Who we are
Certificate of Authenticity Template (certificateofauthenticitytemplate.com) is run by Glenwhisper Limited, a company incorporated in Hong Kong (glenwhisper.com), "we" or "us". HK Business Registration No. 76935415. Registered office: Unit 1603, 16/F, The L. Plaza, 367-375 Queen's Road Central, Sheung Wan, Hong Kong.
We are responsible for the personal data described here: its "controller" under the UK and EU GDPR, and its "data user" under Hong Kong's Personal Data (Privacy) Ordinance (Cap. 486, the "PDPO"). To ask about your data, use our contact form and choose "My account or saved certificates" as the topic.
You decide what goes on a certificate, such as a buyer's name, and you are responsible for having the right to include it. For the content of a saved certificate we act on your instructions: we store it so you can reprint, reissue or make the next edition, and for nothing else. Our data processing terms set this out, with the list of sub-processors.
Your certificates and photos
The form, the live preview and every download (PDF, image, SVG and the foil package) are made inside your web browser on your own device. When you add an artwork photo, a logo or a signature image, the file is read there too.
- Local-first storage. Your certificate drafts and the images you add are saved in your browser's storage (IndexedDB) on this device, so you can close the tab and carry on later. We cannot read it. It stays until you delete the draft or clear this site's data in your browser settings.
- Photos are not uploaded until you save to an account. Then a print-size copy is made in your browser, with location (GPS) and camera data removed, and that copy is uploaded.
- We never put certificate details in page addresses (URLs), so they do not end up in server logs or browser history from our links.
- The files you download are created on your device and go straight to your downloads folder.
- Your images are never used to train or run AI models, and we never edit or recolor them.
Stored in your browser
Besides the session cookie described under Cookies and analytics, the site keeps these items in your browser's own storage on this device. "Local storage" lasts until you clear this site's data; "session storage" is removed when you close the tab.
| Name | What it holds | How long |
|---|---|---|
coa (IndexedDB) | Your certificate drafts (details, design and settings) and the photos, logos and signatures you add. | Until you delete a draft or clear this site's data. |
coa:anon (local storage) |
A random browser ID (for example anon_k2j8…). It is sent only with the anonymous design log, so saves from the same browser
can be grouped. Drafts made in this browser move into your account inside the browser when you sign up or log in; the ID is not sent for that.
| Until you clear this site's data; replaced when you log out. |
coa:log-key (local storage) | A random secret, never sent. Your browser uses it to make the draft number in the anonymous design log, so that number is not your certificate's ID and the log cannot be matched to your account. | Until you clear this site's data; replaced when you log out. |
coa:owner (local storage) | A scrambled key for the account signed in on this browser (no email), so the right drafts show on a shared computer. | Removed when you log out. |
coa:pending (session storage) | The draft you just started on the home page, handed to the editor in case your browser blocks IndexedDB. It never leaves your device. | Removed as soon as the editor opens it, or when you close the tab. |
coa:editor-open (session storage) | The ID of the draft open in this tab, so switching design from the gallery keeps your details. It never leaves your device. | Until you close the tab. |
coa:signed-in (local storage) | A yes/no note that you are signed in (no email or token), so the menu can show "Account". | Removed when you log out. |
coa:consent (local storage)
| Your analytics choice ("Allow analytics" or "No thanks"). | Until you change it or clear this site's data. |
coa:consent-dismissed (session storage)
| A note that you closed the cookie notice without choosing, so it does not reappear on every page. | Until you close the tab. |
Open tabs of the site also tell each other when you log in or out (a browser feature called a BroadcastChannel, named coa:session), so every tab shows the
same signed-in state. Nothing is stored or sent anywhere by it.
Anonymous design log
To learn how people use the editor, it sends a short summary of your design choices to our database (Cloudflare D1) from time to time while you work. It is
linked to a random ID created by your browser (for example anon_k2j8…) and a draft number your browser derives with a secret it never sends, not to your
name, your email or your account: the draft number is not your certificate's ID, so the log cannot be matched to your saved certificates. It contains:
- the design: which of the ten designs, the paper size and orientation, the color variant, the finish and whether low-ink is on;
- the issuer type (artist, studio or gallery) and the edition type (original, limited, open, artist proof or none);
- which fields were filled in (their names, such as "medium" or "year", never what you wrote) and yes/no notes for a photo, logo or signature;
- how many edits and saves there were, your country (two letters, worked out by Cloudflare from your connection) and the dates of the first and last save.
It never contains what is on your certificate: no titles, names, statements, numbers, web addresses, photos or signatures. In Europe it is sent only if you allow analytics. Legal basis: our legitimate interest in improving the tool (in Europe, your consent). Design log rows are deleted 400 days after their last save.
