Your information, handled plainly.

CertNow operates the website at certnow.uk and provides digital workflows for UK gas engineers to prepare, issue, store and share job records, certificates and related documents. In this notice, “CertNow”, “we”, “us” and “our” refer to the operator of the CertNow service.

For privacy questions or requests, email kelvin@certnow.uk.

The service is intended for business users and adults. It is not designed for use by children.

CertNow is a controller for information used to run our website, manage accounts, bill subscribers, secure and improve the service, provide support, and conduct our own business outreach.

Gas engineers and their businesses normally decide why customer, landlord, property and job information is entered into CertNow. For that information, the engineer or business is normally the controller and CertNow provides the processing platform. If you are a landlord, tenant or customer asking about a job record, contacting the relevant engineer first is usually the fastest route. We will assist where we can.

The information we process depends on how you use CertNow. It can include:

• Account and profile information: name, email address, date of birth, profession, company details, telephone number, trade qualifications, Gas Safe identifiers and account settings.
• Job and certificate information: property and landlord details, site contact information, access notes, appliance details, inspection results, safety classifications, signatures, photographs, certificates, service history and delivery records.
• Invoice and billing information: invoice details, standard rates, bank-transfer details, subscription status and identifiers supplied by our payment provider. CertNow does not store full payment card details.
• Public request information: details submitted through landlord request, property and job-prefill links, including contact information, property address, preferred dates and access notes.
• Free tool information: the email address you give when you download a document from one of our free tools, with the time and which tool it came from. We do not store the certificate or record itself, or anything you typed into it — a working copy is kept in your own browser while you fill the form in, and never sent to us.
• Technical and usage information: IP address, browser and device information, page visits, feature events, security records, diagnostics, errors and performance data.
• Optional voice input: short recordings submitted for transcription when the CP12 voice-entry feature is used. CertNow uses the returned transcript to identify readings and does not save the audio as a user-accessible recording.

We use information for the following purposes and legal bases:

Where we rely on legitimate interests, we consider the necessity of the processing and balance it against the rights and reasonable expectations of the people affected. We do not use personal information for solely automated decisions that produce legal or similarly significant effects.

We conduct small-scale outreach to relevant UK businesses to introduce CertNow and request product feedback. We may collect a business name, town, website, public business email or business contact email, company type and status, Gas Safe verification, source URL, communication history and response status.

Sources can include Google Business Profiles and Maps, a business’s own website, Companies House, the Gas Safe Register and other publicly accessible business directories. We use rule-based checks and human approval to decide whether a record is suitable for outreach. Those checks do not make a legal or similarly significant decision about anyone.

Our cold-email workflow is intended for verified corporate subscribers. We do not treat sole traders, ordinary partnerships or unknown business types as eligible for unsolicited email unless an appropriate permission or exception applies. A typical sequence contains one introductory email and one follow-up if no reply is detected.

Outreach links may contain campaign parameters so we can understand whether a visit came from an email. We do not add an email-open tracking pixel to these messages.

We publish free tools that anyone can use without an account, including a CP12 generator, a boiler service record generator and a gas rate calculator. They are deliberately built to keep as little as possible.

Nothing you type into a free tool is stored by us. The property address, landlord details, appliance details, readings, classifications and your signature exist on our servers only for as long as it takes to produce your PDF, and are then discarded. We keep no copy of the document, which also means we cannot re-send one you have lost or reissue it later.

So that a refresh or a closed tab does not cost you a certificate you have nearly finished, the free certificate tools keep your answers in your own browser's local storage while you work. That copy stays on your device, is never transmitted to us, is cleared once you download the document, and expires by itself after seven days. You can remove it at any time by clearing site data in your browser, or by choosing to start a blank form.

If you choose to create an account from the free tool, the certificate you were working on is carried across in the same way — through your browser — and is only saved to our systems when you confirm you want to keep it. Until you do, we still hold nothing.

When you ask us to email the finished document we store your email address, the time, and which tool you used. Nothing else. We use it to send you the document you asked for and to contact you about CertNow. Our legal basis is legitimate interests in promoting our own similar products to someone who has used one of them; you can object at any time and we will stop.

