Legal

Privacy Policy

Effective October 5, 2026

1. Who we are

Credostar is a digital credentialing platform operated by Thinqzo Technologies Private Limited (“Credostar”, “we”, “us”). We help organizations design, issue, manage, and verify digital certificates, badges, and professional credentials at scale, using the W3C Verifiable Credentials and OpenBadges 3.0 open standards.

This policy explains what personal information we handle in connection with the Credostar website, the Credostar platform, and credentials issued through it. It applies to three groups of people: visitors to credostar.com, our customers (organizations that use Credostar to issue credentials), and recipients of credentials that customers issue through the platform.

For the accounts of our customers’ users and for our website, Credostar is the controller under the EU and UK General Data Protection Regulation (GDPR) and the Data Fiduciary under India’s Digital Personal Data Protection Act, 2023 (DPDP Act). For recipient data, the issuing organization is the controller and Data Fiduciary, and Credostar acts as its processor (Data Processor) under the agreement between us.

2. Information we collect

From website visitors

When you visit credostar.com we collect:

  • Form submissions. If you submit our Design Partner Program application, contact form, partner application, or newsletter signup we store the information you provide (such as name, work email, company, role, and any notes you include) so we can respond and assess fit.
  • Technical request data. Standard server log information including IP address, user agent, referrer, and request timestamps. We use this to operate the site, detect abuse, and produce aggregate analytics.
  • Bot-protection signals. We use Cloudflare Turnstile to distinguish humans from automated traffic on our forms. See the dedicated Cloudflare Turnstile section below for details.

From customers

When your organization signs up for Credostar we collect business contact information for the account administrators, billing details, and any data you upload or generate while using the platform (templates, recipient lists, branding assets, configuration settings). For each user we also keep sign-in sessions, a security log of the changes they make (with IP address and browser), and the version of this policy they agreed to and when.

From credential recipients

When a Credostar customer issues a credential to you, the credential typically contains your name, the credential subject (program name, course title, certification scope), the issue date, and a unique credential identifier. The customer who issued the credential is the controller of that personal information; Credostar processes it on their behalf. We also receive your email address from the customer so we can deliver the credential, and whether the email was delivered and opened. Depending on the program, the issuer may also collect your phone number, date of birth, gender, a government ID, a photo, survey answers and, only if you agree when you register, your location at registration.

3. How we use information

We use the personal information we collect to:

  • Provide, operate, and improve the Credostar platform and website.
  • Issue, deliver, store, and verify credentials on behalf of customers.
  • Communicate with you about your account, applications, the Design Partner Program, security advisories, and product updates.
  • Detect, investigate, and prevent fraud, abuse, and security incidents.
  • Comply with our legal and regulatory obligations.
  • Produce aggregate, de-identified analytics about how the website and platform are used.

We do not sell personal information. We do not use credential data or customer-uploaded data to train third-party machine learning models.

Under the GDPR we rely on these legal bases:

  • Contract (Art. 6(1)(b)): running customer accounts, issuing and delivering credentials.
  • Consent (Art. 6(1)(a)): optional product analytics and session replay in the app, and a participant’s registration details and location when they self-register.
  • Legal obligation (Art. 6(1)(c)): invoices, tax records, and security logs we must keep.
  • Legitimate interests (Art. 6(1)(f)): preventing fraud and abuse and keeping the service secure.

Under the DPDP Act we process personal data on the basis of your consent, given with this notice, or for the legitimate uses the Act allows (such as data you provide voluntarily for a specific purpose, and compliance with law). Consent is always an explicit action, such as ticking a box at sign-up or registration; we record what you agreed to and when. You can withdraw consent as easily as you gave it: change analytics under “Cookie settings” in the app footer, or delete your account. Withdrawal does not affect processing that took place before it.

5. Service providers and sub-processors

We rely on a small set of vendors to operate Credostar. We require each one to maintain appropriate security controls and to process personal information only on our instructions.

  • Cloudflare (United States, with EU and APAC presence). Content delivery, DDoS protection, DNS, and Cloudflare Turnstile bot protection.
  • Zoho Corporation (India, United States, EU). Customer relationship management for applications and contact submissions received through credostar.com.
  • Amazon Web Services (European Union, Stockholm region). Hosting, database, and storage for the Credostar platform.
  • Zoho Corporation: ZeptoMail, Zoho Payments, Zoho CRM (India). Transactional email (credential delivery, verification codes, notifications), card and UPI payments, and partner applications.
  • Razorpay (India). Payment processing for some customers.
  • Sentry (United States). Error monitoring for the platform. Session replay, which records a masked version of your screen, runs only if you allow analytics.
  • Google and Microsoft, only if you choose to sign in with them; LinkedIn, only if you choose to share a credential there.

We maintain an up-to-date list of sub-processors. Enterprise customers can request the current list by emailing [email protected].

6. Cloudflare Turnstile

We use Cloudflare Turnstile to protect our forms (the Design Partner Program application, the newsletter signup, and any other forms we add over time) from automated abuse without requiring you to solve a CAPTCHA puzzle.

When you load a page that contains one of our forms, your browser fetches the Turnstile challenge script from challenges.cloudflare.com. The script performs a series of non-intrusive checks on your browser environment (such as evaluating browser characteristics, rendering behaviour, and network signals) and returns a single-use cryptographic token to our server when you submit the form. Our server then asks Cloudflare to verify that token before accepting your submission.

