Privacy Policy

1. Who this applies to, and in what role

We act in two different roles depending on who you are:

• Institution accounts. If you sign up an institution (school, academy, training centre) to issue credentials, we are the data controller for your own account data (name, email), and a data processor for the credential-recipient data you submit to us; you remain responsible for having a lawful basis to collect and submit that data, including parental consent where a recipient is a minor. A Data Processing Agreement is available to institution customers on request.
• Wallet accounts. If you create a personal wallet to collect credentials issued to you, we are the data controller for your account data.
• Credential recipients who haven't created a wallet. If an institution issues you a credential, your name and email may be in our database even if you've never visited Wisam; see "Your rights" below for how to reach us about this.

2. What we collect

• Institution admin accounts: institution name, email, password (stored hashed, never in plain text).
• Wallet accounts: email, password (hashed), display name, bio, skills, profile photo, and any credential details you self-report.
• Credential records: recipient full name, email, course/qualification details, grades, dates, and optionally a photo or uploaded image, submitted by the issuing institution.
• Usage analytics: when a credential or wallet page is viewed or shared, we record a timestamp, a hashed (not raw) IP address, and browser user-agent string; used only for the issuing institution's own analytics dashboard, never sold or shared with advertisers.
• Security and abuse-prevention logs: to stop credential guessing, brute-force logins and signup spam, we record unhashed IP addresses, and, for failed logins, the email address that was tried. This is the only place we store a raw IP. These logs are deleted automatically after 24 hours to 90 days depending on the log.
• Email delivery records: when we send a credential email we record the recipient's address and whether it was delivered, bounced or reported as spam, so the issuing institution can tell whether a credential actually arrived.
• Error reports: if the site crashes in your browser, an automatic report is sent with the page address, browser and device type, and technical details of the error, so we can fix it. It contains no passwords or form contents.
• Sales enquiries: if you contact us through the events page, we keep your name, email, organisation and message so we can reply.

3. Legal bases for processing

Where data-protection law such as the GDPR applies, we rely on the following legal bases for the data we control:

• Performance of a contract — to create and run your account, issue and verify the credentials you ask for, and provide support.
• Legitimate interests — to keep the Service secure and prevent abuse, to give institutions analytics about their own credentials, to respond to enquiries, and to keep issued credentials verifiable over time. We balance these against your rights.
• Legal obligation — to keep tax and accounting records and to respond to lawful requests from authorities.
• Consent — where we ask for it, for example for optional communications; you can withdraw it at any time.

For credential-recipient data that an institution submits, the institution is the controller and is responsible for the lawful basis and any consent; we process that data on their instructions under our Data Processing Agreement.

4. Who we share it with

We use a small number of service providers ("sub-processors") to operate Wisam. The current list, with each provider's role and location, is kept at wisam.app/subprocessors:

• Supabase | database, authentication, and file storage hosting.
• Resend | sends transactional emails (credential delivery, login links). Recipient name and email are shared with Resend solely to send these emails.
• Vercel | hosts and serves the website. Sees IP addresses and request metadata in transit.
• Cloudflare | provides the anti-bot challenge on signup and login. Sees your IP address and browser signals.
• GlitchTip | receives the error reports described in section 2 so we can find and fix bugs. Sees your IP address when a report is sent.
• Stripe | takes payment when an institution buys a plan. Sees the billing contact's name, email, billing address, tax ID and card details; Wisam never sees or stores card numbers.

Every font, on every page and in every certificate PDF, is served from our own site. No font service such as Google Fonts sees your visit.

We may also disclose personal data where we believe in good faith it is necessary to comply with the law or a lawful request, to enforce our terms, or to protect the rights, safety, or property of our users or others. If Wisam is involved in a merger, acquisition, or sale of assets, data may be transferred as part of that transaction, subject to this policy.

We do not sell personal data, and we do not use third-party advertising or analytics trackers.

