How CertTracker collects, uses, stores, and protects your data — including our statement under Malaysia's Personal Data Protection Act 2010 (PDPA).
Last updated: 18 October 2026
CertTracker ("we", "us") is a certificate and license expiry tracking service operated by the owner of the cert-tracker.kamats.online domain. For the purposes of the Personal Data Protection Act 2010 (Malaysia), that operator is the data controller of personal data processed through the service.
Account data: your name, work email address, and a salted password hash. Organization data you enter: employee records, certification and license details, expiry dates, and any documents you upload. Technical data: standard request logs and privacy-friendly, cookie-less aggregate analytics (Cloudflare Web Analytics).
We process personal data only to provide the service you signed up for: operating your account, tracking the certifications you enter, sending expiry-alert and notification emails, keeping the service secure, and — in aggregate, never per-user — understanding how the product is used so we can improve it. We do not sell or rent personal data, and we do not use your data for third-party advertising.
We process personal data on the basis of your consent, given when you create an account or enter data into CertTracker, in line with the Personal Data Protection Act 2010 (Act 709). You may at any time: request access to your personal data; request correction of inaccurate data; request information about what we process and for what purposes; and withdraw consent, which may prevent continued use of the service. Requests and complaints can be sent to the contact address below. On withdrawal, deletion, or account closure we stop active processing, and remaining backup copies age out of our 30-day backup retention.
CertTracker runs on Cloudflare's global network. Structured data is stored in Cloudflare D1 (SQLite) and uploaded documents in Cloudflare R2 object storage. Transactional email (verification, alerts, digests) is delivered through Brevo.
All traffic is encrypted in transit (TLS). Passwords are stored only as salted hashes — never in plain text. Access inside a workspace is role-based (admin, manager, viewer), security-relevant actions are recorded in an audit log, and login and registration endpoints are rate-limited with account lockout after repeated failures.
We take an automated nightly logical dump of the CertTracker database. Each backup is retained for 30 days, after which it is deleted. Uploaded documents are stored in Cloudflare R2, which is designed for high durability. Backups exist for disaster recovery — restoring your data — and are not used for any other purpose.
We keep your data while your account is active. You can delete employees, documents, and exports from within the app at any time, and you can request full account deletion by contacting us. Once deletion is confirmed, remaining copies exist only in the nightly backups, which age out within 30 days.
If we change this statement materially, we will update this page and the "last updated" date above.
Questions, data access or correction requests, or withdrawal of consent can be sent by email to the data controller. We aim to respond within 5 business days.
ken@kamats.dev