Privacy Policy

Last updated 30 September 2026. This policy explains what CertRoll, operated by Femuo at certroll.femuo.com, processes when you preview files, unlock the press, or restore a license. It should be read with the Terms and Refund pages.

1. Who we are

Femuo operates CertRoll. We do not create an account for you. There is no customer login and, in this version, no email-based license recovery. Questions about this policy: reach the operator through the CertRoll site. Do not send roster CSVs or certificate PDFs unless we ask.

2. What stays in your browser

Certificate PDFs are generated on your computer. Recipient names, course lines, dates, issuer names, logos, custom artwork, and CSV rosters are not uploaded to CertRoll servers. We do not store student or attendee lists.

Draft form fields (name, course, date, issuer, selected plate) stay in this browser via localStorage. After you pay, this browser also keeps the license key and, if you copy it, the payment order ID. You can delete that data by clearing site data for certroll.femuo.com. Clearing it does not delete the server-side license record; you can paste the key later on the Unlock page.

3. What we store if you pay

If checkout succeeds, we store only what we need to honor the unlock, in Cloudflare D1:

• a license key;
• a payment order ID (the processor order ID — a PayPal order ID or a Paddle transaction ID);
• the product code cert-bulk;
• a created-at timestamp and an active status.

We do not store card numbers, bank accounts, or the contents of your CSV. We do not get a copy of the unmarked PDF.

4. First-party product counters (not advertising analytics)

CertRoll does not load Google Analytics, Plausible, PostHog, or similar advertising pixels. We do keep small first-party counters so we can see which unlock buttons are used. Unlock-button clicks may send a product name, a coarse source (for example hero or pricing), a path, and a host to our own /api/events endpoint. We persist only aggregated daily totals (day, product, event, source, count) in Cloudflare D1 — not a profile of you, and not license or payment fields.

When checkout starts, the server may increment a matching “order created” counter the same way. Those counters contain no roster names and no license keys.

5. Cookies and similar storage

CertRoll itself does not set a marketing cookie. We use localStorage for drafts and the unlock state, as described above. Our payment processor(s), including PayPal and Paddle, and our host (Cloudflare Pages, D1, and Functions) may set their own cookies or security tokens when you load checkout or when they protect the site. Those are governed by their policies, not by a CertRoll ad-tracking program.

The public site loads fonts from Google Fonts (fonts.googleapis.com / fonts.gstatic.com). Google may process the technical data that a font request normally includes.

6. Payment processors

Payment is handled by our payment processor(s), including PayPal and Paddle. They process the amount, currency, and whatever checkout data they require (for example an account login or a card). Their privacy policy applies to that checkout. We receive back an order ID and a payment result so we can issue or confirm the license.

7. Hosting and infrastructure

The site and APIs run on Cloudflare. Request logs that a host normally keeps (such as IP address, user agent, and URL) may be processed to operate, secure, and debug the service. License and counter tables live in Cloudflare D1 as described above.

8. Retention

• Browser drafts and keys: until you clear site data or overwrite them.
• License rows: kept so we can restore an unlock and avoid issuing two keys for one payment. We may delete or restrict a row if you ask and we can still prevent fraud and double-spend.
• Daily funnel counters: kept as aggregate product metrics, not as a per-person file.
• Processor records: retained by the payment processor(s) under their own rules.

9. Your rights

Depending on where you live, you may have rights to ask what we hold, to correct it, to delete it, or to object to some processing. For CertRoll, the server-side file we can look up is the license row (key, order ID, product code, timestamp). We cannot reconstruct your CSV or PDFs because we never received them.

To make a request, contact the operator through certroll.femuo.com and include the payment order ID. We may refuse a deletion that would let the same payment be reused, or that we must keep under applicable law. This version cannot email a lost license to you.

10. Children

CertRoll is sold as a one-time tool for people who can pay and accept the Terms. It is not directed at children. Do not paste children’s personal data into the press unless you are allowed to produce those layout files and you understand they stay on your machine.

11. Changes

We may update this policy. The date at the top is the latest version. Material changes will appear on this page. Continued use after an update means you accept the revised policy.