The data Cloudflare processes for this purpose includes:

  • Your IP address, user agent, and request headers, transmitted to Cloudflare as part of the challenge.
  • A set of browser-derived signals used by Turnstile’s machine learning models to distinguish humans from bots.
  • A short-lived cookie or local-storage value used to remember a recent successful challenge so you are not re-challenged on every form interaction within a short window.

Cloudflare acts as our sub-processor for this purpose. Cloudflare states that it does not use Turnstile data to track users across sites and that Turnstile is designed to avoid the invasive fingerprinting and behavioural profiling associated with traditional CAPTCHA services. Cloudflare’s own description of what Turnstile collects and how it processes that data is published at cloudflare.com/turnstile-privacy-policy and is incorporated into this policy by reference.

Turnstile is required for our forms to function. If you block the Turnstile script (for example with strict browser-extension content blockers) the affected form will not submit; contact us at the address in the contact section and we will accept your enquiry over email instead.

7. International data transfers

Credostar operates from India and hosts the platform in the European Union (Sweden). Personal information we collect may be transferred to and stored on servers located in countries other than your country of residence, including India, the United States, and the European Union. Transfers out of India follow the DPDP Act and any restrictions notified under it. When we transfer personal information out of the European Economic Area, the United Kingdom, or Switzerland we rely on appropriate safeguards, including Standard Contractual Clauses approved by the European Commission.

8. Cookies and tracking

The credostar.com marketing website uses a minimal set of cookies and similar technologies:

  • Strictly necessary cookies. Set by Cloudflare for security, bot protection, and load balancing. These are required for the site to function.
  • Preference cookies. Remember your view-transition state and similar UI preferences. No personal information is stored.

We do not use third-party advertising cookies or cross-site tracking on credostar.com. We do not load Google Analytics or Facebook Pixel on the marketing website.

The Credostar app (app.credostar.com and issuers’ custom domains, including credential pages) uses strictly necessary cookies to keep you signed in. Optional first-party product analytics and Sentry session replay run only after you choose “Allow analytics” in the cookie banner. You can change your choice at any time from “Cookie settings” in the footer; refusing deletes the analytics identifier from your browser.

9. Data retention

We retain personal information only as long as needed for the purposes described above, then delete or anonymize it. Specifically:

  • Application and contact submissions: retained for 24 months after the last interaction, then deleted unless converted to a customer account.
  • Customer account data: retained while the account exists. When a user deletes their account (Account settings, Privacy), their personal details are erased straight away. Sign-ups whose email was never verified are anonymized after 30 days.
  • Security logs: the IP address and browser in our audit log are removed after one year, and log entries are deleted after three years.
  • Product analytics: deleted after 13 months. One-time codes are cleared as soon as they expire.
  • Credentials and verification metadata: retained according to the policy the issuing customer configures, or until the recipient’s erasure request is completed. Premium and Blockchain tier credentials are designed for lifetime verification; Standard tier credentials have a customer-configurable retention window.
  • Server logs: retained for 90 days for security and operational purposes, then aggregated or deleted.

10. Security

We follow the practices documented at credostar.com/security, including encryption in transit and at rest, role-based access controls, audit logging, and credential signing using dedicated keys stored in a managed key management service. We are ISO 27001 certified and undergoing SOC 2 Type II audit.

If a personal data breach occurs we will notify the affected customers and individuals without undue delay, the Data Protection Board of India as the DPDP Act requires, and, where the GDPR applies, the competent supervisory authority within 72 hours.

No internet-connected system is perfectly secure. If you believe you have discovered a security issue, email [email protected].

11. Your rights

Depending on where you live, you have the right to access your personal data and get a copy you can take elsewhere, to correct or complete it, to have it erased, to restrict or object to processing, and to withdraw consent. Under the DPDP Act you may also nominate another person to exercise your rights if you die or become incapacitated, and you have the right to grievance redressal.

How to exercise them:

  • Platform users: in the app, open Account settings, then Privacy. Download your data, see your consents, and delete your account yourself. Edit your details under My Account.
  • Credential recipients: open your credential page and choose “Manage my data”. After a code sent to your email confirms it is you, download everything held about you, ask the issuing organization to erase it, or raise a concern. The issuer must respond within 30 days and you will get an email with the outcome. If it does not respond, contact our Grievance Officer.
  • Website visitors and applicants: email [email protected].

We respond within 30 days, and may ask you to confirm your identity first. You can complain to the Data Protection Board of India, or to the data protection supervisory authority where you live or work. We encourage you to contact our Grievance Officer first so we can put things right.

12. Grievance Officer

Questions, requests, and complaints about personal data are handled by our Grievance Officer at [email protected], Thinqzo Technologies Private Limited, India. We acknowledge every complaint and resolve it within 30 days.

13. Children

Credostar is a B2B platform not directed at children. Platform accounts are for people aged 18 or over, and we do not knowingly collect personal information from children (under 18 in India, under 16 in the EU) directly through credostar.com. Credentials issued through the platform may relate to programs that include minors; in those cases the issuing organization is responsible for obtaining verifiable consent from a parent or guardian, and for not tracking, profiling, or targeting advertising at children, as the DPDP Act requires. Participants who register themselves confirm that they are 18 or older or that a parent or guardian agrees.

14. Changes to this policy

We may update this policy from time to time. When changes are material we will post a notice on credostar.com, show it in the app, and update the “Effective” date above. Where a change needs your consent, we ask for it again before it applies to you; each version you agree to is recorded.

15. Contact

For questions about this Privacy Policy or how we handle personal information: