This policy explains what personal data A.Rahman Abdulla Mufarreh Abdulla Mufarrah, an individual based in Madinat Hamad, Kingdom of Bahrain ("we"), the operator of ExpiryOwl, processes, why, and who helps us. We try to collect as little as possible.
What we process
| Data | Why | Kept for |
|---|---|---|
| Account email address and name | To run your account, sign you in, send alerts and reports you set up, and a few product emails (see below). | Until you delete the account |
| Monitored hostnames, client names and contact emails you add | To run the checks and send reports. | Until you delete them or the account |
| Check results (certificate details, registration data, DNS records, response times) | To show history, detect changes and alert you. | While the host is monitored, then up to 90 days |
| Alert channel settings (webhook URLs, chat IDs) | To deliver alerts. Secrets are stored encrypted. | Until you remove the channel |
| IP address and browser user-agent | Security, rate limits on sign-in and the free tools, and an audit log of account changes. | Up to 90 days (audit entries up to 1 year) |
| Product usage events (for example "tool used", "monitor added") | To understand which features help. First-party only, no third-party trackers or ad cookies. | Up to 2 years, aggregated after that |
| Billing details | Handled by Paddle. We see your plan, country and invoice status, never your card number. | As required for tax records |
Hostnames typed into a free tool are checked and not stored. We keep an anonymous count of tool uses and, for rate limiting, your IP address for about an hour (until the hourly limit window ends).
Cookies
We set one session cookie when you sign in, and remember your light or dark theme choice in your browser. After you finish setting up your account we set eo_onboarded for 1 year, so the dashboard doesn't show the setup steps again; it holds only your organisation's ID. When you open a team invitation or switch between organisations, eo_org (1 year) remembers which organisation the dashboard shows; it also holds only an organisation ID. There are no advertising or cross-site tracking cookies.
The first time you open a page on our site we also set one first-party cookie, eo_attr, for 30 days. It holds where the visit came from: the campaign tags in the link (utm_source, utm_medium, utm_campaign), the name of the referring website (only its domain, never the full address) and the path of the first page you opened. It contains nothing about you personally. If you create an account, we copy these values onto your organisation so we can see which channels bring customers. No third-party scripts read it.
Sub-processors
| Provider | What for | Data involved |
|---|---|---|
| Paddle | Payments, invoicing, sales tax (merchant of record) | Name, email, billing country, payment details |
| Resend | Sending sign-in links, alerts, reports and product emails | Recipient email addresses, email content |
| Google (Gemini API) | Writing the short summary in monthly client reports | Your agency name, the client's name, hostnames and check results for that report; no account passwords or payment data |
| Hostinger | Server hosting | All service data (stored on our server) |
| Cloudflare | Network and TLS in front of the server, and routing mail sent to our addresses | Request metadata such as IP addresses; sender address of mail to us |
| Google (Gmail) | Our support inbox: mail to support@ and hello@ arrives there | Your email address and what you write to us |
| Zoho Mail | Our mailbox for emails to businesses we contact (see Contacted businesses below) | The business contact address, our emails and any replies |
If report summaries can't be written by Gemini, we fall back to a model running on our own server or a plain template, so the report never depends on it.
To run the checks we send the hostnames you monitor (never personal data) to the domain registries' RDAP services, to Certificate Transparency search services (Cert Spotter and crt.sh) and to public DNS resolvers (Cloudflare 1.1.1.1 and Google 8.8.8.8). They receive only the hostname being looked up.
Contacted businesses
This part is for people at businesses we contact about their business websites. Now and then we write one short email to a web agency or studio when a public check shows something about a site it looks after, for example a certificate that should have renewed and hasn't. ExpiryOwl is independently run, so that email comes from the operator named at the top of this policy.
What we collect. The name of the business, its website, the contact address the business published itself and the page where it was published, the country and legal form of the business (such as Ltd or LLC, because the rules for business email differ by country), a short note about the finding (something publicly visible about a certificate, domain registration or DNS record) with the date we checked it, and the dates we wrote, whether you replied and whether you later created an account.
Portfolio reports. Sometimes the email links to a short report instead: the result of the same public certificate check for the client sites your own website lists as your work, at a private link that only the email contains. We record how many times that link was opened and when it was first and last opened, nothing about who opened it (no IP address, no browser details). The report is deleted 6 months after we make it, or earlier together with the rest of your details.
Where it comes from. Your own public website; public Certificate Transparency logs, DNS records and domain registration (RDAP) data; and partner or agency directories that we browse by hand, only to find business names. We don't buy lists, scrape contact details or copy addresses from directories.
Why. To send one short email about that finding and about ExpiryOwl, and at most two follow-ups if you don't answer. We don't sell or share this data and we don't add you to any mailing list.
Legal basis. Our legitimate interest in telling a business about a publicly visible problem with a website it looks after and in offering a tool that helps (GDPR Article 6(1)(f) and Recital 47). In the UK we write only to companies and LLPs, as the PECR rules for corporate subscribers allow, never to sole traders or partnerships without consent. We don't send this kind of email to businesses in Germany.
How long we keep it. If you don't reply, we delete your details 6 months after our last email. If you reply but don't become a customer, we delete them a year after the last message. If you object, we remove your contact details at once and keep only a one-way hashed form of your address, or your domain, on a do-not-contact list, so that we never write to you again.
Your rights. You can object at any time and we stop the same day: reply "no thanks" to the email or write to [email protected]. You can also ask what we hold about you, have it corrected or erased, and complain to a data protection authority.
Who. A.Rahman Abdulla Mufarreh Abdulla Mufarrah, an individual based in Madinat Hamad, Kingdom of Bahrain, the operator of ExpiryOwl.
Product emails
If you have an account, we may send you a few one-off emails about using ExpiryOwl: a reminder to add your sites a day or two after you sign up, if you haven't yet, and a note when your first client report is ready. Each is sent at most once, only to account holders, never to your clients, and only to accounts created after we started sending them. We send them because of our legitimate interest in helping you use the service you signed up for.
Every product email has a link to stop them, which also works with one click from your mail app, and you can switch them off or on again under Settings › Emails in the dashboard. Stopping them doesn't stop alerts, sign-in links, team invitations, receipts or the reports you send to clients. We don't send newsletters.
Your rights
You can see, export, correct and delete your data from the dashboard, or ask us at [email protected]. Depending on where you live you may also have the right to object to or restrict processing and to complain to a data protection authority. We answer requests within 30 days.
Changes
If we change this policy in a way that matters, we'll email account holders before it takes effect. The date at the top shows the latest version.