01Who we are and scope
This policy applies to the badgeclaimed.com website, the app.badgeclaimed.com application, the public profiles at profiles.badgeclaimed.com, and the BadgeClaimed API. For any privacy matter, email us at info@badgeclaimed.com.
For your account data, BadgeClaimed decides how and why it is processed: we are the controller. For the data an issuer uploads to deliver credentials to its earners, the issuer is the controller, and BadgeClaimed processes that data on the issuer’s behalf and under its instructions.
02Data we process
- Account: name, email, and password. If you sign in with Google, the basic Google profile data you authorize: name, email, and photo.
- Issuing organization: name, logo, website, and contact and billing details.
- Credentials: the earner’s name and email, the achievement, the criteria, the issue and expiration dates, and any evidence the issuer chooses to include.
- Public profile: whatever each earner chooses to show, such as name, photo, skills, and badges.
- Payments: plan, amount, date, and payment reference. Card details are received and processed by Stripe; we do not store them.
- Technical and usage data: IP address, browser, device, access and error logs, delivery of the emails the platform sends, and views of public credentials, which the issuer sees as statistics.
- Communications: the messages you send us and, if you opt in when signing up, your subscription to our updates.
03How we use it
- To provide the service: create and manage accounts; issue, deliver, store, and verify credentials; and display public profiles. Legal basis: our contract with you or, for earner data, the issuer’s instructions.
- To charge and invoice. Legal basis: the contract and our legal obligations.
- To protect the service: prevent fraud, issuer impersonation, and abuse, for example with reCAPTCHA at sign-up. Legal basis: our legitimate interest in a secure and reliable service.
- To improve the product with usage statistics. Legal basis: your consent where the law requires it or, otherwise, our legitimate interest.
- To send you updates and tips. Legal basis: your consent, which you can withdraw at any time through the link in the email or by contacting us.
- To comply with the law and respond to requests from authorities.
We do not sell your personal data or use it for third-party advertising.
04Credentials and public profiles
A credential exists so others can verify it. That is why anyone with the link to a public credential can see its content, including the earner’s name. In your account settings, you can make your profile or any badge private.
If you download a credential or share it on another platform, such as LinkedIn, that copy is outside our control and is governed by that platform’s rules.
05Who we share it with
We share data only with those who need it to provide the service:
- The issuer of your credentials, who sees the data of the credentials it issued and their status.
- Service providers that process data on our behalf: Amazon Web Services (hosting, storage, and email delivery), Cloudflare (network and security), Vercel (hosting of this website and visit measurement), Google (Google sign-in, reCAPTCHA, and fonts), Microsoft (email and Clarity, to understand how the app is used), and Stripe (payments).
- Authorities, when the law requires it.
- A buyer or successor, if BadgeClaimed is merged or sold, who must honor this policy.
06International transfers
Our servers and most of our providers are in the United States. If you are in another country, your data is transferred there. We do so with providers that offer adequate safeguards, such as standard contractual clauses, where the law requires them.
07How long we keep it
- Account data, while the account is active. When you close it, we delete or anonymize it within a reasonable period, except what we must keep by law, such as invoicing records.
- Credentials, for as long as the issuer keeps them, so they can still be verified. The issuer may revoke them or ask us to delete them.
- Technical logs, for as long as needed for security and troubleshooting.
08Security
We apply reasonable technical and organizational measures: encryption in transit (HTTPS), access limited to those who need it, and providers with recognized security certifications. No system is infallible; if an incident affects your data, we will notify you, and the authorities where the law requires it.
09Your rights
You can ask us at any time to:
- Access your data and learn how we process it.
- Correct inaccurate or incomplete data.
- Delete your data or close your account.
- Receive your data in a commonly used format.
- Object to processing or ask us to restrict it.
- Withdraw your consent, without affecting what was done before.
Email us at info@badgeclaimed.com from your account email address. We respond within the deadlines of the law that applies to you and may ask you to confirm your identity. If your data came through an issuer, we may forward your request to that issuer, who decides about it.
These rights are recognized by, among other laws, the European Union General Data Protection Regulation, Brazil’s Lei Geral de Proteção de Dados, Colombia’s Law 1581 of 2012, and the privacy laws of several US states. If you are not satisfied with our response, you can contact the data protection authority in your country.
10Minimum age
You must be at least 21 years old to create a BadgeClaimed account, and we do not knowingly create accounts for anyone younger. If an issuer delivers credentials to minors, it must have the authorization of their parents or guardians. If you believe we hold a minor’s data without that authorization, email us and we will delete it.
12Changes to this policy
If we change this policy, we will publish the new version on this page with its date. If the change is significant, we will notify you by email or in the app.
13Contact
For privacy questions or requests, email us at info@badgeclaimed.com. The terms of use of the service are in the Terms of Service.
Questions about this document?
Email us: info@badgeclaimed.com