What we collect
Service-fit inquiry details you submit without an account; account identifiers supplied by the sign-in service; application and support details you submit; product documents and the information extracted from them; workspace activity, broker invitation and review records, access decisions, optional feedback, CPSC submission authorization and status records; customer-provided CPSC API credentials when the connection feature is used; payment status identifiers supplied by Stripe; and, with your permission, anonymous website usage and performance information supplied through Google Analytics and Cloudflare Web Analytics.
Why we use it
To screen and manage access, provide the requested preparation, customer-authorized Product Registry submission, and broker-collaboration services, store and retrieve your workspace records, support customers, improve the product, prevent misuse, and maintain operational and billing records.
Where information is handled
The service uses hosted site infrastructure for application records and private document storage. Stripe collects and processes payment-card details on its hosted checkout page. CertifyPreflight does not need to store full card numbers.
Optional AI Guide
The AI Guide is used only after you submit a question. Your question is sent to OpenAI to generate a response. If you separately choose Use my current workspace checklist, CertifyPreflight also sends a limited summary of application and checklist values. Uploaded file bytes, document text, evidence quotations, identity, and payment details are excluded. CertifyPreflight does not save an AI chat history, and API responses are requested without OpenAI application-state storage. OpenAI may retain limited abuse-monitoring logs under its API data policy.
Analytics and campaign measurement
CertifyPreflight records campaign labels included in a visit, such as UTM parameters and Google click identifiers, so a fit check or application can be connected to the campaign that produced it. Google Analytics, Google Ads campaign measurement, and Cloudflare Web Analytics load only after you choose Allow analytics. Cloudflare Web Analytics supplies privacy-first page-usage and performance measurements, while Google measurement connects consented visits with campaign outcomes. A successful fit check or application may send an anonymous conversion signal, but we do not send names, email addresses, business summaries, product descriptions, uploaded documents, or payment-card details to either analytics provider, and Google advertising-personalization signals are disabled.
CPSC connection and submission
Customer-provided CPSC API credentials are encrypted at rest and used server-side to verify authorized Product Registry access. Credentials are never added to the saved browser workspace. Before every import, CertifyPreflight rechecks the selected collection’s live CPSC roles. Certification is requested only when CPSC returns the Certifier role and the user gives a separate certification authorization; otherwise the record is imported for later certification. CertifyPreflight stores the resulting import identifier, requested action, and validation status. The Product Registry does not transmit the broker’s separate ACE filing.
Broker collaboration
A customer may create a time-limited invitation for a specific broker email address. After signing in with that address and enabling two-step verification, the broker can view only the fixed case snapshot selected for sharing and can add review notes, request changes, or record review completion. Original uploaded files, CPSC credentials, payment data, and other customer workspaces are not included. The customer can revoke access, and invitation and review activity is recorded.
Professional-interest requests
The public broker and laboratory interest forms collect only an organization name, professional role, work email, selected area of interest, short professional-context note, consent records, and limited campaign attribution. They do not accept files, reports, shipment identifiers, CPSC credentials, payment data, sensitive evidence, or confidential case records. Any license, qualification, or accreditation mentioned by the submitter is self-reported and remains unverified until human review. Submission does not create a partnership, referral arrangement, endorsement, service commitment, filing action, or response-time promise.
Professional-interest use and retention
Professional-interest requests are used for human review, routing, abuse prevention, and, when appropriate, direct contact about the submitted request. They are not used to provide public AI support or make an automated partnership decision. CertifyPreflight keeps these requests for up to 24 months, then deletes or de-identifies them unless a longer period is needed for legal, contractual, security, dispute, or abuse-prevention reasons.
Who can see it
The signed-in customer can access their own workspace records. A broker can access a shared case snapshot only after accepting an active invitation addressed to the broker’s signed-in email. Designated CertifyPreflight operators can review service-fit inquiries, applications, support requests, access records, customer feedback, and limited submission audit records needed to support the service. Service providers may process information only to operate the product. CPSC receives certificate data only after an authorized Product Registry import; CBP does not receive workspace data from this Product Registry connection.
Retention and deletion
Beta records are kept while needed to provide the service, resolve disputes, secure the product, and meet legitimate business or legal obligations. Customers can permanently delete individual uploaded documents from their authenticated workspace. Submit an account-wide Data access or deletion request through Support; verified requests are handled manually, with a target of 30 days unless retention is required.
Your choices
Do not upload information you are not authorized to share. You may request access, correction, or deletion of your information through Support. You can revisit optional analytics consent at any time using Analytics choices in the footer. Optional survey feedback is private by default, and quote follow-up consent never publishes a testimonial automatically.
Questions: Use the
private Support form. Do not send passwords, API keys, payment-card details, or sensitive product files by email.