Accounts and saved certificates
You need a free account to download the finished certificate. When you create one, we store:
| What | Details | How long |
|---|---|---|
| Your account | Your email address and your password, scrambled with PBKDF2-SHA256 and a random salt (we never store or see the password itself), the date you joined and last logged in, and your country (two letters) at sign-up. | Until you delete your account. |
| Sign-in sessions | A hashed copy of the token in your session cookie, with its start and expiry time. | Until you log out or the session expires. |
| Saved certificates | The certificate you are working on, and a fixed copy of each version you downloaded (an issued record), so you can reprint exactly what you issued, reissue it or make the next edition. | Until you delete the certificate (removed for good 30 days later) or your account. |
| Issuer details | The issuer profiles you save: name, role, the contact details and website you choose to add, a default statement and signature name, and your logo and signature images. | Until you delete them or your account. |
| Images | Artwork photos, logos and signatures you save (PNG, JPEG or WebP, up to 8 MB each, 30 per account), stored privately in Cloudflare R2 with location data removed. Only you can load them. | Until you delete them (the record is removed 30 days later) or your account. |
Legal basis: performing our agreement with you (providing the account you asked for). We use your email address to run your account and to answer you, not for marketing.
Password resets. If you ask to reset your password, a single-use reset link is created. For now it is sent to our team inbox and a person on our team forwards it to your email address, usually within one working day. The link expires after 72 hours.
Deleting your account. Deleting your account in Account settings removes your saved certificates, their issued records, your issuer details, your images and your sessions right away. We keep only an empty record of the account ID and the date it was created, with your email address, country and sign-in dates removed, so the account ID cannot be reused. Your rows in the download log are unlinked from you and from the certificate.
Download log
Each time a certificate is downloaded, we record how: the format (PDF, PNG, JPEG, SVG, foil package or blank PDF), the design, paper size, orientation and finish, whether low-ink was on and whether it had a photo, the date and your country. Never what is on the certificate. It is linked to your account so we can see how the tool is used. Download log rows are deleted after 24 months; on account deletion they are unlinked from you.
Contact form
When you send a message, we store your name, email address, topic and message, the page you sent it from, the date and time and your country (two letters) in our database, and our server emails a copy to our team inbox so we can reply. Legal basis: our legitimate interest in answering questions about our service. Messages are deleted 24 months after they were sent, or sooner if you ask. Messages are limited to 5,000 characters; please don't send passwords or payment details through the form.
Hashed IP value. We never store your IP address, not even with your account or your message. To limit how often forms and sign-ins can be tried, our rate-limit records keep a scrambled value instead: if you connect over IPv6, we first shorten the address to its network part (the /64 prefix), then combine it with a secret that changes every day and keep only the result (a SHA-256 hash). Because the secret changes daily, values from different days do not match each other. For IPv6, rate limits also keep a second hash of the wider network (the /48 prefix), made the same way. To limit sign-in and password-reset attempts on one account, rate-limit records also hold a hash of the email address tried, made with a fixed secret rather than a daily one. We use these only to limit how often forms and sign-ins can be tried and to spot abuse. Rate-limit records are deleted after about two days.
Spam check on the contact form. The contact form uses Cloudflare Turnstile to tell people from bots. When you start filling in the form, your browser loads a small script from Cloudflare (challenges.cloudflare.com), which looks at technical signals such as your IP address and browser details. Most people never see it; sometimes it asks you to tick a box. Cloudflare uses this data only to run the check and to improve its bot detection, not for advertising, and Turnstile does not use cookies to track you. We receive only a pass or fail result. It is not used anywhere else on the site.
Anonymous usage counts
The site also counts a short list of actions, such as "a design was picked", "a photo was added" or "a certificate was downloaded", sometimes with one extra word from a
fixed list (a design, paper size or format). Each count is added to a daily total for the whole site, with no visitor ID and no cookie. Anything that is not on the fixed
list is stored as other, so names and anything you type are never stored. The same action names are also sent to Google Analytics (see Cookies and analytics).
Daily totals are deleted after 400 days.
Cookies and analytics
- Signing in sets one session cookie (below). It is needed for your account and is not used for tracking.
- Google Analytics sets first-party cookies on this site: in Europe only after you choose "Allow analytics", elsewhere by default unless you choose "No thanks". Details below.
- No advertising. There are no ad networks, social media pixels or session recording tools, and Google Analytics runs with its advertising features off.
- We also run the anonymous counts above ourselves, without cookies.
- Our fonts are served from our own domain, so no font service sees your visit.
Google Analytics
We use Google Analytics 4, a service of Google LLC, to learn which pages and features people use, so we know what to improve. It records pages you view, the site that sent you, your browser, device type and approximate location (city or country), and the actions listed under anonymous usage counts with the same one-word details. It never receives what you write on a certificate, names, photos, signatures or the web addresses you type.
Cookies. When analytics is allowed, Google Analytics sets two first-party cookies on our domain: _ga, which tells visits from the
same browser apart, and _ga_<ID>, which keeps track of the current visit. As of November 2026, Google sets both to expire after 2 years by
default. They are used only for our statistics, not for advertising.
