Privacy policy

Last updated: 14 October 2026

This is a translation for your convenience. Only the German version is legally binding.

1. Controller

We have not appointed a data protection officer because there is no legal obligation to do so.

2. Overview

CertWalk is a free beta of a study aid for the Google Cloud Generative AI Leader exam. We process as little personal data as possible: first and last name, email address, language, timestamps and aggregated usage data. We do not store the content of your conversations with the AI tutor.

3. Purposes, data and legal bases

3.1 Visiting this website (hosting)

When you visit, our hosting provider Cloudflare processes technically necessary data: IP address, date and time, requested address, referrer, browser and operating system. The purpose is to deliver the website securely and reliably and to protect it from attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure operation.

3.2 Audience measurement with Cloudflare Web Analytics

We count page views with Cloudflare Web Analytics. It sets no cookies, stores nothing on your device and creates no profiles. It records aggregated values such as page, referrer, country, device type and load times. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is understanding website use in aggregated form.

3.3 Abuse protection with Cloudflare Turnstile

During registration, sign-in and waitlist sign-up, Cloudflare Turnstile checks whether a human is using the form. Browser and device characteristics and the IP address are sent to Cloudflare for this. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protection against automated sign-ups and abuse. Any access to your device is strictly necessary for this service you requested (Section 25(2) no. 2 TDDDG).

3.4 Registration, sign-in and account

For the beta we store your first and last name, email address, invitation code (not needed if you were approved from the waitlist), language, role, and the time of registration and of your confirmation of the privacy policy and beta terms. To sign in, we email you a link (magic link). It is valid for 15 minutes, can be used once, and we store it only as a cryptographic hash. The legal basis is Art. 6(1)(b) GDPR (use of the beta under the beta terms). First and last name and email address are required for an account (purpose: reviewing access and addressing you personally); without them you cannot take part. We store the time of your confirmation as evidence on the basis of Art. 6(1)(f) GDPR.

3.5 Using the app

In the app we store your learning progress and anonymised usage events, such as answered practice questions, completed simulations and played episodes. We only derive aggregated statistics from them. The legal basis is Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR for the aggregated statistics (improving the beta).

3.6 AI tutor

When you use the AI tutor, we send your question, the conversation so far and relevant sections of the knowledge page via OpenRouter to a language model by Anthropic. The answer is generated and returned to you. We do not store conversation content, only the number of requests, the tokens used and the cost per day. The legal basis is Art. 6(1)(b) GDPR. Please do not enter confidential or personal data into the tutor. How long the providers retain requests depends on their terms; we choose settings that exclude training on your inputs where the providers offer this.Note: the logging and training settings at OpenRouter and Anthropic will be reviewed by a lawyer before any commercial launch.

3.7 Feedback

If you voluntarily give feedback, we store the rating, text, page and language together with your account. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future. We only publish quotes from your feedback if you explicitly and separately agree.

3.8 Waitlist until the beta opens

Until the beta test starts (planned for November 1, 2026) you can join a waitlist – with the form or with “Join the waitlist with Google” (section 3.9). For this we store your email address, your first and last name, the chosen language, whether you signed up via the form or Google, voluntarily your answer to “Are you taking part in Google’s Get Certified program?” (yes, no or prefer not to say), and the times of your consent, of sending the confirmation email, of your confirmation and of the access email.

Purposes: to inform you by email when the beta opens and, once approved, to send you personal access; to allocate beta places fairly and to detect abuse (multiple or fake sign-ups); to address you personally. First and last name are required for this. The program question is voluntary and helps us allocate places; it is only used for the review. There is no newsletter.

Legal bases: for the emails and the voluntary program answer, your consent (Art. 6(1)(a) GDPR); for reviewing sign-ups and detecting abuse, our legitimate interest in fair allocation and protection against abuse (Art. 6(1)(f) GDPR). You can withdraw your consent at any time with effect for the future: via the unsubscribe link in every email or by writing to info@ai-workx.de. When you unsubscribe we delete your entry immediately.

Double opt-in: After signing up with the form we send you an email with a confirmation link. We only use the address after you confirm. The link is valid for 7 days; if you do not confirm, we delete the entry afterwards. If email sending is not set up yet when you sign up, we send the confirmation email later. If you sign up with Google, Google has already verified your address, so no confirmation email is needed. We store the times of consent and confirmation as proof (Art. 7(1) GDPR). Confirmation, unsubscribe and access links are stored only as cryptographic hashes.

Review and approval: The controller personally reviews every confirmed sign-up and approves or rejects it. A program pre-sorts entries and flags anomalies with a traffic light: identical or very similar email addresses or names, known disposable addresses, implausible details, several sign-ups from the same network within 24 hours, sign-ups during a flood. A human always makes the decision. After approval we send you an access email with a personal registration link (valid for 14 days, single use); because of the limited email quota, in waves starting November 1. If rejected, we send no email.

Network identifier (IP hash): We do not store your IP address but a cryptographic hash (HMAC-SHA256 with a secret key) of the network prefix (IPv4: first three blocks, /24; IPv6: first four blocks, /64). The IP address cannot be derived from the hash; the same network yields the same hash. The sole purpose is detecting abuse when allocating beta places; many people share a network (company, mobile), so this flag is never a reason to reject on its own. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in fair allocation and protection against abuse). We delete the hash automatically after 30 days.

