This Privacy Policy explains how Pcnaid Inc. (“AutoCertify,” “we,” “us”) collects, uses and protects information when you use AutoCertify — the website at autocertify.net, the dashboard and the API (the “Service”). We keep this deliberately plain, because privacy shouldn't require a translator.
1. Information we collect
We collect only what we need to run the Service:
- Account information. When you sign up, authentication is handled by Auth0. We receive your email address, a user identifier and basic profile details (such as your name if you provide it). We do not receive or store your password.
- Domains & DNS records. The domain names you add and the DNS/delegation records needed to validate control and issue, install and renew certificates.
- Contact-form submissions. If you contact us, we collect the name, email, topic, optional domain and message you send, so we can respond and keep a record of the conversation.
- Usage & logs. Technical information generated as you use the Service — API requests, certificate and delegation status events, timestamps, IP address, and browser/user-agent — used for operating, securing and debugging the Service.
- Billing information. If and when paid billing is enabled, plan and subscription details. Card payments, where offered, are processed by our payment provider; we do not store full card numbers.
- Cookies & browser storage. Authentication, session and theme preferences use cookies or local browser storage. When PostHog is configured for the portal, product analytics can also use browser storage and collect page views and interaction events. The public marketing site stores your theme preference.
2. How we use information
- To provide the Service: validate domain control, request managed certificates, retrieve provider status and support DNS setup.
- To keep the Service secure and reliable, prevent abuse, and diagnose and fix problems.
- To communicate with you through DNS verification invitations and reminders, service notices, and replies to your questions.
- When analytics is enabled, to understand product usage and improve the portal and API.
- To manage plans and billing where applicable.
- To meet legal obligations and enforce our Terms of Service.
We do not use your data to build advertising profiles, and we do not sell it.
3. Legal bases
Where data-protection laws such as the GDPR apply, we rely on: performance of a contract (to deliver the Service you signed up for); our legitimate interests (to secure, maintain and improve the Service); consent where we ask for it; and legal obligation where the law requires. You can withdraw consent, where it's the basis, at any time.
4. Sub-processors & service providers
We rely on a small set of trusted providers to operate the Service, and share only what each needs to do its job:
- Cloudflare — custom hostnames, managed certificate delivery, edge hosting, contact-form storage and abuse prevention.
- Auth0 (Okta) — authentication and login.
- Resend — transactional and notification email delivery (including contact-form notifications).
- Microsoft Azure & managed Postgres — application hosting and data storage.
- Stripe — payment processing, if and when paid billing is enabled for your account.
- Sentry — application error reporting and diagnostics when configured.
- PostHog — portal and API product analytics when configured.
These providers process data on our behalf under their own security and privacy commitments. We may add or change sub-processors as the Service evolves and will keep this list current.
5. How we share data
We do not sell your personal data. We share it only: with the sub-processors above to run the Service; when you direct us to; to comply with the law or a valid legal request; to protect the rights, safety and security of AutoCertify, our users and the public; or as part of a business transfer (such as a merger or acquisition), in which case we'll ensure it remains protected under terms consistent with this Policy.
6. Data retention
We keep your information for as long as your account is active and as needed to provide the Service. Domain and certificate data is retained while a domain is under management; logs are kept for a limited period for security and operational purposes; contact-form submissions are kept as long as needed to handle and record your request. When data is no longer needed — or when you ask us to delete it — we delete or de-identify it, except where we're required to retain it by law.
7. Security
We practice least-data handling, keep certificate key material with Cloudflare (there are no private keys or PEM files for you or us to export), encrypt traffic in transit over TLS, authenticate access with Auth0, scope API keys, sign webhooks, and record workspace audit events. For a fuller description of our controls, see our Security page. No system is perfectly secure, but we work hard to protect your data and to be honest about how.
8. Your rights
Depending on where you live, you may have the right to access, correct, export, restrict or delete your personal data, and to object to certain processing. You can update much of your account information directly in the dashboard. For anything else — including access, export or deletion requests — email [email protected], and we'll respond within the time the law requires. You also have the right to complain to your local data-protection authority.
9. International data transfers
We and our providers may process and store data in the United States and other countries where they operate. Where we transfer personal data across borders, we rely on appropriate safeguards — such as the standard contractual clauses offered by our providers — to protect it in line with applicable law.
10. Children
AutoCertify is a business tool and is not directed to children. The Service is intended for users aged 16 and over, and we do not knowingly collect personal data from anyone under 16. If you believe a child has provided us personal data, contact us and we'll delete it.
11. Changes to this Policy
We may update this Policy as the Service changes. When we make material changes, we'll update the “Last updated” date above and, where appropriate, notify you. Your continued use of the Service after an update means you accept the revised Policy.
12. Contact
Questions about your privacy or this Policy? Email [email protected], or use our contact page. AutoCertify is operated by Pcnaid Inc., a Texas, USA company.