The free certificate tools offer address search. If you use it, what you type in the search box is sent to our address provider (Ideal Postcodes) to return matches. We do not store the search or the result. Typing the address in manually instead avoids that entirely, and the manual fields are always available.

The gas rate calculator asks for no email at all and runs entirely in your browser — the figures you enter are never sent to us.

We use specialist providers to operate CertNow. Depending on the feature, these currently include:

• Supabase for authentication, database and file storage.
• Vercel for application hosting and delivery.
• Stripe for subscriptions and payment processing.
• Resend and Google Gmail for transactional and business email.
• Airtable and Make for the controlled business-outreach workflow.
• PostHog EU Cloud for restricted product analytics and masked session replay.
• Sentry for error reporting and performance diagnostics.
• Ideal Postcodes for address search and formatting.
• OpenAI for optional voice transcription of spoken appliance readings.

We may also share information with professional advisers, regulators, courts, law enforcement or another organisation where required by law, needed to protect rights and safety, or connected with a genuine business reorganisation. We do not sell personal information.

Some providers may process information outside the UK. Where UK data-protection law requires safeguards, we use providers and arrangements designed to protect the information, such as applicable adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to standard contractual clauses. You can contact us for more information about the safeguards relevant to your information.

We keep information only for as long as it is reasonably needed for the purpose for which it was collected, including providing the service, maintaining certificate and property history, meeting accounting or legal duties, resolving disputes, preventing fraud and establishing or defending legal claims.

• Account and profile information is normally kept while the account is active and for a limited period afterwards for support, security and legal purposes.
• Issued certificates, job documents and property history may need to be retained for longer because they form compliance and service records.
• Billing and invoice records are kept for the period required by applicable accounting and tax rules.
• Outreach lead information is reviewed against the continuing campaign need. Suppression information can be retained for longer so that an objection continues to be respected.
• Free tool email addresses are kept while they remain useful for contacting you about CertNow, and are deleted on request. The documents produced by those tools are never stored at all.
• Security logs and backups are retained on rolling schedules and then deleted or overwritten.

When information is no longer required, we delete it or anonymise it. Exact periods can vary according to record type, account status and legal requirements.

We use technical and organisational measures designed to protect information, including authenticated account access, scoped database permissions, restricted service credentials, encrypted connections and tokenised public links.

Property, certificate, job and prefill links can be shared without requiring the recipient to create an account. These links use hard-to-guess tokens, but anyone who receives a valid link may be able to view the information made available through it. Users should share them only with intended recipients and contact us if a link may have been exposed.

No online service can guarantee absolute security. Please tell us promptly if you believe an account, document or link has been accessed improperly.

Depending on the circumstances and legal basis, you may have rights to access, correct, erase or restrict personal information, receive a portable copy, and object to processing. If processing is based on consent, you can withdraw that consent without affecting earlier lawful processing.

Some rights are not absolute. For example, we may need to retain certain records to meet legal duties or establish or defend claims. We may ask for information needed to verify identity before completing a request.

The right to object to processing for direct marketing is absolute. Use the contact details below or reply directly to the relevant email.

CertNow uses essential session technology to keep signed-in users authenticated and secure. These functions are necessary for the service.

Our PostHog configuration uses memory-only persistence rather than cookies, local storage or session storage. It respects browser Do Not Track settings. Session replay masks all input values and rendered text so that names, addresses, job details and certificate content are not intentionally captured in replay. Analytics events are designed not to include names, email addresses, telephone numbers or property addresses.

External services opened from CertNow, such as Stripe’s hosted payment pages, may use their own necessary technologies under their own notices.

To ask a question, exercise a privacy right or object to direct marketing, email kelvin@certnow.uk. Please use “Privacy request” in the subject line.

We would like the opportunity to resolve a concern directly. You also have the right to complain to the UK Information Commissioner’s Office through ico.org.uk/make-a-complaint.

We may update this notice as CertNow, our providers or the law changes. Material changes will be highlighted through the service or another appropriate channel, and the date at the top will be updated.