Privacy Policy

This policy explains what data CertBridge collects and who controls it. CertBridge is one of several early-stage products built and operated by AppTechLab, which acts as the data controller for all of them.

Who controls your data

AppTechLab (apptechlab.com) is the data controller for information collected through this page, not CertBridge individually. This gives you one place to ask about, correct, or delete your data across every AppTechLab product.

What we collect

• Email address — only if you submit the "Reserve early access" form, together with what hardware you told us you primarily manage (optional), a timestamp, and the consent you gave at signup.
• Anonymous page views — the page path and referrer for each visit, with no cookies, no IP storage, and no identifier tied to you personally. Clicking "Book a demo instead" records one extra anonymous page-view row so we can measure interest in that path — no email is captured by that click alone.
• Live-demo activity log — every time you run the "Generate renewal plan" scan, one row is recorded with a timestamp, how many devices were in that batch, and the single highest risk tier found ("critical", "warning", or "ok"). The device inventory you pasted, the parsed device details, and the generated renewal procedure/script are never written to that log or any other storage — they exist only in memory for the length of that one request, long enough to build the response sent back to your browser.

What we don't collect

No cookies are set by this page — the page-view counter and demo-activity log above are both cookie-free and carry no visitor identifier, so there is nothing here that requires a cookie consent banner. No third-party advertising or tracking pixels are loaded. No payment information is collected — this page has no live payment processing. Your IP address is never stored in readable form; it is hashed with a server-side secret salt before being used to enforce the demo's rate limit, and that hash is not linked to your email or to any activity-log row.

About the live demo specifically

The device inventory you paste is sent to Google's Gemini API to identify vendor/model/firmware quirks and generate a renewal procedure — do not paste anything you would not want a third-party AI provider to process (for example, prefer generic hostnames over your real internal naming scheme if that matters to you). CertBridge never connects to, logs into, or otherwise touches the devices you describe — every generated procedure is guidance for a human to review and run themselves. No code in this product opens an outbound SSH connection or prompts for a device credential.

How we use it

Your email is used to notify you when CertBridge opens for self-serve access, and occasionally about other AppTechLab infrastructure tools. It is never sold or shared with third parties.

Your rights

You can ask AppTechLab to access, correct, or delete your data at any time by emailing the contact address on apptechlab.com, or by calling POST /api/delete-account with your email and the deletion code shown when you signed up — this removes your signup record (and the hardware note attached to it) and logs a one-way hash of the deletion for audit purposes only. The code is only ever shown once, at signup, so that knowing someone else's email address alone is not enough to delete their data; if you lose it, use the email option instead. As part of AppTechLab's data retention policy, data belonging to a discontinued product is deleted within 30 days of that product's retirement.

Storage

Data is stored with Supabase, our database provider. Your email address and hardware note are only ever written by our server, through the "Reserve early access" endpoint, which validates and rate-limits every submission before it reaches the database — this page's own browser code cannot write to the signup table directly. The page-view table is protected by a row-level security policy that restricts this page to inserting new records only — it cannot read, modify, or delete existing rows. The live-demo activity log has no public read or write access at all; only the server-side scan function can write to it, and only the server-side dashboard endpoint can read from it (and only returns device count + risk tier + a minute-rounded time, never a full row).