Free-preview privacy policy
Privacy Policy
This policy explains how CertLuna processes account, learning, and limited technical data during its free, non-commercial preview.
Scope and age
This policy applies to the CertLuna website, authenticated learning workspace, submitted theory assessments, study features, reports, deterministic labs, and privacy requests. The free preview is restricted to account holders who are at least 18 years old.
Data controller
Bednarczyk Gary is the operator of CertLuna and the controller of personal data processed for the platform.
Bednarczyk GaryAvenue de Wezembeek 83, bte 6
1950 Kraainem, Belgium
certluna@gmail.com
Information we process
| Category | Examples | Source | Mandatory? |
|---|---|---|---|
| Account identity | Email address, display name, provider identifiers, session metadata | Google and Supabase Auth | Yes, for an account |
| Learning activity | Submitted answers, scores, corrections, question order, review marks, timing, and topic results | Your activity and CertLuna scoring | Yes, when using scored practice |
| Learning preferences | Study Plan settings, planned exam date, weakness training, bookmarks, and review selections | You and automated educational calculations | Optional by feature |
| Practical progress | Guided lab, Weekly Challenge, and examination CLI completion and results | Your activity and deterministic validation | Optional by feature |
| Reports | Question-report reason, optional free-text detail, status, and related question or attempt | You and CertLuna review activity | Optional |
| Technical and security data | Limited authentication, request, security-event, and application-error information | CertLuna and infrastructure providers | Necessary to secure and diagnose the service |
| Audience and performance measurements | Aggregated page views, referring site, approximate country, browser characteristics, and page-performance measurements without analytics cookies | Cloudflare Web Analytics | Used to understand and improve service usage and performance |
| Launch newsletter | Email address, consent and subscription status, consent or subscription timestamps, and—when selected—one Premium offer interest with a coarse originating-page category | You, when you voluntarily submit the newsletter form | No |
Raw CLI command history is not intentionally retained as a learner-history record. Provider-controlled request or security logs may follow a separate verified lifecycle.
Automated educational calculations
Topic statistics, weakness selection, and study recommendations are educational calculations based on submitted activity. They do not produce legal or similarly significant effects, and they do not make decisions about employment, credit, insurance, or access to public services.
Purposes and legal bases
| Purpose | Data used | Legal basis | GDPR reference |
|---|---|---|---|
| Authenticate and administer the account | Identity and session data | Necessary to provide and administer the free-preview service requested under the Terms | Article 6(1)(b) GDPR |
| Save progress, score practice, and personalize learning | Learning activity, preferences, and practical progress | Necessary to provide and administer the free-preview service requested under the Terms | Article 6(1)(b) GDPR |
| Security, abuse prevention, debugging, and reliability | Technical, authentication, security, and error data | Legitimate interest in operating a safe service | Article 6(1)(f) |
| Measure aggregate audience and page performance | Cookie-free Cloudflare Web Analytics measurements | Legitimate interest in understanding and improving the service | Article 6(1)(f) |
| Send the official-launch announcement and essential CertLuna launch updates | Launch-newsletter email address, consent record, and an optional selected Premium offer interest | Your freely given consent, which you may withdraw at any time | Article 6(1)(a) |
| Meet legal duties | Only records required by the applicable duty | Legal obligation | Article 6(1)(c) |
| Establish, exercise, or defend legal claims | Minimized acceptance, incident, and request records where necessary | Legitimate interest and applicable legal protections | Article 6(1)(f) |
| Future optional tracking or marketing | Not currently collected for these purposes | Consent where legally required | Article 6(1)(a) |
Legitimate interests
Where Article 6(1)(f) is used, CertLuna's interests are protecting accounts, preventing abuse, diagnosing errors, preserving service integrity, and keeping evidence needed to respond to incidents or legal claims. Processing must remain necessary, proportionate, and subject to the learner's applicable rights.
Service providers and recipients
Google supports account selection and identity confirmation. Supabase provides authentication and session management. OpenAI Sites and Cloudflare provide hosted delivery, application runtime, security, application-data infrastructure, and cookie-free web analytics. OVHcloud provides domain and DNS services, and Google Gmail receives messages sent to the published privacy mailbox.
CertLuna does not receive or store your Google password. These providers process information only for their respective technical roles. CertLuna does not sell personal information and does not currently use advertising or behavioral profiling providers.
International processing
A provider may process limited personal data outside the European Economic Area depending on its service configuration and support operations. The applicable transfer mechanism and contractual safeguards must be confirmed for each provider before broad or commercial launch. Further information may be requested through the Privacy Requests page.
Retention schedule
| Category | Period | Trigger or criterion |
|---|---|---|
| Account identity and learning data | While active; inactivity notice after 12 months, then 30 days | Verified sign-in date; delete after the notice period if there is no sign-in or response, except lawful retention |
| CertLuna-controlled security events | Up to 90 days | Event date; a documented incident or legal duty may justify a restricted record for longer |
| CertLuna-controlled application errors | Up to 30 days | Error date |
| Versioned legal acceptance | Account duration plus five years after closure | Closure date, where lawful and necessary for proof of acceptance |
| Provider-controlled logs and backups | Not yet verified | Provider contract, settings, and documented lifecycle must be confirmed before broad or commercial launch |
| Launch-newsletter subscription | Until consent is withdrawn or 90 days after the official-launch announcement | Withdrawal request, unsubscribe action, or completion of the limited launch-notification purpose |
During the free preview, inactivity review and deletion are administered manually under this schedule while automated purge controls are being prepared. Provider-controlled logs and backups follow provider lifecycles that remain subject to the verification described above.
Security
CertLuna uses server-side identity checks, access controls, secure transport, and provider-managed authentication to protect learner records. No online service can promise absolute security. Suspected account misuse should be reported promptly to the contact address.
Your rights
Subject to applicable conditions, you may request access, rectification, erasure, restriction, objection, or portability. Where processing is based on consent, you may withdraw that consent without affecting earlier lawful processing. Requests are handled without undue delay and, after necessary identity verification, within one month unless applicable law permits an extension. See Privacy Requests for the current manual procedure.
Newsletter consent is separate from account access and is never a condition for using CertLuna. Every launch email will provide a withdrawal method. New requests remain pending and no message is sent until address ownership is confirmed through a future double-opt-in flow. If you select a Premium offer in the form, CertLuna stores only that latest selection, a predefined page category, a notice version, and the selection time; it does not store the full URL or a browsing history for this purpose. Until automated email delivery is activated, consent may also be withdrawn through the Privacy Requests procedure.
You also have the right to lodge a complaint with the Belgian Data Protection Authority. Complaint information is available at autoriteprotectiondonnees.be.
Required data and automated recommendations
A verified email identity is required for a preview account. Without it, CertLuna cannot secure or associate learning history with the learner. Topic recommendations and weakness-based practice are educational aids only and do not produce legal or similarly significant effects.
Policy changes
This policy will be reviewed before material new processing, payments, materially different analytics, or advertising are introduced. Material changes will be presented before they take effect when required.
Independence
CertLuna is not affiliated with, endorsed by, sponsored by, or authorized by Cisco Systems, Inc. Cisco and CCNA are trademarks of Cisco Systems, Inc. and/or its affiliates.