Privacy Policy
How ANQA Labs handles information on the CredVerse platform.
Information We Collect
- Account information: name, email, organization details
- Usage data: IP address, browser type, and security activity logs
- Credential data: recipient name and email, issue dates, and verification records
- Payment information, if paid checkout is offered: processed by Stripe
How We Protect Your Data
- Row Level Security (RLS) isolates each organization's data
- Credential records include cryptographic signatures and hashes
- Issuer private keys are encrypted with AES-256-GCM before database storage
- Production traffic is served over HTTPS
Data Storage & Processing
- Application data is stored with Supabase
- Stripe processes payments when paid checkout is enabled
- Transactional email is delivered through Resend when configured
- Public page traffic and performance are measured with Vercel
- Public verification pages expose only an allowlisted credential projection
Operator and Purposes
ANQA Labs operates CredVerse from Colombo, Sri Lanka. We use account and organization details to provide access, issuer management, support, and security. We use credential and recipient details to issue, deliver, store, and verify credentials. We use technical and activity data to operate the service, prevent abuse, and understand public page performance. Issuers provide much of the recipient data and remain responsible for what they submit.
Public Verification
A credential verification link can be shared with anyone. People with that link can view the public verification record including the recipient's name, skills and credential status. Recipient email and private metadata are excluded from the public page. Anonymous machine-readable export is withheld when the signed document contains recipient email or metadata; authorized issuer exports may still contain those fields. Do not share a verification link with people you do not want to see the public details.
Data Requests
You can update certain profile details in the app. To request access to, correction of, export of, or deletion of personal information, contact our support team. We review requests under applicable requirements and any necessary retention obligations.
Retention and Locations
We retain information while needed to provide accounts, credential verification, security, and required records. Retention varies by data type; a complete schedule is still being finalized. Our service providers may process data outside Sri Lanka. Contact us for details relevant to your organization or a specific request.
Third-Party Services
We use third-party service providers to help us operate our business, including Supabase for application data, Vercel for hosting and public page measurement, and Resend for email delivery when configured. Stripe processes payments if paid checkout is enabled. Contact us for current vendor and data-handling information before making a procurement decision.
Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the effective date. Your continued use of the platform after any changes indicates your acceptance of the updated policy.
Contact Us
ANQA Labs operates CredVerse from Colombo, Sri Lanka. For privacy questions or data requests, contact privacy@credverse.live.
Draft last reviewed September 25, 2026. Qualified legal counsel must review this page before production release.