This policy describes what personal data AICA actually collects, why, who processes it on our behalf, and the rights available to you. It applies to every visitor and every form on aicauthority.org, and it reflects AICA's real data practices as of the effective date below, written by AICA directly rather than adapted from a generic template.
This Privacy Policy applies to anyone who visits aicauthority.org, submits a form on the site, applies for or holds an AICA certification, or uses the AICA credential verification registry. It covers AICA's own handling of personal data as the operator of the site. It does not cover the separate privacy practices of Authorized Training Partners (ATPs), who deliver training and proctor exams under their own arrangements with candidates.
"Personal data" in this policy means any information that identifies or could reasonably identify you, such as your name, email address, or the details you submit through a form or a certification application. It does not include information that has been fully anonymized so that it can no longer be linked back to you.
AICA collects personal data in two places: the forms on the site, and the credential registry that supports certification and verification.
Forms live on get-certified.html, contact.html, for-organizations.html, partners.html, and a newsletter signup on resources.html. The exact fields vary by form, but generally include:
Every form includes a hidden honeypot field used only to catch automated spam submissions, and is protected by Google reCAPTCHA v3, which is described in Section 6.
When a credential is issued, the registry that powers AICA's verification service stores: the holder's name, the credential ID, the issue and expiry dates, and the cryptographic signature and transparency log entry associated with that credential. This data is necessary for verification to work at all, since public, checkable verification is the core function of the registry.
AICA does not collect any personal data beyond what is described above. We do not invent additional data categories in this policy that are not actually gathered by the site.
AICA uses the personal data described in Section 2 for the following purposes, and no others:
AICA does not use your personal data for any purpose beyond these, and does not use it to build advertising profiles or sell it to third parties, as set out in Section 9.
For visitors in the European Union, the United Kingdom, and other jurisdictions that require a stated legal basis, AICA relies on one of the following bases for each category of processing:
AICA uses a small number of third-party service providers to operate the site and the registry. Each processes personal data on AICA's behalf and only for the purposes described in this policy.
AICA does not use any other third-party processor beyond those named above.
The site uses cookies and comparable device signals in two places:
You can control cookies through your browser settings. Blocking analytics or reCAPTCHA cookies may affect site analytics accuracy or, in the case of reCAPTCHA, may make it harder for a form submission to be recognized as legitimate.
AICA's service providers, including Supabase, Google, and Vercel, may process and store data in countries other than the one you are located in. Where personal data is transferred internationally, AICA is committed to ensuring it continues to receive an appropriate level of protection consistent with applicable data protection law, and to working with service providers who maintain their own safeguards for cross-border processing.
AICA retains personal data submitted through forms for as long as reasonably needed to fulfill the purpose it was collected for, such as responding to an inquiry or processing a certification application, and not longer than necessary.
Credential registry data is retained for the life of the credential, plus a reasonable period afterward, because the entire purpose of the registry is to allow a credential to be verified, including after it has expired or been revoked. Removing registry data prematurely would defeat the verification service itself. If you have questions about how long a specific record is retained, contact sophia@aicauthority.org.
Depending on where you live, you have rights over your personal data. AICA honors these rights for all visitors, not only where local law strictly requires it.
AICA does not sell personal data. This is a factual statement about our current practice, not a promise contingent on you exercising an opt-out.
The AICA site is not directed at children under 16, and AICA does not knowingly collect personal data from anyone under 16. If you believe a child has submitted personal data to AICA, contact sophia@aicauthority.org and we will address it.
To access, correct, delete, or ask any question about your personal data, email sophia@aicauthority.org. AICA has not named a dedicated Data Protection Officer; correspondence about privacy and data rights should route to this address, and we will respond to verified requests within a reasonable time.
AICA may update this policy as its practices, services, or applicable law change. Where this policy is revised, the effective date below is updated. Material changes will be reflected on this page; continued use of the site after a change takes effect means you accept the updated policy.
This policy is governed by the laws applicable to AICA's operations.
This Privacy Policy is version 1.0, effective July 11, 2026. It describes AICA's actual data practices as of this date. It was written and is maintained by AICA directly.
Email sophia@aicauthority.org and we will respond directly.