Account information
The application stores your name, email, salted password hash, session-token hash, plan, and notification preference. Passwords and tokens are excluded from public certificates.
TRANSPARENT BY DESIGN
Privacy, in plain language.
TrustCertia is operated by LIKE A KING INC, a United States company based in New York. Contact our contact form at /contact about privacy and account requests. This notice describes the current beta service.
Email confirmation and recovery
Registration and password recovery send short-lived codes through our SMTP provider. The server retains code hashes, expiry and attempt counts, not public codes. Password resets invalidate browser sessions and personal agent tokens.
Private agent access
Personal agent tokens are stored as hashes with their scopes, expiry and revocation state. A token can grant access to your project and ownership instructions. Keep it in your client's private credential settings; do not publish it.
Website identity previews
For a website you add, we retrieve its public homepage and published raster logo, and may capture a scripts-disabled screenshot. These previews and their capture timestamps are available privately in the owning workspace. They do not establish ownership or certification.
Business enquiries
If you submit the contact form, we retain your contact name, email, company, domain, interest, message and contact-consent timestamp. Authorized staff can review the request, and SMTP may deliver an internal notification. Submitting a request does not enroll you in marketing or create a subscription.
Public records
Published certificates contain domain, scan evidence, disclosures, dates, and status history. Reviews display the reviewer’s profile name, stars, opinion, comment, and date; email addresses are not published.
Cookies & offline storage
An HttpOnly, SameSite session cookie authenticates your account. The badge sets no cookies. The PWA caches only public offline assets, never account data, certificate responses, or badge status.
Reports and security
Concern reports are retained privately for authorized administrator review. Local request limits retain a request key briefly; a trusted reverse proxy may provide the client IP.
Optional processors
When configured, Stripe processes subscriptions and an SMTP provider delivers emails. Verify provider agreements, retention, hosting location, and data transfer requirements before launching.
Retention & rights
The development adapter retains account and evidence data on its persistent disk. Operators must set retention, backup, deletion and export procedures, identify their controller, and provide a contact for access, correction, objection, and deletion requests before production.