Privacy Policy

Last updated: September 3, 2026

1. Introduction

CertNotify is a product of Mallah Software Services Private Limited, a company incorporated in India ("we", "us", "our"), which operates certnotify.com and is the data controller for the personal data described in this policy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service. Please read this policy carefully. By using CertNotify, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

Account Information: If you register with an email address and password, we store your email address and, if provided, your name. Authentication is handled by Google Firebase Authentication — we never see or store your password. If you sign in with Google instead, we receive your name, email address, and Google profile photo via Google OAuth, and store your name and email address to identify your account.

Domain Data: We collect the domain names you add to your account for monitoring purposes. We do not collect or store private keys, certificate contents, or server credentials of any kind.

Code and Configuration You Scan: Our secret, dependency and infrastructure-as-code scanners analyse content you paste. That content is processed in memory to generate your result and is not stored. If you save a scan as a dashboard asset, we store only the findings and summary counts it produced — never the submitted content. Dependency scans send package names and versions (not your code) to the public OSV.dev vulnerability database to look up known advisories.

Usage Data: We collect standard server logs including IP addresses, browser type, pages visited, and timestamps. This data is used for security and service improvement purposes and is not sold to third parties.

Payment Information: None. CertNotify does not currently accept online payment, so we never collect or store card numbers or billing details, and no payment processor receives your data. The free Pro trial requires no payment method. Should online payment be introduced, this policy will be updated to name the processor before any details are collected.

3. How We Use Your Information

  • To provide and operate the CertNotify monitoring service
  • To send SSL certificate and domain expiry alerts via email or WhatsApp (as configured by you)
  • To manage your account and subscription
  • To communicate service-related notices and updates
  • To display advertisements on our free tools and learning content (see Section 8)
  • To detect and prevent fraud or abuse of our service
  • To comply with legal obligations

4. Data Sharing

We do not sell, trade, or rent your personal information to third parties. We share data only with:

  • Google Firebase Authentication & Google OAuth: For account sign-in, including email/password and Google Sign-In (governed by Google's Privacy Policy)
  • OSV.dev: When you run a dependency scan, package names and versions are sent to the public Open Source Vulnerabilities database to look up known advisories. Your code is never sent
  • Google AdSense: We display advertisements through Google AdSense on our free tools and learning content. Google may use cookies and data about your visits to this and other websites to serve relevant ads (see Section 8 for full details and opt-out options)
  • Vercel: Our hosting provider processes request data as part of delivering our service
  • Law enforcement: When required by valid legal process

5. Data Retention

We retain your account data for as long as your account is active. Domain monitoring records are retained for up to 12 months for historical analysis. If you delete your account, we delete your personal data within 30 days, except where retention is required for legal compliance.

6. Your Rights (GDPR / UK GDPR)

If you are in the European Economic Area or United Kingdom, you have the following rights:

  • Access: Request a copy of your personal data
  • Rectification: Request correction of inaccurate data
  • Erasure: Request deletion of your data ("right to be forgotten")
  • Portability: Receive your data in a structured, machine-readable format
  • Objection: Object to processing based on legitimate interests

To exercise these rights, email us at privacy@certnotify.com. We will respond within 30 days.

7. Cookies

We use essential session cookies required for authentication and keeping you signed in to your account. You can disable cookies in your browser settings, but doing so will prevent you from remaining signed in.

We also use third-party cookies for advertising purposes, as described in Section 8 below.

8. Advertising — Google AdSense

CertNotify uses Google AdSense to display advertisements on our free tools, learning articles, and other public pages. Google AdSense is operated by Google LLC. By serving ads, Google and its advertising partners may use cookies, web beacons, and similar tracking technologies (including the DoubleClick cookie) to:

  • Serve ads based on your prior visits to this website and other websites across the internet
  • Measure the performance and effectiveness of advertisements
  • Prevent the same ad from appearing to you too frequently

Google's use of advertising cookies enables it and its partners to serve ads based on your visit to certnotify.com and other sites on the internet. For more information on how Google uses data when you visit partner sites, visit How Google uses data from sites that use our services.

Opt out of personalised advertising

You can opt out of personalised ads at any time using the following tools. Note that opting out does not remove all advertising — it means the ads you see will be less tailored to your browsing history.

9. Security

We use HTTPS/TLS for all data transmission, encrypt sensitive credentials at rest, and follow security best practices including regular dependency updates and access controls. No system is 100% secure — please report security vulnerabilities to security@certnotify.com.

10. Children's Privacy

CertNotify is not directed to children under 16. We do not knowingly collect personal information from children. If you believe we have collected data from a child under 16, contact us immediately at privacy@certnotify.com.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or a prominent notice on our website at least 14 days before they take effect. Continued use of CertNotify after the effective date constitutes acceptance of the updated policy.

12. Contact

For privacy-related enquiries: privacy@certnotify.com

Data controller: Mallah Software Services Private Limited, operator of CertNotify, incorporated in India.