Privacy Policy
Last updated 7 August 2026 · CertTwin is in closed testing
CertTwin translates official documents into a side-by-side draft you review yourself. Doing that means handling the document you upload and everything written in it. This page says exactly what happens to it. Questions or requests: bigbowl.yuan@gmail.com.
1. What we hold
Your documents
The files you upload and every piece of information in them. For this product that routinely includes names, dates of birth, identity and passport numbers, addresses, family relationships, academic records and financial amounts. Under the GDPR some of this is special-category data.
Your account
Your email address, the display name you sign in with, your Google account identifier if you use Google sign-in, and sign-in timestamps. We never hold a password: sign-in happens through Google or a one-time link sent to your invited address.
Job records
Filename, page count, language pair, processing status, quality-gate results, estimated cost, and an audit log of the review actions you take — what you edited, what you approved, and when.
In your browser
Your language preference and your own job list are kept in your browser's local storage so the page remembers them. This site sets no tracking cookies and runs no analytics — there is no third-party script on any page.
2. Why we may hold it
For visitors in the EEA and the UK, our legal bases under the GDPR are:
- Performance of a contract (Art. 6(1)(b)) — processing your document is the service you asked for.
- Your explicit consent (Art. 9(2)(a)) for any special-category content inside a document. You choose which document to upload, and uploading it is that consent. You can withdraw it at any time by asking us to delete the job.
- Legitimate interests (Art. 6(1)(f)) — keeping the service secure, preventing abuse, and enforcing spending limits.
3. Who else processes it
We use Google Cloud as the sole processor for the pipeline, all in the us-central1 region: Cloud Storage holds the files, Firestore holds job and account records, Cloud Run runs the code, Vertex AI (Gemini) performs extraction and translation, and Cloud Vision performs OCR on scans. Firebase Authentication handles sign-in. Cloudflare delivers this website and rate-limits the API, and therefore sees request metadata such as your IP address.
Your documents are not used to train AI models. Google Cloud's terms for Vertex AI state that customer data submitted to the service is not used to train Google's foundation models. We do not sell data, and we do not share your documents with anyone outside the processors named above.
4. Where it is processed
In the United States. If you are in the EEA or the UK, sending us a document is an international transfer; Google Cloud provides its transfer safeguards through Standard Contractual Clauses and its certification under the EU–US Data Privacy Framework.
5. How long we keep it
| What | Kept for |
|---|---|
| The original file you uploaded | Deleted 1 day after upload |
| Translation artifacts — draft PDF, extracted text, review data | Deleted 30 days after the job |
| Job record — filename, status, cost | Until you ask us to delete it |
| Account record — email, name | Until you ask us to delete it |
Deletion of files is enforced automatically by storage lifecycle rules, not by someone remembering to do it.
6. Your rights
You can ask us for a copy of your data, or to correct it, delete it, restrict or object to its processing, or export it. Email bigbowl.yuan@gmail.com and we will act within 30 days. See also the data deletion page. If you are in the EEA or the UK you may also complain to your national supervisory authority.
7. Security
Files live in a private bucket with public access prevention enabled; downloads use short-lived signed links. The API requires a token on every request and marks every response no-store, so nothing is cached at the edge. Sign-in is invite-only: an email address that Google authenticates but nobody invited is refused.
8. Children
CertTwin is not intended for use by anyone under 16. An adult may of course upload a document that concerns a child, such as a birth certificate.
9. Changes
If this policy changes materially we will say so on this page, and for anything that affects documents already uploaded we will email the address on your account.