Privacy Policy

Last updated: October 23, 2026

ILIEV CONSULTING LLC is the data controller responsible for the processing of personal data in connection with the CertAvert service (the “Service”).

This Privacy Policy explains how personal data is collected, used, retained, and deleted when you use the Service.

1. Information We Collect

Name and email address
If you add them, extra alert email addresses, their verification status, and the alert and reminder days you chose, or alerts you turned off, for each domain
If you add them, the Slack or Discord webhook URLs you want alerts posted to, the name you give each one, and whether recent alerts to it were delivered (each URL is stored encrypted)
Account and authentication metadata
If you enable two-factor authentication: a secret for your authenticator app and a set of one-time recovery codes, both stored encrypted (we never see the codes your authenticator app generates)
If you sign in with Google: the name, email address and account ID that Google shares with us, and that Google has verified your email address. We don't receive your Google password or any other Google data.
Domains and configuration data you submit for monitoring
If you use the Inventory (Pro plan): the groups, purposes and owners you make, each owner's name and, if you add it, email address, and which of your domains are in each. They are your own notes: they are shown to you and printed in your certificate reports, and the owners' email addresses are offered as suggestions when you add an alert address. We don't email an owner unless you add their address as an alert address and they confirm it. They are kept until you delete them (also if you change plans), and deleted with your account. Please do not enter sensitive personal data there.
If you use the certificate report (Pro plan): the notes you write in it for your auditor, kept until you delete them and deleted with the domain or your account; and, for each report you download, its ID, period, the group, owner or purpose it covers (if one was chosen), the account name as printed in it, when it was generated, and a fingerprint (SHA-256) of each of its files. We never keep the report itself. Anyone who has one of its files, or its fingerprint, can see on our verify page the report ID, account name, period, that group, owner or purpose and when it was generated. The fingerprints are kept until your account is deleted. Please do not enter sensitive personal data in notes.
Monitoring results, timestamps, and alert history, including a copy of the public certificate each of your domains last served and a history of when it was replaced and what changed (these are public data the domain sends to anyone who connects)
A daily record for each of your domains: that day's worst result and why, how many checks ran, the certificate seen (its fingerprint, serial number, issuer and end date), its revocation status, the TLS versions accepted and the domain's alert settings. It is kept for 1 year, or 2 years on the Pro plan (Pro accounts may choose up to 5 years), and is used for your certificate report. If your plan or choice later keeps less, we email you and wait 90 days before deleting the older records.
Support conversations and messages
If you rate CertAvert: your rating (1 to 5 stars), any comment you add, the name you give to show with it, whether you allowed us to quote your comment on our website, and when you chose "Not now" when asked
If you subscribe: your Paddle customer and subscription IDs, your subscription status and renewal date, your payment history with us, and the payment method summary Paddle shares with us, such as card brand and last four digits (we never receive full card numbers or security codes)
Your plan, how it was granted (subscription, administrator, a promotional offer, or an earlier tip), and when it ends or renews; if you sign up through a promotional link, which offer it was and when you received it; whether and when your account had Pro free of charge, and when its Pro trial ends
Usage logs, security logs, and IP addresses
Anonymous visit counts: for each page, how many times it was viewed per day, and how many different visitors came per day. We don't use cookies for this and don't store IP addresses in these counts; to tell visitors apart within one day we use a one-way hash of your IP address and browser details that changes every day and is deleted after 2 days. We also count which website a visit came from (the referring site's name only, for example google.com). Visits by signed-in users and robots are not counted.
Anonymous counts of how often the free tools are used: per day and tool, how many checks were run, how many were answered from the saved result, how many failed, and how many requests were stopped by the captcha, the rate limit or an invalid entry. These counts never contain the domain you entered or any information about you.
If you use the free certificate expiry and trust tool on our website (with or without an account): the domain you enter and your IP address. To run the check, our server connects to that domain on port 443, reads its public certificate and the certificate chain it sends, asks the certificate authority whether a trusted certificate has been revoked (see Section 4), and reads where its homepage redirects to (without following the redirect). The result is kept in a temporary cache for up to a minute, so checking the same domain again right away shows it without connecting to that domain again, and is not linked to an account; your IP address is used for rate limiting and abuse prevention and may appear in our server logs. The free certificate names and SANs tool, certificate chain tool and compromised eMudhra CAs tool use the same check; the names and SANs tool also looks up the names on the certificate in DNS. The free TLS versions and ciphers tool works the same way: it opens a few short connections to port 443 of the domain you enter to read which TLS versions and ciphers it accepts, keeps the result for up to a minute and stores nothing else. The free DNS and domain registration tool does not connect to the domain: it looks the domain up in DNS (its addresses, aliases, nameservers and CAA records) and asks the domain's registry about its registration, keeps the result for up to a minute and stores nothing else. The free certificate and CSR decoder does not connect anywhere: it reads the certificates or certificate signing request you paste and shows what they contain on the same page, without storing them, not even for a minute; a file you choose is read by your browser and only its text is sent, in the same way. Your IP address is used for rate limiting as above. A private key pasted by mistake is refused and not shown back. certavert-scan, our open-source scanner, runs on your own computer and sends us nothing, so we receive no data from it.