Your choice. If you visit from the European Economic Area, the UK or Switzerland, Google Analytics starts with its cookies off. Until you choose
"Allow analytics" (or if you choose "No thanks"), Google's consent mode does not read or write analytics cookies; it may still send Google a basic cookieless
signal for each page, with the time, your browser type, the referring page and whether consent was given, which Google uses for aggregate statistics. Everywhere
else, analytics cookies are on by default. Wherever you are, you can change your choice at any time with "Cookie settings" at the bottom of every page: "No thanks"
turns the cookies off from then on. Your choice is saved in your browser's local storage (coa:consent), not in a cookie. Deleting cookies already set
is done in your browser settings.
What is switched off. We have turned off Google signals and ad personalization, so Google Analytics does not link your visits to a Google account, and its data is not used to show you ads. We do not pass ad click information between pages.
IP addresses. As of November 2026, Google states that Google Analytics 4 does not log or store IP addresses. For visitors in the EU, the UK and Switzerland, Google uses the IP address only to work out an approximate location on servers in those regions, and then discards it.
Legal basis: in the European Economic Area, the UK and Switzerland, your consent. Elsewhere, our legitimate interest in improving the tool, with the option to opt out at any time. See how Google uses information from sites that use its services.
Cloudflare
Session cookie. When you sign in, we set one cookie, coa_session. It holds a random token that keeps you signed in; we store only a scrambled
(hashed) copy of the token. It is HttpOnly (page scripts cannot read it), sent only over HTTPS to this site, and removed when you log out or the session expires. It is
strictly necessary for your account and is not used for analytics or advertising. While you are signed in, your browser's local storage also keeps a
simple yes/no note (coa:signed-in, no email or token) so the menu can show "Account" instead of "Log in"; it is removed when you log out.
Cloudflare, which delivers the site, may set a strictly necessary security cookie (such as __cf_bm or cf_clearance) if it needs to check that traffic is not
from a bot. These cookies are used only for security, not for tracking or advertising.
Who processes data for us
Cloudflare, Inc. hosts the site, delivers its pages, protects it from attacks, runs the database (D1) that holds accounts, saved certificates, issuer profiles, the design log, contact messages and usage totals, and stores the images of signed-in users (R2). It also runs the Turnstile spam check on the contact form (see Contact form). To deliver any website, Cloudflare has to handle your IP address and basic request details. Cloudflare acts as our processor under its data processing addendum. See Cloudflare's privacy policy.
Google LLC provides Google Analytics (see Cookies and analytics) as our processor under the Google Ads Data Processing Terms. We have switched off Google Analytics' "Google products & services" data sharing setting. If we ever turn it on, we will say so here first.
Our team inbox is a Google Gmail account, so contact messages, password-reset relays and our replies are also stored by Google LLC. Cloudflare delivers the email from our server to the inbox. We do not use any other service providers for the personal data on this page, and we never sell or rent it.
Where your data is handled
We are based in Hong Kong. The database, file storage and network are run by Cloudflare on servers in many countries, so your data may also be handled outside Hong Kong, the UK and the EU, including in the United States. Email copies are stored by Google (Gmail), including in the United States.
- From the UK and the EU: as of November 2026, Cloudflare's data processing addendum includes the EU Standard Contractual Clauses and the UK International Data Transfer Addendum. Google Analytics data is handled by Google, including in the United States, under terms that include the Standard Contractual Clauses.
- Under the PDPO: we use your data only for the purposes on this page, wherever it is processed, and Cloudflare's data processing addendum binds it to keep the data secure and to use it only on our instructions.
Your rights
Everyone. Under Hong Kong's PDPO, which applies to us wherever you live, you can ask whether we hold personal data about you, get a copy of it, and ask us to correct it. You can delete your saved certificates, images and your whole account yourself in Account settings, or ask us to do it.
In the UK and the European Economic Area. Under the UK GDPR and the EU GDPR you also have the right to:
- get a copy of the personal data we hold about you;
- have it corrected if it is wrong;
- have it deleted;
- object to, or ask us to restrict, how we use it;
- receive it in a portable format;
- withdraw your consent at any time, without affecting what we did before.
How to ask. Send a message through our contact form from the email address the request is about. We may ask you to confirm the request from that address before we act. We reply within one month, which is also inside the 40 days the PDPO allows for access and correction requests. There is no charge.
Named on someone else's certificate. If you are named on a certificate someone else made (for example as the buyer), the issuer decides what is on it. Please ask them first; you can also contact us and we will help where we can.
If you are unhappy with how we handle your data, please tell us first so we can put it right. You can also complain to Hong Kong's Office of the Privacy Commissioner for Personal Data (PCPD) at pcpd.org.hk, to the UK Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint, or to the data protection authority where you live.
Children
Accounts are for adults. We do not knowingly collect data from children under 13 through accounts or the contact form. If you think a child has sent us their details, contact us and we will delete them.
Changes to this policy
When the site changes how it handles data, we update this page and the effective date at the top before the change goes live. If a change affects account holders in a meaningful way, we will email them. The Studio plan, when it starts, will be covered here before it launches.
See also our terms of use. Questions? Contact us.