CTlogs.io privacy & data

Controller Lyalpha GmbH

Account Name, email address, password, the network and the page the account was opened from

Stripe customer identifier, subscription status and dates, card brand and last four digits.

for each active sign-in, the network and browser identification of the session

A pseudonymised record of each search and each use of a free tool

The subject and text of ticket messages with their timestamps.

For each logged certificate: the hostnames it covers and their registrable domain, the issuing authority, the validation type, the validity period, the fingerprint

kept for 7 days to keep the service available

Basis: Art. 6(1)(b) GDPR, providing the account

Art. 6(1)(f) for attributing abuse to an account

preventing repeat abuse and re-registration

Detecting mis-issued and unauthorised certificates, impersonation and phishing

kept for 7 days to keep the service available

Kept for as long as the account exists; sign-in records for 30 days.

Kept for eight to ten years as German commercial and tax law requires.

Kept for up to two years after the account is closed.

For as long as the index is maintained; expired certificates remain as history.

keep them for as long as a removal is in force and for three years afterwards

These processors process data in the United States.

Transfers are covered by the EU-US Data Privacy Framework where the processor is certified under it

otherwise by the European Commission's Standard Contractual Clauses.

Stripe Payment processing and subscriptions. Resend Delivery of email. Cloudflare Content delivery and protection. Hivelocity Hosting of the application and its databases.

To exercise them, write to

You have the right of access (Art. 15 GDPR)

rectification (Art. 16)

erasure (Art. 17)

restriction of processing (Art. 18)

data portability (Art. 20)

You may object at any time, on grounds relating to your particular situation

You have the right to lodge a complaint with a supervisory authority.