2. Purpose of Processing

Personal data is processed to operate, secure, maintain, and improve the Service, perform SSL/TLS monitoring, deliver alerts (to your account email, to any alert email addresses you have verified and, on paid plans, to the Slack or Discord channels you added), send verification codes and links, provide customer support, manage subscriptions and billing and send related emails (such as renewal reminders, failed-payment notices and plan-ending reminders), send a monthly account summary (to your account email and, where your plan allows, to the verified alert addresses you choose in your profile, each with its own unsubscribe link; you can turn it off for any of them in your profile), send domain name renewal reminders (paid plans), show the average rating and, only if you allowed it, your comment with the name you gave on our website, prevent abuse, and comply with legal or regulatory obligations.

3. Legal Basis (GDPR)

For users in the European Economic Area, data is processed based on one or more of the following legal bases: performance of a contract, legitimate interests in operating and securing the Service, or compliance with legal obligations.

4. Data Sharing

Personal data is not sold. Data may be shared only with infrastructure, hosting, email, and monitoring providers strictly necessary to operate the Service, or when required by law.

Payments are processed by Paddle (Paddle.com Market Limited and its affiliates), our reseller and Merchant of Record. When you subscribe, you enter your payment details and billing country directly with Paddle, which handles the payment, tax, receipts, refunds, and payment disputes as an independent controller under its Privacy Policy. We share your email address and plan with Paddle, and Paddle sends us your subscription status, payments, and a payment method summary such as card brand and last four digits.

If you add a Slack or Discord channel, each alert (its subject and text, including the domain names it is about, and a link to CertAvert) is sent to that service (Slack or Discord), which handles it under its own terms and privacy policy. We send it only to the URLs you add, and nothing else about you or your account.

We use Google reCAPTCHA on registration and on the free tools (certificate expiry and trust, certificate names and SANs, certificate chain, TLS versions and ciphers, DNS and domain registration, the certificate and CSR decoder, compromised eMudhra CAs) to prevent abuse. reCAPTCHA collects hardware and software information, such as device and application data, and sends it to Google, whose Privacy Policy and Terms of Service apply.

To show when a domain name's registration ends, we ask that domain's registry, through its public lookup service (RDAP), about the domain names you monitor, about once a day, and about a domain you check with the free DNS and domain registration tool. Only the domain name is sent; nothing about you or your account.

To show other names under a domain that have a certificate, we search the public Certificate Transparency logs through crt.sh (operated by Sectigo) or, when crt.sh does not answer, Cert Spotter (operated by SSLMate) for the domain names you monitor. The free tools do not do this. Only the domain name is sent; nothing about you or your account.

To check whether a certificate has been revoked, we ask the certificate authority that issued it, at the OCSP responder or the certificate revocation list (CRL) address written in the certificate. This is done for trusted certificates of the domains you monitor and of a domain you check with the free SSL/TLS certificate tool. An OCSP request contains only the certificate's serial number and hashes of its issuer's name and key; a CRL is downloaded whole and contains nothing about the request. Nothing about you or your account is sent.

5. Data Retention and Deletion

Domain Deletion

When you delete a monitored domain, the domain is removed from active monitoring immediately. Related data, including monitoring results, alert history, and logs, is retained for up to 30 days for security, audit, troubleshooting, and abuse-prevention purposes.

If the same domain is re-added within this 30-day period, the domain and its related monitoring data may be restored. After the 30-day retention period expires, all data associated with the deleted domain is permanently deleted.

Ratings

Your rating counts toward the average shown on our website, but it is shown without your name or email address. Your comment is shown only if you allowed it and we chose to quote it, with the name you gave (or "CertAvert user"), never your email address. To have your comment removed from the website or your rating deleted, contact us. When you delete your account, your rating stops counting and your comment stops being shown at once, and both are deleted with the rest of your account data.

