Privacy Policy

The business responsible for the processing of personal information is States University, which operates States University. For any matter related to personal information and privacy, the contact channel is support@states.university.

• Certificate holder information: full name, email address, ID number (with its type and issuing country, when provided) and date of birth. Purpose: to identify the certificate holder unambiguously in the certificate record and verify its authenticity, preventing confusion between people with the same name, fraud and certificates issued in the name of others.
• Assessment information: results and performance on the exams linked to the certificate.
• Account, purchase and subscription information: details needed to provide the courses and enrollments purchased. Payments are handled by the payment processor; States University does not store full card numbers.
• Contact and support: name, email address and the message the user sends voluntarily (contact form and correction or deletion requests).
• Browsing and device information: technical data, aggregate usage measurement and advertising measurement identifiers, as described in the Cookie Policy.

States University does not sell personal information. The ID number and date of birth are never shown publicly and are used only to verify identity and prevent fraud.

Personal information is used to provide the services the user requests (courses, enrollments, and the issuance and maintenance of a certificate requested by the certificate holder or by a partner organization on the holder’s behalf); with consent (publishing a certificate on a public profile); for security, fraud prevention and the integrity of the record; to measure and improve the service and its advertising; and to comply with legal obligations, when applicable.

A certificate record is long-lasting by nature: the purpose of a certificate is that it can be verified years after issuance, by an employer, an institution or the certificate holder. For that reason, the certificate record (number, course, dates and status) is kept for as long as the verification service exists.

This does not mean that personal information stays exposed: the certificate holder can keep the certificate private, ask for corrections or request the deletion of personal information (Section 7). In that case, only the minimum needed for the integrity of the record is kept, such as the certificate number and its status, with no public display of the holder’s information. Records of contact and deletion requests are kept as evidence that the request was handled.

Every certificate is private when issued. It appears on a public page only if the certificate holder expressly authorizes it, at issuance or later, and the holder separately decides whether the holder’s name is shown on that page. Consent can be withdrawn at any time, which makes the certificate private again; verification by someone who has the exact certificate number continues to work.

Personal information is disclosed only to service providers that make the service possible (hosting and database, email delivery, file storage, analytics and advertising measurement, and payment processing), under contract and only to the extent necessary. Partner organizations that request an issuance can access only the data of the certificates they issued. Because the platform and its providers operate in several countries, personal information may be processed in the United States and in other countries; in that case, the safeguards required by applicable law are applied.

You can request access to your personal information, its correction when it is incomplete or inaccurate, its deletion or de-identification, a copy of the information you provided in a portable format, and the withdrawal of consent to publication. Use the data deletion and correction page or write to support@states.university. Before a request is fulfilled, ownership is verified to protect your own information.

Any rights granted by the privacy laws of your state of residence apply even if they are not described in this Policy.

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA), gives you the right to: know what personal information is collected, used and disclosed, and to access it; delete personal information; correct inaccurate personal information; opt out of the sale or sharing of personal information; and not be discriminated against for exercising these rights.

The categories of personal information collected in the last 12 months are those listed in Section 2 (identifiers, such as name, email address and ID number; assessment and purchase information; and internet activity information). They are collected from the user directly, from partner organizations that request an issuance and from the user’s browser or device. The purposes are described in Section 3, and the categories of recipients in Section 6. Sensitive personal information (such as the ID number) is used only to verify identity and prevent fraud, and not to infer characteristics about the user.

To exercise these rights, use the data deletion and correction page or write to support@states.university. An authorized agent may submit a request on your behalf with proof of authorization. States University verifies each request by matching the information provided with the information on record (for example, the email address used at issuance) and responds within the time required by law.

States University does not sell personal information. The site uses advertising measurement tools (such as pixels and conversion identifiers from advertising platforms, described in the Cookie Policy) to measure the results of its campaigns. Under California law, some of this activity may be considered “sharing” for cross-context behavioral advertising.

To opt out of sharing, write to support@states.university with the subject “Do Not Sell or Share”, or submit a request on the data deletion and correction page. You can also block or delete advertising cookies in your browser settings.

The platform is not directed to children under 13, and States University does not knowingly collect personal information from children under 13. Children under 13 may not create an account, enroll in a course or request a certificate. If States University learns that it has collected personal information from a child under 13, it deletes that information. A parent or guardian who believes this has happened can write to support@states.university.

Cookies and similar technologies are used for essential operation, aggregate measurement and advertising measurement, as described in the Cookie Policy. Transactional emails (issuance, verification, support) may measure delivery and opens to ensure the quality of the service.

Technical and organizational measures are used to protect personal information: access control, encryption in transit, separation of identification data (which never appears in public verification) and audit logs of issuance. No system is 100% secure, but risks are reduced on an ongoing basis.

The certificate holder’s public profile, and each certificate shown on it, are private by default. Publishing is always the certificate holder’s decision: nothing appears on a public page unless the holder turns on the option in the portal, and the holder separately decides whether the name is shown.

Each contact detail has its own separate consent: email address, phone number and WhatsApp are enabled one by one, and enabling one does not enable the others. Any of them can be withdrawn at any time in the portal, without giving a reason and without contacting support.

Unpublishing takes effect immediately: the page stops being available at that moment and is no longer offered to search engines. Verification by the exact certificate number keeps working for anyone who holds the certificate; this preserves the usefulness of the record without exposing the certificate holder.

To view and download certificates in the holder portal, the certificate holder enters the ID number and date of birth, the same information that identifies the holder unambiguously at issuance. The lookup returns only the certificates linked to that pair of details.

To change information, change a certificate’s privacy setting or request its deletion, a second step is required: a 6-digit code sent to the email address registered at issuance. No change is applied without that code.

This processing is based on consent, for publication and display of contact details, and on the certificate holder’s security, for identity verification, which is what prevents a third party from changing, unpublishing or deleting another person’s certificate.

This Policy may be updated; the version in effect is the one published on this page, with the date shown at the top. The English version is the only version of this Policy.