Privacy
Privacy: what happens to a certificate you upload
A certificate of analysis can carry a supplier's commercial detail. This page says where your file goes, how long it stays, who else handles it, and what stays in your browser.
This page describes how the service works at the time of writing. Do not upload a document if your agreements forbid third-party processing.
The short version
- Privacy summary
- Files are processed in memory and deleted after conversion. Pages that need a second look may be sent to Google's Gemini API, where Google's terms allow retention for up to 55 days. Uploads are not used for training. The batch log never leaves your browser.
The service uses four kinds of sub-processor: Modal for compute, Google for the vision check, Cloudflare for hosting and the edge function, and a payment provider (to be named when checkout is enabled).
What happens to a file, in order
From the moment you choose a file to the moment it is gone.
Your browser sends the file
To this site's conversion endpoint, hosted on Cloudflare. The request carries a random device identifier from your browser's local storage, and Cloudflare supplies your IP address, so the free allowance can be counted.
The endpoint relays it to the conversion engine
The engine runs on Modal and reads the file in memory to turn it into text and tables.
Some pages may go to Google for a second look
Pages the engine cannot read with confidence may be sent to Google's Gemini API as images. Under Google's terms, data sent to that API may be retained for up to 55 days.
The file is deleted after conversion
The engine returns text only. The uploaded file is not kept by CertiClean after the conversion finishes.
The comparison runs and the result comes back
The specification check runs at the edge on the returned text. The result goes to your browser. The batch log you build from it is stored in your browser only.
What is collected
- The file you upload, for the length of the conversion.
- A random device identifier, kept in your browser's local storage and sent with each upload, used to count the free allowance.
- A page code, if you enter one: kept in your browser's local storage and sent with each upload, so the engine can count pages against it.
- Your IP address, passed on by Cloudflare for the same purpose, and the standard request logs that Cloudflare keeps for the hosting service.
- Emails you send to [email protected], kept as long as needed to answer them.
- Payment details are entered with the payment provider, never on this site, and are not seen by CertiClean.
- This site sets no cookies of its own. If page-view counts are switched on, they come from Cloudflare Web Analytics, which loads one script from Cloudflare.
- Fonts load from Google Fonts, so your browser contacts Google when a page loads. No other third-party scripts are used.
Sub-processors
- Modal: compute that runs the conversion engine.
- Google: the Gemini API, used for the vision check on pages that need a second look, and Google Fonts for the typefaces.
- Cloudflare: hosting, the edge function that relays uploads and runs the specification check, and optional page-view analytics.
- A payment provider, to be named on the checkout page when subscriptions are enabled.
What stays in your browser
The batch log, the device identifier and a page code, if you have entered one, are stored in your browser's local storage on the device you use. The log is never sent to us. The device identifier, and the page code when one is saved, accompany each upload. Clear site data for coatoexcel.com to remove all three. Download the log first if you want a copy, and keep the email with your page code in case you need to enter it again.
No region is promised for processing. The engine runs on Modal and Google's service is global.
Where a certificate goes: by hand, through a generic converter, through CertiClean
Data handling is a reason to read the terms of any online tool.
| What you need | Manual spec check | Generic PDF-to-Excel | CertiClean |
|---|---|---|---|
| Who handles the file | You and your own systems. | The converter's provider and its processors. Read its policy. | Cloudflare (hosting), Modal (compute), and Google for pages needing a second look. |
| How long the file stays | As long as your records policy says. | Set by the provider. | Deleted after conversion. Pages sent to Google may be retained by Google for up to 55 days. |
| Used for training | No. | Set by the provider. | No. Uploads are not used for training. |
| Where the log lives | Your spreadsheet. | Not applicable. | Your browser only, not uploaded. |
| Account or sign-up | None. | Often required. | None for the free allowance. |
Statements about generic converters describe what to check, not any named product.
Questions people ask
Do you keep my certificate?
No. The file is processed in memory and deleted after conversion. What you keep is the result in your browser and any files you download.
Is my file sent to Google?
Only pages that need a second look may be sent to Google's Gemini API for a vision check. Under Google's terms, that data may be retained for up to 55 days. Pages the engine can read directly are not sent.
Do you train models on uploaded certificates?
No. Uploads are not used for training.
Where is my batch log stored?
In your browser's local storage, on your device. It is not uploaded and we cannot read it.
What identifies me for the free allowance?
A random device identifier stored in your browser and your IP address as seen by Cloudflare. There is no account, no name and no email address involved.
Do you use cookies or analytics?
The site sets no cookies of its own. Fonts come from Google Fonts, so your browser contacts Google when a page loads. If page-view counts are enabled they come from Cloudflare Web Analytics, which loads a single script from Cloudflare; otherwise no third-party script runs.
Who are your sub-processors?
Modal for compute, Google for the vision check, Cloudflare for hosting and the edge function, and a payment provider that will be named on the checkout page when subscriptions are enabled.
How do I delete my data?
Clear site data for coatoexcel.com in your browser to remove the batch log and device identifier. We do not keep uploaded files, so there is nothing else to delete on our side, apart from emails you sent us.
Where in the world is my file processed?
No region is promised. The conversion engine runs on Modal and the Gemini API is a Google service. If your agreements restrict where documents may be processed, do not upload them.
Can I upload a confidential supplier certificate?
Only if you have the right to share it with processors such as these. A certificate can contain commercial detail that your supplier agreement treats as confidential.
How do I contact you about privacy?
Write to [email protected].