QualityforEveryone is committed to the transparent, lawful, and secure processing of your personal data. This Privacy Policy details our data practices under the General Data Protection Regulation (EU) 2016/679 (GDPR).
Data Protection & GDPR ComplianceVersion 2026-10-18
Privacy Policy
Effective Date: October 18, 2026
1. Scope & Data Controller Overview
This Privacy Policy applies to personal data collected and processed through QualityforEveryone.com ('the Platform', 'we', 'our'). QualityforEveryone operates as an independent open educational initiative. We process personal data strictly in accordance with European data protection standards (GDPR) and applicable privacy legislation.
2. Privacy Contact Details & Official Channel
If you have questions about this policy, wish to exercise your data subject rights, or require data protection assistance, you may reach our privacy desk directly via email at qualityforevery1@gmail.com. Inquiries are handled promptly in compliance with statutory response deadlines.
3. Account Registration & Profile Data
When you create an account, we collect your email address, an optional full name for certificate personalization, hashed authentication credentials, preferred language locale, and account role ('learner' or 'admin'). Hashed passwords are encrypted and managed securely via Supabase Auth; we never store or have access to raw plaintext passwords.
4. Authentication, Google OAuth & Account Recovery
You may authenticate using email and password or optional Google OAuth single sign-on. When using Google OAuth, Google provides basic identity verification (email address and profile name) to authenticate your account. We do not access your Google contacts, drive, browsing history, or private Google account data. Account recovery emails are sent exclusively to the registered email address upon verified request.
5. Learning Progress, Assessments & Examination Records
To track your educational achievements, our platform records course enrollments, module completion timestamps, quiz and final examination attempts, answer submissions, calculated percentage scores, and pass/fail statuses. These records are stored in server-side relational databases protected by Row Level Security (RLS).
6. Certificate Issuance, Public Verification & Name Masking
Upon achieving a passing score on a final assessment, a verifiable certificate record is generated with a unique identifier (e.g. QFE-XXXX-XXXX-XXXX). To balance credential authenticity with learner privacy, our Public Verification Registry (/verify) displays only the course title, issue date, exam score, and a privacy-masked name (e.g. Ba*** Ka***). Your unmasked full name is displayed exclusively in your private, authenticated certificate view. Your email address is NEVER disclosed on public verification pages or API endpoints.
7. Technical Logs, Device Information & Rate Limiting
When accessing the platform, standard web server logs record transient technical information such as your IP address, browser user-agent header, request timestamps, and referrers. IP addresses are used in transient memory counters solely to enforce security rate limits and prevent brute-force credential stuffing or denial-of-service attacks.
8. Tracking Technologies & Explicit Exclusion of Analytics Cookies
QualityforEveryone DOES NOT use optional advertising cookies, tracking pixels, retargeting beacons, commercial fingerprinting, or third-party web analytics tools (such as Google Analytics). Only strictly necessary technical session cookies (such as Supabase authentication session tokens and CSRF security headers) are utilized to maintain your authenticated login state and preserve system integrity. Consequently, no cookie consent banner is presented or required.
9. Purposes and Legal Bases Under Article 6 GDPR
We process your personal data based on distinct legal grounds under Article 6(1) of the GDPR: (a) Performance of a contract (Art. 6(1)(b)) to manage your account, deliver educational coursework, grade examinations, and issue verifiable certificates; (b) Legitimate interests (Art. 6(1)(f)) to secure our platform against fraud, enforce rate limits, and maintain the integrity of our public verification registry; and (c) Compliance with legal obligations (Art. 6(1)(c)) where required by applicable law.
10. Data Minimisation & Purpose Limitation Principles
In adherence to GDPR principles, we collect only personal data that is adequate, relevant, and strictly necessary for the educational and credentialing purposes outlined. We do not collect sensitive personal data (special category data under Art. 9 GDPR) such as biometrics, health records, or political affiliations.
11. Third-Party Infrastructure Processors (Vercel & Supabase)
To deliver reliable and secure services, we engage reputable infrastructure providers acting as data processors under binding Data Processing Agreements: (a) Vercel Inc. for frontend edge hosting, content delivery, and serverless compute; and (b) Supabase Inc. for cloud PostgreSQL database hosting and managed authentication infrastructure. Both processors maintain ISO 27001 and SOC 2 Type II certifications.
12. Data Processing Agreements & Disclosures
We do not sell, rent, monetize, or trade your personal data to advertisers, data brokers, or commercial third parties. Disclosures are made only to contracted cloud infrastructure processors bound by confidentiality and security obligations, or when required by lawful court orders or binding governmental requests.
13. International Data Transfers & Chapter V GDPR Safeguards
While our platform serves global learners, infrastructure servers may be situated in the European Union and the United States. Where personal data is transferred across international borders, we ensure adequate safeguards are implemented in compliance with Chapter V of the GDPR, including Standard Contractual Clauses (SCCs) approved by the European Commission and the EU-US Data Privacy Framework.
14. Data Retention Periods & Criteria
We retain your personal data only as long as necessary to fulfill the purposes for which it was collected: (a) Account and learning records are retained while your account remains active; (b) Issued certificate verification records remain in the public registry to provide permanent verification utility unless account deletion or certificate revocation is requested; and (c) Transient server security logs are purged within 30 to 90 days.
15. Technical and Organisational Security Measures (TOMs)
We implement robust security controls designed to safeguard personal data, including: end-to-end TLS 1.3 encryption in transit, salted bcrypt password hashing, Supabase Row Level Security (RLS) policies enforcing database isolation between accounts, automated IP-based rate limiting, strict Content Security Policies (CSP), and automated security testing.
16. Personal Data Breach Notification Protocols
In the unlikely event of a security incident resulting in a personal data breach, we follow documented incident response protocols. We will notify the competent data protection supervisory authority within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to individuals, and notify affected learners directly where a high risk to their rights and freedoms exists.
17. Your Statutory GDPR Rights
Under GDPR Articles 15 through 22, you possess clear legal rights regarding your personal data: (a) Right of access to your data; (b) Right to rectification of inaccurate information; (c) Right to erasure ('right to be forgotten'); (d) Right to restriction of processing; (e) Right to data portability in a machine-readable format; (f) Right to object to processing; and (g) Right to lodge a complaint with an EU data protection supervisory authority.
18. Procedures and Timelines for Exercising Rights
You may exercise any of your data protection rights by submitting an email to qualityforevery1@gmail.com with the subject line 'GDPR Data Subject Request'. We respond to all verified requests without undue delay and at the latest within one calendar month. To protect your privacy and security, we may request verification of your identity before executing requests.
19. Account Deletion & Impact on Issued Credentials
You may permanently delete your account at any time through your Learner Dashboard (/dashboard) or by submitting a request. Deleting your account permanently purges your profile, enrollments, lesson progress, and exam attempts from our active database. When an account is deleted, public certificate registry records may be revoked or deleted upon verified instruction.
20. Children's Privacy Protections
QualityforEveryone is intended for adult learners and students who have reached the digital age of consent (at least 16 years of age in the European Economic Area). We do not knowingly solicit or collect personal data from children under 16. If we become aware that personal data of a child has been collected without verified parental consent, we will take immediate steps to delete such data.
21. Policy Revisions, Changes & Privacy Inquiries
We may update this Privacy Policy to reflect technical, operational, or legal evolutions. Any modifications will be published on this page with an updated effective date. We encourage regular review of this policy. For any privacy-related questions or feedback, please contact us at qualityforevery1@gmail.com.