5. Data retention

Deletion runs automatically every day; these are enforced periods, not intentions:

• Abuse-prevention logs holding raw IP addresses: 24 hours to 90 days, depending on the log.
• Analytics (views and shares): 24 months.
• Email delivery records: 24 months.
• Unanswered or closed sales enquiries: 24 months.
• Account data: kept while the account exists.

Credentials are kept indefinitely on purpose. A credential is only useful if it can still be verified years later, so we do not delete it on a timer. If you want a credential issued to you removed, see your rights below, but note that deleting it breaks every verification link, badge and PDF already shared, which is usually not what people want.

6. How we protect your data

We take security seriously and design the platform to limit what any one party can reach. In particular:

• data is encrypted in transit (HTTPS/TLS) and at rest;
• passwords are stored hashed, never in plain text, and analytics IP addresses are hashed;
• access to data is governed by row-level security and least-privilege rules, so each institution and wallet holder reaches only their own data;
• we log and monitor for abuse, and review the platform's security, including independent audits.

No system can be guaranteed perfectly secure, but if a breach affects your personal data we will act on it and notify you and any regulator where the law requires.

7. Your rights

Depending on where you live, you may have the right to access, correct, export (port), or delete your personal data, to restrict or object to certain processing, and to withdraw consent where we relied on it. You also have the right to complain to your local data-protection authority. What we can do directly depends on how your data reached us:

• If you have a Wisam wallet, you can export everything we hold about your account, and delete the account, from your wallet settings; no request needed. Deleting your wallet unlinks credentials from it but does not delete them, because they belong to the issuing institution's records and remain valid proof of what you achieved.
• If an institution issued you a credential, that institution, not Wisam, decides requests about it. We act on their instruction. Contact them first; if you contact us, we will pass your request on and tell you we have. When they instruct us to erase, we remove your name, email, photo and any notes, and issue a fresh identity salt so your old identity hash cannot be matched back to you.

For anything else, contact privacy@wisam.app. We may need to confirm your identity before acting, and we respond within the time the law allows.

8. International transfers

Your data is stored in South Korea (Seoul). South Korea holds an adequacy decision from the European Commission and a corresponding UK determination, meaning transfers there from the EEA or UK are recognised as offering equivalent protection without additional safeguards.

Transactional email is handled by Resend in the United States, under that provider's own data-processing terms and Standard Contractual Clauses. Error reports are handled by GlitchTip, a United States company. Payments are handled by Stripe, a United States company, under its own data-processing terms and Standard Contractual Clauses.

9. Children's data

Wallet accounts are for people aged 18 or older; we do not knowingly let anyone under 18 create one. Wisam itself does not knowingly collect personal data directly from children. Where an institution (such as a school) submits credential data about a minor, that institution is responsible for ensuring it has the necessary parental or guardian consent before doing so, and a minor's credential stays verifiable through the institution without any wallet.

10. Cookies and local storage

Wisam sets no cookies of its own and loads no advertising or analytics trackers. We keep a few small items in your browser's storage instead. They stay on your device, are never used for cross-site tracking or advertising, and you can clear them at any time from your browser settings. Full detail is in our Cookie Notice; in short:

• Sign-in session, so you stay signed in to your institution account or wallet.
• Language, so pages open in English or Arabic as you last chose.
• Interface preferences, such as whether the admin sidebar is collapsed and which wallet reminders you put off.
• Unsent drafts in the admin (a class list being issued, an email being written), so they survive a reload.
• How you reached a course page (for example a LinkedIn share or a recommendation), kept only for that browser tab and cleared when you close it. If you then register interest, the institution sees that source with your sign-up. It holds no identifier of you.

Some third parties do receive your IP address as a consequence of how pages load: Cloudflare when a signup or login challenge is shown, and GlitchTip when an error report is sent. See section 4.

11. Changes to this policy

We'll update the date at the top of this page when this policy changes. For significant changes, we'll make reasonable efforts to notify account holders directly.

12. Contact

Questions about this policy or your data: privacy@wisam.app.