Privacy Policy

Effective: May 1, 2026 · 12 Squared Technologies LLC

This Policy describes what 12 Squared Technologies LLC ("we", "us") collects, how we use it, and the rights you have over your information when you use CertTracker. This Policy is incorporated into the Terms & Conditions.

1. Scope

This Policy covers the CertTracker SaaS application and its supporting websites operated by 12 Squared Technologies LLC. It does not cover third-party websites you reach via links from our pages, or services operated by your CertTracker MSP or reseller.

2. What We Collect

Account information. Email address, username, full name, company name, password (stored as a salted hash; we cannot recover the plaintext), and the contact information you provide for billing and alert routing.

Billing information. Plan selection, billing cadence, subscription status, payment status, and a Stripe customer identifier. Payment card numbers are collected by Stripe and never touch CertTracker servers. We receive only metadata (card brand, last four digits, expiry) from Stripe to display in your account.

Monitor configuration. Hostnames, ports, paths, polling intervals, poller assignments, tags, alert recipient lists, expiry-alert thresholds, and similar configuration you submit.

Polling results. Certificate metadata gathered from public TLS handshakes against the endpoints you configure: subject, issuer, validity dates, fingerprints, signature algorithm, TLS version, cipher suite, IP address, availability status, response time, and similar non-sensitive characteristics.

Communications. Support ticket content, community forum posts, wiki contributions, and email correspondence with us.

Usage and audit logs. Login events, password-change events, account changes, billing events, IP addresses for security and abuse-prevention purposes, and other operational telemetry. Landing-page visitor counts are recorded with hashed IPs (SHA-256), not raw addresses.

Cookies. A session cookie for authentication, a small "ct_seen" cookie used to suppress double-counting in landing-page analytics, and a CSRF protection token. We do not use third-party advertising or cross-site tracking cookies.

3. What We Do Not Collect

CertTracker never collects, transmits, or stores:

Private TLS keys from the endpoints we monitor;
Credentials, API keys, or passwords for the systems you monitor;
HTTP request or response bodies from the endpoints we monitor (only the TLS handshake metadata);
On-host file contents, environment variables, or other data from the machines running our optional private pollers beyond what the poller itself emits in heartbeats and polling results.

4. How We Use Information

We use the information we collect to:

Provide the Service — poll your endpoints, render dashboards, send certificate-expiration and change alerts;
Authenticate your Authorized Users and enforce account-level access controls;
Process billing through Stripe and notify you of billing events;
Detect and prevent abuse, fraud, and security incidents;
Provide customer support and respond to your inquiries;
Improve the Service — aggregate, de-identified usage telemetry informs roadmap and reliability work; individual customer data is not used to train any external model or shared with third parties for their own use;
Comply with legal obligations.

5. Who We Share Information With

We share information only with the subprocessors necessary to operate the Service, and only the data each one needs:

Stripe, Inc. — payment processing. Receives billing email, name, and the payment card details you enter directly into the Stripe checkout form.
Our hosting and network infrastructure providers — receive whatever data is processed by the Service in the ordinary course of hosting it.
Our email delivery infrastructure — receives the alert and notification emails we send on your behalf to the recipients you configure.

We do not sell your personal information. We do not share Your Data with advertisers. We may disclose information when required by law, valid legal process, or to protect the rights, safety, or property of 12 Squared, our customers, or the public. Where the law allows we will notify you of any such disclosure.

6. Data Location

CertTracker's primary infrastructure is hosted in the United States. By using the Service you understand that information about you may be transferred to and processed in the United States, which may have different data-protection laws than your country of residence. We rely on appropriate safeguards (such as Standard Contractual Clauses or equivalent mechanisms with our subprocessors) where required by applicable law.

7. Data Retention

We retain Your Data for as long as your Account is active. After your Account is terminated, Your Data may be retained for up to 30 days before permanent deletion, during which time you may request an export. Backups and audit logs may persist for a longer period — typically up to 12 months — and information required for legal, security, accounting, or fraud-prevention purposes may be retained as long as necessary for those purposes.

8. Security

We use industry-standard protections including TLS for data in transit, salted password hashing (bcrypt-class), least-privilege database access, role-based application authorization, network segmentation between the public web tier and the data tier, and regular security review. No system is perfectly secure; you are responsible for safeguarding your account credentials and for choosing strong, unique passwords.

9. Your Rights

You have the right to access, correct, export, and delete the personal information we hold about you. Most of this you can do yourself from inside the Service (Settings, monitor edit, account management). For data portability specifically, the Export Company Data button on your Administration page lets you download a ZIP containing your company's configuration and history at any time — no ticket required. For requests we can't satisfy through the UI, email support@certtracker.12squared.com and we will respond within a reasonable time and at no charge.

If you are in the European Economic Area, the United Kingdom, or Switzerland: you have additional rights under the GDPR (or equivalent local law) including the right to object to or restrict our processing, the right to data portability, and the right to lodge a complaint with your supervisory authority. 12 Squared is the data controller for the account-level information you provide; for the monitor configurations and polling results you submit, you are the data controller and we are the data processor. A Data Processing Addendum is available on request.

If you are a California resident: you have rights under the CCPA/CPRA including the right to know what personal information we collect, the right to delete it, and the right to opt out of sale or sharing (we do not sell or share for cross-context behavioral advertising). To exercise these rights email support@certtracker.12squared.com. We will not discriminate against you for exercising these rights.

10. Children

CertTracker is not directed at, intended for, or knowingly marketed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

11. Email Communications

We send transactional emails (alerts, billing notices, support replies, security notifications) that are essential to the operation of the Service; these cannot be opted out of while your Account is active. We do not send marketing emails by default. If we add marketing communications in the future, they will include an unsubscribe mechanism.

12. Changes to This Policy

We may update this Policy from time to time. Material changes will be communicated to Account holders by email and through an updated effective date at the top of this page. Continued use of the Service after a change takes effect constitutes acceptance.

13. Contact

Privacy questions or rights requests? Email support@certtracker.12squared.com or write to:
12 Squared Technologies LLC, Washington, United States.