Privacy Policy

1. Introduction

CertNotify is a product of Mallah Software Services Private Limited, a company incorporated in India ("we", "us", "our"), which operates certnotify.com and is the data controller for the personal data described in this policy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service. Please read this policy carefully. By using CertNotify, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

Account Information: If you register with an email address and password, we store your email address and, if provided, your name. Authentication is handled by Google Firebase Authentication — we never see or store your password. If you sign in with Google instead, we receive your name, email address, and Google profile photo via Google OAuth, and store your name and email address to identify your account.

Domain Data: We collect the domain names you add to your account for monitoring purposes. We do not collect or store private keys, certificate contents, or server credentials of any kind.

Code and Configuration You Scan: Our secret, dependency and infrastructure-as-code scanners analyse content you paste. That content is processed in memory to generate your result and is not stored. If you save a scan as a dashboard asset, we store only the findings and summary counts it produced — never the submitted content. Dependency scans send package names and versions (not your code) to the public OSV.dev vulnerability database to look up known advisories.

Repositories You Connect: If you connect a GitHub, GitLab or Bitbucket repository and enable scanning, we read its files through that provider's API when you enable scanning, when a push reaches the default branch, and when you ask for a scan. File contents are scanned in memory and not stored. We store the repository's name, the paths of the files scanned, and the findings and summary counts they produced, with any secret value masked. A GitLab or Bitbucket access token you paste is stored encrypted and is never shown back in full; a GitHub connection is an app installation and stores no token.

Usage Data: We collect standard server logs including IP addresses, browser type, pages visited, and timestamps. This data is used for security and service improvement purposes and is not sold to third parties.

Analytics and Session Activity: On our public pages we use Google Analytics to count visits and Microsoft Clarity to understand how those pages are used. Clarity records interaction data — mouse movement, clicks, scrolling, and which pages you move between — and can replay a recorded session for diagnostic purposes. Neither tool is loaded before the conditions in Section 9 are met, neither receives your password, and we do not use either to identify you personally.

Payment Information: Paid subscriptions are processed by Cashfree Payments India Private Limited. When you subscribe, your name, email address and mobile number are shared with Cashfree to set up the payment, and you enter your card or UPI details on Cashfree's own checkout — we never receive or store card numbers, UPI PINs or bank credentials. We keep a record of each payment (plan, amount, currency, date and Cashfree's reference) for accounting and tax purposes, including after an account is deleted. The free Pro trial requires no payment method.

3. How We Use Your Information

• To provide and operate the CertNotify monitoring service
• To send SSL certificate and domain expiry alerts by email, and to any other alert destination you add to your account
• To manage your account and subscription
• To communicate service-related notices and updates
• To send occasional emails about upgrading your plan, based on how you use CertNotify (for example, when you reach the Free plan's domain limit). There are a few over the life of an account, never more than one a week, and every one has a one-click unsubscribe link. Unsubscribing does not affect alerts, trial and plan notices or receipts.
• To display advertisements on our free tools and learning content (see Section 8)
• To detect and prevent fraud or abuse of our service
• To comply with legal obligations

Business contacts we email

We sometimes email people who do not have a CertNotify account about the service, typically engineers and IT staff responsible for websites and domains. For them we hold a business email address and, where known, a name, company, job title, country and the source of the record (for example, a sign-up form, a referral or a business contact list). We email such a person only with a documented basis: their consent, an existing customer relationship, or, where the law permits it for business addresses, our legitimate interest in telling relevant professionals about a relevant service. In countries that require prior consent we email only those who gave it. Every such email names us, gives our postal address, and has a one-click unsubscribe; replies to it are stored so we can answer them. Unsubscribing, or asking us by reply to stop, ends all marketing email to that address, and the address is kept on a suppression list so that it is not emailed again. If you have an account, you can turn these emails back on yourself under Settings. To have your record deleted, contact us; the address stays on the suppression list only so that the deletion cannot lead to further email.

We do not track whether marketing emails are opened. Links in them pass through our own address so we can count clicks and recognise a sign-up that came from a campaign; no cookie is set.

4. Data Sharing

We do not sell, trade, or rent your personal information to third parties. We share data only with:

• Google Firebase Authentication & Google OAuth: For account sign-in, including email/password and Google Sign-In (governed by Google's Privacy Policy)
• OSV.dev: When you run a dependency scan, package names and versions are sent to the public Open Source Vulnerabilities database to look up known advisories. Your code is never sent
• Google AdSense: We display advertisements through Google AdSense on our free tools and learning content. Google may use cookies and data about your visits to this and other websites to serve relevant ads (see Section 8 for full details and opt-out options)
• Google Analytics: Aggregate traffic measurement on our public pages (governed by Google's Privacy Policy)
• Microsoft Clarity: Product analytics and session replay on our public pages, used to see where a page is confusing or broken (governed by Microsoft's Privacy Statement)
• Vercel: Hosts the website and runs the daily monitoring jobs, so it processes request data, including IP addresses, as part of delivering our service
• Prisma: Prisma Postgres hosts our database, reached through Prisma Accelerate, so it stores your account, domain, alert and scan records
• GitHub, GitLab & Bitbucket: Only if you connect a repository for code scanning. We call their APIs with the access you granted to list your repositories and read the files being scanned. A self-managed GitLab or Bitbucket server you connect is called at the address you give
• Resend: Delivers our emails, including alerts, so it receives your email address and the content of each message
• Cashfree Payments: Processes paid subscriptions, as described in Section 2
• Anthropic: Only when you ask CERTIBOT, the dashboard assistant, a question. Your question, the screen you are on and the monitoring records of your workspace that the question needs (such as a domain's certificate dates and findings) are sent to Anthropic's API to write the reply. CertNotify keeps your conversations with your account until you delete them from the assistant
• Law enforcement: When required by valid legal process

