Privacy and cookies

ICAP is a training and certification platform. It is a separate system from cippo.care with its own database: creating an account here does not create one there, and vice versa.

Depending on how you use the platform, that is:

• Your account. Email address, name, and optionally a phone number, preferred language and timezone. The name is stored because it is printed on every certificate you earn.
• Your learning. Which courses you enrolled in, which lessons you completed, quiz attempts and answers, assignment submissions, grades, and attendance at live sessions.
• Your credentials. Certificates issued to you, including a snapshot of your name and the course title as they were at the time of issue, plus issue, expiry and any revocation date.
• Payments, if you buy a course: the order, its amount, and a reference from the payment provider. Card numbers never reach this platform.
• Messages you send us through the contact form, and notifications the platform has sent you.
• Security events. An audit log of privileged actions — role changes, price changes, credential issue and revocation — so that a change to what someone is permitted to do can always be traced.

If you are a CIPPO practitioner signing in from cippo.care, we additionally store the identifier cippo.care gives us for you, so the two accounts stay linked. We never match accounts by email address.

The database and application run on Supabase, hosted on AWS in the eu-west-1 region (Ireland). Beyond that, personal data reaches these processors and no others:

• Microsoft 365 — delivers the email this platform sends you, including account confirmation and password resets.
• Kashier — processes card payments. You enter card details on their side; we receive only the result.
• Cloudflare Stream — hosts and delivers course video.
• Zoho CRM — receives enquiries and enrolment events so CIPPO can follow them up.
• cippo.care — for CIPPO practitioners only, and only in one direction: a credential you earn here can be sent there to unlock a service you are then permitted to deliver. Nothing about an external learner is sent to cippo.care.

Certificate verification is deliberately open. Anyone holding a certificate number can look it up on this site without an account and will see the holder's name, the course, the issue and expiry dates, and whether it has been revoked. That is the point of a verifiable credential — a certificate nobody can check is not worth much — but it does mean your name and course are visible to anyone you give the number to.

Nothing else is searchable. A certificate number cannot be guessed from your name, and the verification page never returns a list.

This site sets no advertising or analytics cookies, and loads no third-party tracking scripts. There is nothing to opt out of, which is why you are shown a notice rather than a consent wall.

What the site does keep in your browser:

• Your sign-in session, stored in the browser's local storage so you are not asked to sign in on every page. Signing out removes it.
• Whether you have dismissed the notice at the bottom of the screen, so it does not reappear on every visit.

Clearing site data in your browser removes both. Doing so signs you out; it does not delete anything from your account.

Records of what you were awarded are kept for as long as the credential could reasonably need to be verified — a certificate whose record is deleted can no longer be checked by anyone, including you.

You can see and correct your own account details from your account page at any time. Notification preferences are yours to change. For anything else — a copy of your data, correction of a record you cannot edit, or deletion of your account — use the contact form.

Deleting an account does not withdraw a certificate that has already been issued and verified by others; if that is what you want, say so and it will be handled as a revocation, which is recorded rather than hidden.