Privacy Policy

Last updated: October 9, 2026

CertObserver is operated by Kodhaj AB, a company registered in Sweden under company registration number 559537-4868. Our contact details are on the Contact page.

Kodhaj AB is the data controller for the personal data described in this policy.

What we collect and why

Technical data: Request and search details, IP addresses, browser information, timestamps, and login-session records. We use these to operate and secure the service, investigate problems, and prevent abuse.
Account and project data: Your name, email address, project memberships, monitored domains and hosts, monitoring results, notification recipients, and Slack webhook URLs. We use these to provide accounts, monitoring, shared access, and alerts. Your name and email address are required to create an account. Other project members may provide your email address when inviting you or adding an alert recipient.
Certificate data: Certificates from public Certificate Transparency logs and monitored hosts. These can contain domain names, IP addresses, organization details, and email addresses. We use them for certificate search, host discovery, and monitoring. Certificates collected from public CT logs are available through our public CT search.
Billing data: Our billing partner FastSpring collects payment details and handles checkout under its privacy policy. We receive billing and subscription information to manage your subscription. We do not receive your full credit card number.
Correspondence: Your contact details and the messages you send us, so we can respond to inquiries and provide support.

We rely on our contract with you to provide the service and support. We rely on our legitimate interests in security, preventing abuse, answering inquiries, and processing certificate data for search and monitoring. For invitees and alert recipients who have no contract with us, we rely on our legitimate interest in providing the project’s requested service.

Project members can see member names, email addresses, and project information available to their role. Alerts are sent to the email addresses or Slack destinations configured for the project. Recipients in the same email notification channel can see one another’s email addresses.

We use hosting, email delivery, and support email providers to operate CertObserver. Our application, databases, logs, and backups are hosted in Germany. Application emails are sent through servers in Sweden. Our support email provider’s mail servers are in Switzerland, Germany, and Norway.

FastSpring processes checkout data in the United States. Under its data processing agreement, we and FastSpring act as joint controllers for certain personal data related to payments, with each responsible for its own processing. You can contact either of us about your rights.

We do not sell your personal data or share it with third parties for their own marketing.

Cookies

We do not set any cookies when you browse our website.

When you sign up or sign in, we use a cookie that is required to keep you logged in. It is stored for your browser session, or for up to 400 days if you select “Remember me”. Signing out removes it.

We do not use third-party tracking cookies or advertising cookies.

How long we keep data

HTTP and application logs: Up to 90 days.
Login-session records: Up to 90 days after the session’s last activity, or within 30 days of account deletion, whichever is sooner.
Account data: Kept while your account is active, then deleted or anonymized within 30 days of account deletion.
Project data: Kept while the project is active. Personal data in deleted projects or notification channels is deleted or anonymized within 30 days of their deletion. Deleting an account does not change notification channels in projects that remain active.
Public Certificate Transparency records: Retained indefinitely for historical certificate search, independently of account deletion.
Support and contact emails: Up to 12 months after the inquiry is resolved.
Database backups: Kept for up to 30 days from creation. Account data can therefore remain in backups for up to 60 days after account deletion. Deletions are reapplied if a backup is restored.

We may retain specific records longer where needed to meet a legal obligation or handle an ongoing dispute.

Your rights

You can request access to your personal data, corrections or deletion, restriction of processing, and a portable copy of data you provided, where applicable. We normally respond within one month.

You can also object to processing based on legitimate interests for reasons relating to your situation.

You can also complain to the Swedish Authority for Privacy Protection (IMY) or the relevant data protection authority where you live or work.

Changes to this policy