Privacy Policy

1. Information We Collect

1.1 Information You Provide

• Account Information: Email address, name, company name when you sign up
• Service Configuration: URLs of APIs you want us to monitor
• Billing Information: Payment details processed by our payment provider (we don't store full payment details)
• Communication: Emails, support tickets, or other communications

1.2 Information We Collect Automatically

• Usage Data: How you interact with our service, pages visited, features used
• Log Data: IP address, browser type, device information, error logs
• Certificate Data: SSL certificate information (issuer, expiry date, public key hashes) from URLs you provide

1.3 Information from Third Parties

When you sign up using OAuth (Google, GitHub, etc.), we receive basic profile information from those services.

2. How We Use Your Information

• To provide and maintain our service
• To send certificate expiry alerts and service notifications
• To process payments and prevent fraud
• To communicate with you about updates, security alerts, or support
• To improve our service and develop new features
• To comply with legal obligations

3. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), our legal basis for processing is:

• Contract: Processing necessary to provide our service under our Terms
• Consent: Where you have given consent for specific processing
• Legitimate Interests: To improve our service, prevent fraud, and ensure security
• Legal Obligation: To comply with EU laws and regulations

4. Data Sharing and Disclosure

We do not sell your personal information. We may share data with:

• Service Providers: Payment processors, hosting providers, email services
• Legal Requirements: When required by law or to protect our rights
• Business Transfers: In connection with a merger, acquisition, or sale of assets

All third parties are contractually obligated to protect your data.

5. Data Retention

We retain data only as needed:

• Account Data: Until account deletion
• Monitoring Data: Until you remove URLs
• Server Logs: 30 days (hosting provider may retain longer for security)
• Billing Data: As required by EU tax laws (minimum 10 years)

6. Your Rights (GDPR)

As an EU resident, you have the right to:

• Access your personal data
• Correct inaccurate data
• Delete your data ("right to be forgotten")
• Restrict or object to processing
• Data portability
• Withdraw consent at any time

To exercise these rights, contact us at hello@certwatch.dev.

7. Data Processing and Security

7.1 Hosting Provider

We use Mochahost (World Host Group US Inc.) for web hosting services. Our servers are located in Frankfurt, Germany.

7.2 Data Processing Agreement

We have executed a Data Processing Agreement (DPA) with Mochahost that includes:

• European Commission Standard Contractual Clauses (SCCs)
• Data processing terms compliant with GDPR Article 28
• Security measures as specified in Annex II of the DPA
• Breach notification requirements
• Audit rights

7.3 Data Categories Processed

For hosting services, Mochahost processes:

• Website visitor access logs (anonymized IPs)
• Website files and content
• Form submission data (via our waitlist forms)
• Email communications

7.4 Competent Supervisory Authority

The competent supervisory authority under our DPA is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestraße 2-4, 40213 Düsseldorf, Germany

7.5 Sub-processors

Mochahost may use sub-processors for hosting infrastructure. All sub-processors are bound by data protection terms equivalent to our DPA.

7.6 Security Measures

We implement appropriate technical and organizational measures including:

• Encryption of data in transit (TLS 1.2+) and at rest
• Regular security assessments
• Access controls and authentication
• Secure development practices

8. International Data Transfers

Although our hosting servers are located in Frankfurt, Germany, Mochahost is a US-based company. We rely on Standard Contractual Clauses (SCCs) in our Data Processing Agreement to ensure compliant data transfers between our EU-based operations and our US-based hosting provider.

9. Children's Privacy

Our service is not intended for children under 16. We do not knowingly collect data from children.

10. Website Analytics

We use our hosting provider's built-in analytics to understand basic website usage. This information is collected server-side and does not use cookies or JavaScript tracking.

10.1 Data Collected

Our hosting analytics collect only:

• Page access counts and timing
• Referring websites (if available)
• Browser type and operating system
• Country of origin (from IP address, anonymized)
• Error logs for debugging

10.2 What We Don't Collect

• No cookies are set for analytics purposes
• No personal identification
• No individual user tracking
• No cross-site tracking

10.3 Data Retention

Analytics logs are retained for 30 days and then automatically deleted.

11. Cookies and Tracking

We respect your privacy. We only use:

• Essential Cookies: For login, preferences and anti-forgery (required)

We do not use analytics or marketing cookies.

12. Changes to This Policy

We may update this policy. We will notify you of material changes by email or in-app notification.

13. Contact & EU Representative