Privacy Policy

Information we collect to be able to generate certificates only

Creators (who connect a Patreon campaign)

• From Patreon, when you connect: your Patreon user ID, campaign ID and URL, the email address on your Patreon account, and your campaign’s tiers (names and prices). Only used to generate certificates.
• Patreon access tokens that let us check your members’ status. They are stored encrypted (AES-256-GCM) and used only for membership checks.
• Settings you enter: the name shown on certificates, an optional second creator box, signature line, contact email, logo URL, license wording, banner image and eligible tiers.
• Billing status from Stripe: customer and subscription IDs, plan, billing period and renewal date. Card details are entered on Stripe’s pages and never reach us.

Patrons (who request a certificate)

• The certificate record: the name printed on the certificate (your Patreon name), your Patreon member ID for that creator, the tier name, the certificate ID, the covered dates and its status (valid, expired, revoked).
• Your email address is not stored. When you log in with Patreon or use the email form, we read the email Patreon has on file only to send your certificate. For the email form we keep a one-way hash of the address and your IP address for up to 24 hours, to limit repeated requests.
• Your Patreon login is used once to confirm who you are. We don’t keep your Patreon access token.

Anyone who uses the contact form

• Your name, email address and message are emailed to us and kept in our mailbox as normal correspondence. They are not stored in the PrintProof database. A one-way hash of the address and your IP address are kept for up to 24 hours to limit repeated messages.

Usage and technical information

• An activity log of service events, such as a certificate being issued or refused (with the reason), a verification page being viewed, sign-ups and billing changes. It is linked to the creator account and contains no patron names or email addresses.
• Server logs may briefly record IP addresses, for example when a request is rate-limited.

We do not sell, share, lease or give away your data, or use it in any other way than as intended in this service. The only exception is the providers listed under Service providers we use, which receive information only to run PrintProof.

What is public

A certificate is meant to be shown to buyers. Anyone with its QR code or link can open its verification page, which shows the licensee name, the creator, the tier, the covered dates, the issue date, the certificate ID and whether it is currently valid. Certificate IDs are random and not listed anywhere, but anyone you share a certificate with can see these details.

How we use information

• To run the service: check Patreon membership, issue, email and verify certificates, and show creators their issued certificates.
• To bill creators for paid plans through Stripe.
• To send service emails, such as a certificate copy, a broken Patreon connection, usage limits or billing notices.
• To answer messages you send us.
• To keep the service secure and prevent abuse, such as rate limits.

We don’t send marketing emails, sell or rent personal information, show advertising or build profiles.

Legal bases (EEA, UK and similar laws)

Where these laws apply, we rely on: performance of a contract (providing the service a creator signs up for, and the certificate a patron requests); legitimate interests (letting buyers verify certificates, keeping the service secure, keeping basic usage records); and legal obligations (for example tax records for payments).

Service providers we use

We share information only with the providers needed to run PrintProof, and only for that purpose:

• Patreon: login and membership checks.
• Stripe: payments, invoices and the billing portal for creators.
• Brevo: delivering emails (certificate copies, alerts, contact form messages).
• Cloudflare: secure network connection and protection for the website.
• Google Fonts: the website’s font. Your browser requests it from Google, which receives your IP address.
• Our hosting provider, which stores the database and its backups.

These providers may store and process information outside Canada, mainly in the United States, where it is subject to the laws of those countries and may be accessed by their authorities. We may also disclose information if the law requires it, or to protect the rights and safety of users or the service.

Cookies

We use one essential cookie, sess, which keeps you logged in and lets you download the certificate you just requested. It is signed, can’t be read by scripts and expires after 7 days. Cloudflare may set its own security cookies. We use no analytics or advertising cookies.

How long we keep information

• Creator accounts: while the account is active. When you ask us to delete your account, we remove your settings, tokens and billing references. Stripe keeps its own payment records as the law requires.
• Certificate records: kept so that printed QR codes keep showing the right status. A patron can ask for their certificate records to be deleted, after which those certificates can no longer be verified.
• Activity log: 30 days. Rate-limit records: up to 24 hours. Database backups: 7 days.

Your choices and rights

You can ask us to access, correct, export or delete your personal information, or object to how we use it, by emailing patreoncertificate@aihouselabs.com. We answer within 30 days. Creators can also revoke PrintProof’s access at any time in their Patreon account settings, which stops new certificates and membership checks.

If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada. Depending on where you live (for example in the EEA, the UK or California), you may have further rights, including the right to complain to your local data protection authority. We don’t sell or share personal information for advertising, as those terms are defined in California law.

Security

The website uses HTTPS. Patreon tokens are encrypted, sessions use signed cookies, and admin access is limited to the operator. No method of storage or transmission is completely secure, but we work to protect your information. If a breach creates a real risk of significant harm, we will notify the people affected and the Office of the Privacy Commissioner of Canada, as PIPEDA requires.

Children

PrintProof is not directed at children under 13, and creators must be at least 18. We don’t knowingly collect information from children under 13. If you believe a child has used the service, contact us and we will delete the information.

Changes to this policy

We will update this page when our practices change and change the date at the top. For significant changes we will also email creators.

Contact

Questions or requests: patreoncertificate@aihouselabs.com.