Retention: When you unsubscribe we delete your entry immediately; unconfirmed entries 7 days after the confirmation link was sent; rejected entries 30 days after the decision; and the entry within 7 days after your account is created; in any case at the latest 6 months after sign-up. Emails are sent by Resend (see section 5).

3.9 Sign in with Google

Instead of an email link you can use your Google account to sign in, join the waitlist or (with an invitation code) register. We redirect you to Google for this (OpenID Connect, permissions only “openid email profile”). Google learns that you are signing in to CertWalk; Google is itself responsible for this sign-in (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Google privacy policy).

Google sends us your email address, whether it is verified, your first and last name, the address of your profile picture and a Google identifier. Of these we store only the email address and your first and last name; we do not store the profile picture address, the Google identifier or access tokens. If your Google profile lacks a first or last name, you add it on an intermediate page. An account is only created if you have been approved, have a valid invitation code or already have an account.

The legal basis is Art. 6(1)(b) GDPR (sign-in and use of the beta); for joining the waitlist, your consent (Art. 6(1)(a) GDPR), which you give before clicking the Google button. Using Google is voluntary; signing in with an email link always remains possible. We briefly set technically necessary cookies for the process (see section 4).

3.10 Community: referral link, sharing and exam result

Personal referral link: When you share something in the app, we generate a random referral code (10 characters) once and store it with your account. The shared link looks like https://certwalk.com/en/?ref=CODE. If someone joins the waitlist via this link, we store the code with that person’s entry (only if it belongs to an active account). In the review list the controller then sees the note “Referred by” with your first name and the initial of your last name; this is a positive signal, not an automatic approval. An overview visible only to the controller counts referrals per account; there is no public ranking. On the website the code is only read from the address and sent with the form; nothing is stored on your device. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in taking referrals into account when allocating beta places fairly). We remove the code when you delete your account; after that the link no longer counts.

Sharing: The share image is created entirely in your browser. Sharing happens via your device’s share function or by copying the link or downloading the image. We do not embed social media buttons, scripts or trackers. We do not learn what you share or with whom. Your name only appears on the image if you switch it on.

Exam result: You can voluntarily report whether you passed the exam and the date. We store this with your account to improve the beta and to understand how well the preparation helps. The legal basis is your consent (Art. 6(1)(a) GDPR); you can change or delete the report in the app at any time.

Success story: Only if you explicitly consent do we additionally store your first name, the initial of your last name and a short sentence from you (at most 280 characters) plus the time of consent, and CertWalk may then mention you as a success story, for example on this website. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future – in the app (“Withdraw consent” or “Delete report”) or by email to info@ai-workx.de. We then delete the name and sentence immediately and remove anything already published. Please do not include any content from the real exam in your text; Google’s exam agreement prohibits this.

4. Cookies

This website sets no cookies. After you sign in, the app sets exactly one technically necessary cookie: cw_session (HttpOnly, Secure, SameSite=Strict, 30 days) so that you stay signed in. The legal bases are Section 25(2) no. 2 TDDDG and Art. 6(1)(b) GDPR. We do not use tracking or advertising cookies. During a sign-in with Google we additionally set short-lived, technically necessary cookies: cw_oauth (protects the sign-in flow, 10 minutes) and, if details are missing, cw_gpending (intermediate page, 15 minutes); both apply only to /api/auth/google/.

5. Recipients

We use the following service providers as processors (Art. 28 GDPR):

6. Transfers to third countries

These providers are based in the USA. Transfers are based on the European Commission's adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR) where the provider is certified, and otherwise on EU standard contractual clauses (Art. 46(2)(c) GDPR).Note: the providers' DPF certification or standard contractual clauses will be reviewed by a lawyer before any commercial launch.

7. Retention

• Sign-in links: 15 minutes, then invalid; stored only as a hash.
• Sessions: until you sign out, at most 30 days.
• Account, progress and feedback: until you delete your account. When the beta ends, we delete all accounts within 30 days unless you explicitly agree to continued use.
• Usage events: only as long as needed for aggregated statistics; the statistics contain no personal data.
• Tutor: no conversation content on our side; counters for requests, tokens and cost for as long as your account exists.
• Waitlist: immediately when you unsubscribe; unconfirmed entries 7 days after the confirmation link was sent; rejected entries 30 days after the decision; within 7 days after your account is created; within 7 days after the beta launch notice; at the latest 6 months after sign-up.
• Waitlist network identifier (IP hash): 30 days.
• Referral code: until you delete your account; on a referred person’s waitlist entry for as long as that entry exists.
• Exam result and success story: until you delete the report, withdraw consent (then name and sentence immediately) or delete your account.
• Intermediate state of a sign-in with Google: 10 or 15 minutes.
• Server logs and analytics data at Cloudflare: according to Cloudflare's retention periods.

8. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3)).

Right to object: where we process data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation (Art. 21 GDPR).

Write to us at info@ai-workx.de. You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the authority where you live or the one responsible for us: State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de.

9. Deleting your account

You can delete your account yourself at any time: in the app under Settings → Delete account. We then immediately delete your account, sessions, progress, feedback, any reported exam result including the success story, and your referral code. Aggregated statistics without personal data are kept.

10. No automated decisions

We make no decisions within the meaning of Art. 22 GDPR. The exam simulator's evaluation is a study recommendation without legal effect. The pre-sorting of the waitlist (traffic light, section 3.8) is only an aid; a human decides on every approval.

11. Changes

We update this policy when the beta or the law changes. The version published here applies.