Privacy Policy

Last updated: November 2026

Habakkuk Certify is operated by Habakkuk Designs, Cape Town, South Africa. We take the Protection of Personal Information Act (POPIA) seriously. This page explains, in plain language, what we collect and why.

Who is responsible for what

• Organisations (schools, trainers, academies) decide which students to add and which certificates to issue. For student information, the organisation is the responsible party.
• Habakkuk Designs stores and processes that information on the organisation's behalf (as an operator), and is the responsible party for organisation account and billing information.

What we collect

• Organisation accounts: email address, password (stored securely by our authentication provider — we never see it), organisation name, branding and contact details.
• Students: only what is needed for a certificate — full name, and optionally an email address (to send the certificate) and a student number.
• Payments: handled by Paystack. We receive confirmation of payment, the amount and a reference. We never see or store card numbers.
• Security records: a log of who issued or revoked certificates and when, and IP addresses used for rate limiting.

What the public can see

Anyone with a certificate's verification code can see: the recipient's name, the course title, the issuing organisation, the completion and issue dates, the certificate number and whether it is valid or revoked. Email addresses and student numbers are never shown publicly. Verification pages are hidden from search engines.

How long we keep information

Certificate records are kept for as long as the issuing organisation's account exists so that certificates can still be verified. An organisation can delete student records at any time; issued certificates stay verifiable unless revoked. When an organisation closes its account, we delete its data within 90 days, except records we must keep by law (such as payment records).

Where information is stored

Data is stored with Supabase (database and file storage), hosted by Vercel, and emails are sent through Brevo. These providers may store data outside South Africa under appropriate safeguards.

Your rights

You may ask to see, correct or delete your personal information, or object to its processing. Students should contact the organisation that issued their certificate first. You can also contact us at habakkukweb@outlook.com. If you are not satisfied, you may complain to the Information Regulator of South Africa (inforegulator.org.za).

Security

Each organisation's data is separated at database level, files are stored privately, connections are encrypted, and sensitive operations only run on our servers.