Last updated: 23 September 2026
CertStash (“we”, “us”) runs certstash.com and sells digital practice question packs for IT exams. This policy explains what personal information we collect when you visit the site, download a free sample, buy a pack or contact us, how we use it, who we share it with, and the choices you have.
What we collect
- Contact details: your name and email address, and the billing country and address you enter at checkout.
- Order details: what you bought, when, the amount paid, and the download links issued to you, including when those links were used.
- Payment information: card and wallet payments are handled by our payment providers (below). We never see or store your full card number.
- Messages: anything you send us by email, including score reports sent with a refund claim.
- Reviews: if you review a pack, your name as you give it, your rating, your text and any photos you attach.
- Technical information: your IP address, browser and device type, and the pages you visit, collected through server logs and the cookies described below.
How we use it
- To take payment and deliver your purchase, including sending your download links by email.
- To send updated versions of packs you own and messages about your order.
- To handle refund claims under our refund policy and to answer your questions.
- To ask for a review after your purchase. You can ignore or unsubscribe from these requests.
- To send marketing emails, only where you have signed up for them. Every marketing email has an unsubscribe link.
- To keep the site secure: preventing fraud, abuse and scraping (for example, rate limits on free samples).
- To meet legal and tax obligations.
Who we share it with
We do not sell your personal information. We share it only with the service providers that run parts of the store for us, each for the purpose listed:
- Stripe and, where offered, PayPal: payment processing and fraud prevention.
- Brevo: sending order, download and account emails.
- Klaviyo: marketing emails, where you have signed up.
- Hetzner: the server that hosts this site and its database (located in Finland).
We may also disclose information where the law requires it, to enforce our terms, or to protect our rights and the safety of others.
Cookies
The store uses cookies that are needed for it to work: keeping your cart and checkout session, and protecting payments against fraud (set by our payment providers). We do not use advertising cookies. If we add analytics or marketing cookies in future, we will update this policy and ask for consent where the law requires it.
How long we keep it
We keep order and payment records for as long as tax and accounting law requires, and keep your download access for as long as you own the pack. Messages are kept as long as needed to resolve them. You can ask us to delete information we are not required to keep.
Your rights
Depending on where you live, you may have the right to access the personal information we hold about you, correct it, delete it, receive a copy of it, object to or restrict how we use it, and withdraw consent you have given. To use any of these rights, email support@certstash.com. We may need to confirm your identity first, and we will reply within the time the law requires.
If you are in the UK or the European Economic Area and are unhappy with how we handle your information, you can also complain to your local data protection authority.
International transfers
Our providers may process your information outside the country you live in. Where information leaves the UK or the European Economic Area, we rely on the safeguards those providers put in place, such as the European Commission’s Standard Contractual Clauses.
Children
The store is not intended for children, and we do not knowingly collect information from anyone under the age of majority where they live.
Changes
We may update this policy to reflect changes to how we operate or to the law. The date at the top shows the latest version.
Contact
For anything about your personal information, email support@certstash.com.