Privacy Policy

To operate the competency assessment platform, IMCAC collects the following:

• Account data — full name, email, hashed password, profession (optional).
• Assessment data — exam attempts, answers, scores, timestamps, case-study text.
• Certificate data — issued certificate IDs, issue and expiry dates, holder name and email.
• Payment metadata — PayPal order reference, amount, currency, payment status. We do not store card numbers or PayPal credentials; these are handled entirely by PayPal.
• Technical data — IP address on login/registration (for fraud prevention), browser type, and session cookies.

• To authenticate you and secure your account.
• To administer, grade, and audit the competency assessment.
• To issue, deliver, and verify your certificate.
• To process one-time issuance fees via PayPal.
• To prevent fraud, cheating, and abuse.
• To comply with legal, tax, and accounting obligations.

• PayPal — payment processing (name, email, amount).
• Anthropic (Claude) — pseudonymous case-study text is sent to Claude Sonnet for AI grading. No personally identifying data is included in the grading prompt.
• Resend — transactional email delivery (name, email, certificate PDF attachment) once configured.
• Cloud infrastructure (Emergent / MongoDB Atlas) — hosting.

IMCAC does not sell or rent personal data. We do not use your data for advertising.

• Account & assessment data — retained while your account is active and for 2 years after the last certificate expires, to support verification.
• Certificate metadata — retained indefinitely so anyone can verify a historical credential.
• Payment records — retained for the period required by applicable tax and accounting law (typically 7 years in India).
• Server logs & IPs — 90 days, then automatically discarded.

Regardless of jurisdiction, you may at any time request that we:

• Access the personal data we hold about you.
• Correct inaccuracies in your data.
• Delete your account (this will revoke active certificates; historical verification metadata may be retained in redacted form).
• Export your assessment data in a portable format.

Send requests to admin@imcac.org. We respond within 30 days.

We use a small number of strictly-necessary browser storage items:

• httpOnly session cookie — authenticates your logged-in session. Cannot be read by JavaScript, so cannot be stolen by cross-site scripting.
• localStorage — exam-in-progress recovery state, corporate order drafts, disclaimer acknowledgement. Never contains passwords or auth tokens.

We do not use any advertising, analytics, or tracking cookies.

Passwords are hashed with bcrypt. Communication with our servers is encrypted in transit (TLS 1.2+). Certificate PDFs are generated server-side per-request and are not stored on disk. PayPal handles all card data; we never see it.

The platform is intended for use by adults 18 years or older. We do not knowingly collect personal data from children.

Material changes will be announced by email to registered users and by a banner on the site. Continued use after a change constitutes acceptance of the revised policy.

Data protection questions: admin@imcac.org. See also our Terms of Service.