5. Data Retention

We retain your account data for as long as your account is active. Monitoring records are kept as follows:

• Check history (the result of each check on a domain) is shown for as long as your plan allows: 7 days on Free, 90 days on Pro, 2 years on Business and 10 years on Enterprise. It is stored for up to 3,680 days (the longest plan's period plus 30 days) and then deleted, so moving to a plan with a longer history also shows older records.
• Security events are kept while open, and deleted one year after they are resolved.
• DNS records: the most recent records and the baseline they are compared against are kept while the domain is monitored; a record that has been replaced is deleted one year after its replacement.
• Code scan history: the 50 most recent scans of each code asset, and every scan from the last 200 days, are kept; older ones are deleted.
• Other monitoring records, such as the alerts sent to you and the findings on your domains and code, have no fixed period and are kept while your account is active.
• Payment notifications from Cashfree are cleared of their contents after 400 days. The payment record itself is kept for accounting and tax purposes, as described in Section 2.

If you delete your account, we delete your personal data within 30 days, except where retention is required for legal compliance.

6. Your Rights (GDPR / UK GDPR)

If you are in the European Economic Area or United Kingdom, you have the following rights:

• Access: Request a copy of your personal data
• Rectification: Request correction of inaccurate data
• Erasure: Request deletion of your data ("right to be forgotten")
• Portability: Receive your data in a structured, machine-readable format
• Objection: Object to processing based on legitimate interests

To exercise these rights, email us at privacy@certnotify.com. We will respond within 30 days.

7. Cookies and Similar Technologies

Three categories, which are treated differently:

• Strictly necessary. Session cookies set by Google Firebase Authentication to keep you signed in. These are set only once you sign in, are required for an account to work at all, and are not subject to consent. Blocking them in your browser will prevent you from staying signed in.
• Measurement. Google Analytics (_ga, _ga_*) and Microsoft Clarity (_clck, _clsk), used to count visits and see how public pages are used. Subject to consent as described in Section 9.
• Advertising. Cookies and similar identifiers set by Google AdSense and its partners, described in Section 8. Subject to consent as described in Section 9.

Our consent record itself is also stored in your browser, so that your choice can be remembered and honoured on later visits.

8. Advertising — Google AdSense

CertNotify uses Google AdSense to display advertisements on our free tools, learning articles, and other public pages. Google AdSense is operated by Google LLC. By serving ads, Google and its advertising partners may use cookies, web beacons, and similar tracking technologies (including the DoubleClick cookie) to:

• Serve ads based on your prior visits to this website and other websites across the internet
• Measure the performance and effectiveness of advertisements
• Prevent the same ad from appearing to you too frequently

Google's use of advertising cookies enables it and its partners to serve ads based on your visit to certnotify.com and other sites on the internet. For more information on how Google uses data when you visit partner sites, visit How Google uses data from sites that use our services.

Opt out of personalised advertising

You can opt out of personalised ads at any time using the following tools. Note that opting out does not remove all advertising — it means the ads you see will be less tailored to your browsing history.

• Google Ad Settings — manage and opt out of Google personalised ads
• Network Advertising Initiative (NAI) opt-out
• Digital Advertising Alliance (DAA) opt-out

9. Consent to Cookies and Advertising

For visitors in the European Economic Area, the United Kingdom and Switzerland, we ask before any measurement or advertising cookie is set. The prompt is served by Google's Funding Choices, a consent platform certified under the IAB Europe Transparency & Consent Framework (TCF v2.2), and your choice is recorded and passed to the tags on the page.

Until a choice is made, and if consent is declined:

• Advertising: no advertising cookies or identifiers are stored, and any ads shown are non-personalised — selected from the content of the page rather than from your browsing history.
• Google Analytics: runs without cookies, sending only aggregate measurement that is not tied to a returning visitor.
• Microsoft Clarity: is not loaded at all. No session is recorded and none of its cookies are set.
• Strictly necessary cookies: continue to work, because signing in would otherwise be impossible.

You can change or withdraw your choice at any time using the Cookie settings link at the bottom of any page, which reopens the same prompt. If that link is not shown, clearing the consent cookies (FCCDCF and FCNEC) in your browser has the same effect: the prompt will appear again on your next visit. Withdrawing consent stops further collection; it does not by itself delete what was already collected, for which see Section 6.

Outside those regions we do not currently present a consent prompt, and the tags described in Sections 7 and 8 load on their default settings. You can still opt out of personalised advertising using the tools in Section 8, control cookies in your browser, and exercise the rights in Section 6.

10. Security

We use HTTPS/TLS for all data transmission, encrypt sensitive credentials at rest, and follow security best practices including regular dependency updates and access controls. No system is 100% secure — please report security vulnerabilities to security@certnotify.com.

11. Children's Privacy

CertNotify is not directed to children under 16. We do not knowingly collect personal information from children. If you believe we have collected data from a child under 16, contact us immediately at privacy@certnotify.com.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or a prominent notice on our website at least 14 days before they take effect. Continued use of CertNotify after the effective date constitutes acceptance of the updated policy.

13. Contact

For privacy-related enquiries: privacy@certnotify.com

Data controller: Mallah Software Services Private Limited, operator of CertNotify, incorporated in India. Registered office: Plot No. 347, Flat No. 301, Status-2 CHSL, Santacruz (East), Mumbai 400055, Maharashtra, India.