Account Deletion

When you delete your account, access to the Service is disabled immediately and monitoring activities stop. Account data, including domains and related records, is retained for up to 30 days for security, audit, abuse-prevention, and legal purposes. Support conversations are retained for up to 90 days after account deletion and are then permanently deleted.

After this retention period, all account data is permanently deleted and cannot be recovered, except the short payment record described under Payment Records if you paid for a plan. During the retention period, you can restore your account by logging in (or signing up again) with the same email address: your account, domains and settings come back as they were. Otherwise you cannot access the Service during this period.

Support Conversations

Support conversations and related messages may be retained after resolution or deletion to ensure service quality, maintain audit trails, prevent abuse, and comply with legal obligations.

Support conversations are closed and no longer shown in your account 90 days after the last activity. Closed conversations are retained by us for support history, audit, and abuse-prevention purposes until your account is deleted, and are permanently deleted 90 days after account deletion.

Alert Email Addresses

When you add an alert email address, we send one message with a verification link to that address. The link expires after 24 hours. An address that is not verified is never used for alerts and is discarded. A verified alert address is kept until you remove it, and is deleted with your account. Addresses beyond what your plan allows are kept but not used; if your plan no longer includes extra alert addresses, alerts go only to your account email.

Slack and Discord Alerts

A Slack or Discord webhook URL is saved only after a test message sent to it was accepted, and is kept until you remove it, and is deleted with your account. If alerts to it keep failing we stop using it and email you. URLs beyond what your plan allows are kept but not used.

Payment Records

Deleting your account cancels your subscription with Paddle right away. If you paid for a plan, we keep a short payment record for 18 months after your last payment, to handle refunds, payment disputes (chargebacks), and legal claims: your name and email address, your Paddle customer ID, when you signed up, verified your email, were last active, and deleted your account, your plan, how many domains you monitored and how many alerts and emails we sent, and your payments (invoice numbers, amounts, tax, and dates). It does not include domain names or the contents of messages. It is then permanently deleted. Everything else about your billing (Paddle IDs, subscription details, payment method summary) is deleted with your account. Paddle keeps its own records of payments, invoices, and tax as needed for accounting, tax, dispute, and legal purposes, under its privacy policy.

Records of Emails We Send

We keep a record of the emails the Service sends you (such as certificate alerts, account and billing emails) for up to 12 months, to answer support questions and look into delivery problems. Records about a deleted domain are deleted with that domain, and all of them are deleted with your account.

Backups

We keep daily backups for up to 14 days. Data deleted from the Service may remain in these backups until they are rotated out, after which it is permanently deleted.

Cookies

We use only cookies needed to run the Service: a session cookie that keeps you signed in and a security token that protects forms. We do not use advertising or analytics cookies. When reCAPTCHA loads (on registration and when you use a free tool), Google may set its own cookies under its policies. When you open checkout, Paddle loads its payment form, which may set cookies used for payment and fraud prevention under Paddle's policies. If you pick Light or Dark at the bottom of a page, your browser remembers that choice in its own storage on your device; it is not a cookie and is never sent to us.

6. Security

Reasonable technical and organizational measures are used to protect personal data against unauthorized access, disclosure, alteration, or destruction. No system can be guaranteed to be completely secure.

You can protect your account with optional two-factor authentication using an authenticator app. If you enable it, the one-time recovery codes we show you are the only way to sign in if you lose your authenticator app, so keep them safe; our Terms of Service explain how lost access is handled.

7. Your Rights (GDPR & CCPA)

Depending on your jurisdiction, you may have certain rights regarding your personal data, including the right to:

Request access to personal data held about you
Request correction of inaccurate or incomplete data
Request deletion of personal data, subject to applicable retention requirements
Request restriction of or object to certain processing activities
Receive a copy of personal data in a portable format, where applicable

Requests may require identity verification and may be limited where data must be retained for security, audit, fraud prevention, or legal compliance. Requests are handled within the timeframes required by applicable law.

The Service does not sell personal data as defined under the California Consumer Privacy Act (CCPA).

8. Changes to This Policy

This Privacy Policy may be updated from time to time. Continued use of the Service after an update constitutes acceptance of the revised policy.

9. Contact

Privacy and data protection inquiries can be sent to support@certavert.com or, if you have an account, through the Support section of the application. ILIEV CONSULTING LLC, Minnesota, United States.