CPD Pro by Protagon

Privacy Policy

Last updated: 4 September 2026

1. Controller

The data controller is Protagon, operator of CPD Pro.

Email: service@protagon.ai

If you are in the EEA or UK, you may also lodge a complaint with your local supervisory authority. In the Netherlands that is the Autoriteit Persoonsgegevens.

2. What we collect

Category	Examples	Why
Account	Name, email, password hash, profession(s), phone, address if you provide it, language preference	Create and secure your account; personalise content
Subscription	Plan, status, Stripe customer/subscription IDs, billing period, discount-code use	Provide paid access; invoicing
Learning record	Articles opened, tests, answers, scores, attempts remaining, PE/CPD units, certificates and verification IDs, objectives, activity history	Deliver CPD, certificates, and progress tracking
Extension activity	Text you explicitly extract from a page or PDF, generated questions, quiz results saved to your account	Earn points from content you choose in the browser
Support	Messages sent via contact form, article requests, feedback	Help you and improve the Service
Technical	IP address, device/browser type, authentication tokens in local storage, basic logs	Security, debugging, abuse prevention

We do not store full payment-card numbers. Stripe processes those. We do not use advertising cookies or sell personal data.

3. Legal bases (GDPR)

• Contract — creating an account, delivering the Service, generating certificates, processing subscriptions.
• Legal obligation — tax and accounting records for payments.
• Legitimate interests — securing the platform, preventing fraud, understanding aggregated product use, and defending legal claims. We balance these against your rights.
• Consent — where we ask for it (for example optional communications). You can withdraw consent at any time without affecting prior lawful processing.

4. Chrome extension

The CPD Pro Chrome extension is part of the same Service. It does not run in the background to read your browsing history.

• Page or PDF text is sent to our API only when you start extract / generate-questions in the side panel.
• We use that text to generate a short quiz and, if you complete it while subscribed, to record PE/CPD units and a certificate on your account.
• We do not collect your location, contacts, or unrelated browsing history.
• You must be signed in. Earning points requires an active paid subscription.
• Traffic to our API uses HTTPS.

Do not extract content you are not allowed to process. Third-party sites have their own privacy terms.

5. AI processing

We send selected article or extracted text to AI providers (currently OpenAI) to generate questions, summaries, and assistant replies. We do not send your password, payment details, or identity documents to OpenAI. Prompts and outputs are processed so we can provide the feature. Do not paste secrets or special-category data into the assistant.

6. Who we share data with

We share data only with processors who help us run CPD Pro, under contracts that require them to protect it:

• Stripe — payments, invoices, customer portal, tax
• PlanetScale (MySQL) — application database
• Vercel / Netlify — hosting and delivery of the app and APIs
• OpenAI — generation of questions and assistant output
• Email delivery provider — confirmation, password reset, and service emails from service@protagon.ai

We may disclose data if required by law, to protect rights and safety, or in connection with a business transfer (with equivalent protection).

Certificate verification: anyone with a certificate ID can check that a certificate is authentic. The verification page shows limited certificate details needed for that check, not your password or payment data.

7. International transfers

Some providers (for example Stripe or OpenAI) may process data outside the EEA. Where that happens, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses and the provider’s own transfer mechanisms.

8. Retention

• Account and learning records — while the account is active, and a reasonable period after closure so we can restore access or handle disputes.
• Certificates and verification IDs — kept so you and third parties can still verify issued certificates; we may anonymise or restrict them if you request erasure where the law allows.
• Billing records — up to 7 years where tax law requires.
• Support emails — as long as needed to resolve the request, then routinely deleted.
• Security logs — typically up to 12 months unless needed longer for an incident.

9. Cookies and local storage

We use essential storage only:

• Authentication token and cached user profile (so you stay signed in)
• Language preference
• Temporary checkout / pending-plan flags during registration

We do not use third-party advertising or analytics cookies that track you across sites. You can clear local storage in your browser; you will need to sign in again.

10. Your rights

If GDPR (or UK GDPR) applies, you may request:

• Access to your personal data
• Correction of inaccurate data
• Erasure (with the legal limits above, for example invoices we must keep)
• Restriction of, or objection to, certain processing
• Data portability of data you provided to us
• Withdrawal of consent where processing is based on consent

Email service@protagon.ai. We will verify that the request comes from the account holder before acting. We aim to respond within one month.

You can update much of your profile yourself in Account. You can download certificates from your account while you have access.

11. Security

We use HTTPS/TLS in transit, hashed passwords, access-controlled hosting, and least-privilege access to production systems. No method of transmission is 100% secure. Tell us immediately at service@protagon.ai if you suspect unauthorised use of your account.

12. Children

CPD Pro is for professionals aged 18 and over. We do not knowingly collect data from children.

13. Changes

We may update this policy when the product or the law changes. The date at the top will change. Material changes will be notified by email or in-product notice where appropriate.