Privacy Policy.
VeriForward stores credential records so that issuing organizations can confirm them and anyone with a link or QR code can check them. The public page for a credential shows the holder's name, credential and status. We do not sell personal information, and we do not show unverified uploads as verified or expose contact details publicly.
This summary helps you read the policy. The full text below is what applies.
01Who this policy covers
This Privacy Policy explains how VeriForward ("VeriForward", "we", "us") collects, uses and shares information when you use veriforward.com, app.veriforward.com, verify.veriforward.com, organization subdomains such as {org}.veriforward.com, custom verification domains we serve, and related services (the "Service"). It is part of our Terms of Service.
Different people interact with the Service in different ways, and this policy addresses each:
- Organization users
- Staff of certification bodies and training providers who claim an organization, import or issue credentials, and verify records.
- Credential holders
- People whose credentials are recorded on the Service, whether imported by an organization or uploaded by the holder.
- Verifiers and visitors
- Anyone who looks up a credential on a public verification page or browses our website.
Our role for holder data
When an issuing organization imports or issues records, that organization decides what credential data to record and is responsible for its own privacy notices to holders. VeriForward processes that data to provide the Service on the organization's behalf. When a holder uploads a certificate directly, VeriForward collects that information from the holder and this policy applies in full.
02Information we collect
Information you provide
- Account details. Name, work email address, password (stored hashed), organization name, role, and the details entered during onboarding such as credential volume ranges and how records are currently stored.
- Credential records. For each credential: holder first and last name, credential type and number, issue and expiration dates, status, and where provided, holder email, phone and city, state and country. Organizations supply these by CSV import, manual entry or issuing a credential in the app.
- Holder uploads. The certificate file you upload (image or PDF), the organization you select or type in, your name and email, and any details you add about the credential.
- Billing information. For paid plans, billing name, address and plan choice. Card numbers are collected and stored by our payment processor, not by VeriForward.
- Support messages. Anything you send us by email or through the Service.
Information collected automatically
- Usage and device data. IP address, browser type, device and operating system, pages viewed, referring URLs, and the date and time of requests.
- Verification activity. When a public verification page is viewed or a QR code is scanned, we record the time, the credential ID and general technical data about the request so organizations can see how often their credentials are checked. We do not require verifiers to identify themselves.
- Cookies and similar technologies. See Section 6.
Information from other sources
Issuing organizations supply holder information when they import or confirm records. If a holder and an organization both supply information about the same credential, we may combine it into one record after the organization reviews the match.
03How we use information
- To create and manage accounts, authenticate users and process organization claims, including checking whether a claimant's email domain matches the organization.
- To store, display and maintain credential records, generate verification pages and QR codes, track expirations and support renewals.
- To route holder uploads to the organization the holder selected, show organizations their pending verification requests, and let organizations confirm, decline or revoke records.
- To send service messages: account and security notices, import results, verification outcomes, and, where an organization enables them, expiration or renewal reminders to holders.
- To contact issuing organizations about pending holder uploads that name them, including organizations that do not yet have an account.
- To process payments, prevent fraud and abuse, enforce our Terms and comply with law.
- To understand how the Service is used, fix problems and improve features, using aggregated or de-identified data wherever practical.
We do not sell personal information, and we do not use holder information for advertising.
04What appears on public verification pages
The purpose of the Service is to make credentials checkable, so some information is public by design. We limit what is shown to what a verifier needs.
| Record state | Shown publicly | Never shown publicly |
|---|---|---|
| Verified by the issuing organization | Holder name, credential type, credential number, issuing organization, status, issue and expiration dates, and a dated history of status changes | Email, phone, street address, uploaded certificate file, account details |
| Self-reported (uploaded, not yet verified) | First name and last initial, credential type, organization named by the holder, year-only dates, and a clear "awaiting verification" or similar label | Full name, certificate number, contact details, certificate file |
| Declined or not verified | The record page remains published and shows the declined status | Any detail beyond what was already public |
| Removed | A notice that the record is unavailable | Everything else |
Pages for unverified uploads are marked not to be indexed by search engines. Pages for verified credentials may be indexed. Credential IDs and verification addresses are permanent so that printed QR codes keep working; when a record is deleted, we may keep a placeholder at its address that displays no personal information.
07How long we keep information
- Credential records
- For as long as the issuing organization keeps them on the Service, plus 60 days after the organization's account ends so the organization can export its data.
- Holder uploads
- Until the holder asks us to remove the upload, the issuing organization declines it and the holder removes it, or we remove it under our Terms. Certificate files for records an organization has confirmed are retained with the record.
- Account details
- For the life of the account and a reasonable period afterward for dispute resolution and legal compliance.
- Verification activity
- Detailed logs are kept for a limited period for security and troubleshooting; aggregated counts may be kept indefinitely.
- Billing records
- As required by tax and accounting law, typically seven years.
Backups may retain copies for a limited time after deletion. We delete or de-identify information when it is no longer needed for the purposes above.
08Your choices and rights
If you are a credential holder
- You can ask us to remove a self-reported upload you made at any time by emailing us from the address you used to upload.
- If an organization imported or verified your credential, the organization controls that record. You can ask us to update or remove it and we will pass your request to the organization, or you can contact the organization directly. We may need to keep a minimal record of a revoked or removed credential so that printed QR codes do not resolve to a different person's record.
- You can ask us for a copy of the personal information we hold about you.
- You can opt out of reminder emails using the link in any reminder. Service and security notices cannot be opted out of while you have an active record or account.
If you are an organization user
- You can view and update account details in Settings, and export your organization's records as CSV at any time.
- You can close your account from Settings or by contacting us. Records remain exportable for 60 days afterward.
Regional rights
Depending on where you live, you may have rights under state or national privacy law to access, correct, delete or port your personal information, to restrict or object to certain processing, and to not be discriminated against for exercising those rights. To exercise them, contact us at the address in Section 13. We will verify your identity before acting on a request and respond within the time required by applicable law. If you are in the European Economic Area or United Kingdom, our legal bases for processing are performance of a contract, our legitimate interests in operating and securing the Service, your consent where you upload a certificate, and compliance with legal obligations.
09Security
We use administrative, technical and physical safeguards appropriate to the sensitivity of the information, including encryption in transit, hashed passwords, access controls limited to staff who need access, and logging of administrative actions. No method of storage or transmission is completely secure, and we cannot guarantee absolute security. If you believe your account has been compromised, contact us immediately.
10Children
The Service is intended for adults and for professional credentials. We do not knowingly collect personal information from anyone under 18. If you believe a minor's information has been recorded on the Service, contact us and we will remove it.
11Where data is stored
VeriForward is based in Georgia, United States, and our servers are located in the United States. If you use the Service from outside the United States, your information will be transferred to and processed in the United States, where privacy laws may differ from those in your location. Where required, we use appropriate safeguards for international transfers.
12Changes to this policy
We may update this policy as the Service changes. We will post the new version here with an updated date and, for material changes, notify organization accounts by email at least 14 days before the change takes effect. Continued use after that date means you accept the updated policy.
13Contact
Questions about this policy, or a request to access, correct or remove information: