the school and us. Once you leave, or delete your account, your teachers no longer see your progress.
7. Children and teenagers
- You must be at least 15 to use certifyboost, or older if your country's age of digital consent is higher (16 in Germany, the Netherlands, Ireland, Poland, Romania, Luxembourg, Hungary, Slovakia, Croatia and Liechtenstein).
- If you are under 18, we process your account data on the basis of your own consent, which you give with a separate box when you sign up (the minimum age for that consent is 15 in Greece). You can withdraw it at any time by deleting your account in Settings › Account.
- If you are under 18, a parent or legal guardian must make any purchase. We then process the parent's details for that purchase.
- We try to explain everything in this policy in plain words. If something is unclear, ask us.
- Parents and guardians can contact us about their child's data at hello@certifyboost.com.
8. Cookies and similar technologies
| Name | What it does | Type | How long |
|---|---|---|---|
sb-… | Keeps you logged in (Supabase login session) | Necessary | Up to 400 days, or until you log out |
cb_consent | Remembers your cookie choice | Necessary | 6 months |
display_currency | Remembers the currency you chose for prices | Necessary | 12 months |
classroom_school | Remembers which school a teacher is managing (teachers only) | Necessary | 12 months |
sidebar_state | Remembers whether you collapsed the app's sidebar | Necessary | 7 days |
admin_premium_preview | Lets our own staff preview Premium (staff accounts only) | Necessary | 30 days, or until switched off |
| Local storage | Remembers your theme, text size, preferred display currency, the video player's volume, mute and caption language, and whether you have finished the getting-started checklist | Necessary | Until you clear your browser data |
| Session storage | Counts how often you have played an exam or booster recording (so the two-play rule holds) | Necessary | Until you close the tab |
| Vercel Web Analytics | Counts page visits without cookies | Only with your consent | A daily pseudonymous hash, discarded within 24 hours |
cb_attrib (and a session-storage copy on our website) | Remembers how you found us (campaign link, referring site, landing page) | Only with your consent | 90 days (the session copy: until you close the tab) |
Stripe's checkout page runs on Stripe's own website, with its own cookies. You can change your choice at any time with "Cookie settings": at the bottom of every page of our website and of the app's workspace, or in Settings › Notifications.
9. Your rights
You have the right to:
- access your data and get a copy;
- correct data that is wrong;
- delete your data;
- restrict how we use it;
- take your data with you in a common format (portability);
- object to processing based on our legitimate interests, and to marketing at any time;
- withdraw your consent at any time, without affecting what happened before;
- not be subject to a decision based solely on automated processing that has legal or similarly significant effects on you.
How: e-mail hello@certifyboost.com. You can delete your account yourself in Settings › Account, and change your e-mail preferences in Settings › Notifications. We reply within one month. Where the law allows, we may extend this by two more months, and we tell you if we do.
Complaints: you can lodge a complaint with the Hellenic Data Protection Authority, Kifisias 1-3, 11523 Athens, www.dpa.gr, or with the data protection authority of the EU country where you live.
10. Deleting your account and how long we keep data
After account deletion we delete or anonymise the personal data that we are not required to retain. Data that must be kept by law or for the establishment, exercise or defence of legal claims is retained only for as long as necessary and with restricted access.
- When you delete your account, it is disabled immediately.
- For 30 days you can change your mind by writing to us; until then you can't sign in. After that, your personal data (profile, answers, essays, recordings, progress) is erased permanently.
- Your XP history is deleted with your account.
- Records of AI usage costs (date, feature, amount of processing) are kept for our accounts without any link to you.
- Purchase and billing records, including withdrawal statements, are kept for the periods in section 2, because tax and consumer law require it.
- Database backups are kept for up to 7 days and then overwritten, so deleted data disappears from them within that time.
11. How we protect your data
- All connections are encrypted (TLS), and data is encrypted at rest.
- Speaking recordings are kept in private storage and played only through short-lived signed links.
- Essays and answers are stored in our database, protected by access rules so that only you can read them. Teachers see only the classroom information listed in section 6, never your essays, recordings or AI feedback.
- Staff access is limited to what is needed, and every teacher and admin action is checked on our servers.
- Card details never reach our servers: Stripe handles them.
12. Changes to this policy
We update this policy when our service or the law changes. The version date is at the top, and earlier versions stay in the Privacy Policy archive. If we make important changes, we tell you by e-mail or in the app before they apply.
13. Contact
Questions about your data or this policy: hello@certifyboost.com, +30 698 631 0904, or by post to ntagks, Pavlou Mela 39, Triadi, 57001 Thermi, Greece.