ArgusLeaf
Privacy
What we collect and why.
Last updated: August 2026
Data controller
ArgusLeaf is operated by an independent security researcher ("Operator"). Contact for privacy matters: [email protected].
What we collect
| Category | Data | Retention |
|---|---|---|
| Account data | Name, email, organisation, domain, brand terms, phone (optional), LinkedIn (optional), sector | Until account closure + 30 days |
| Verification data | DNS TXT record presence (token only — full TXT value not stored beyond verification) | Until monitoring is active |
| Technical / server logs | IP address, timestamp, HTTP method, user-agent, response code | 30 days |
| Submission fingerprints | Browser fingerprint metadata included in application emails for identity verification in case of disputes (user-agent, timezone, screen resolution, language, submission timestamp) | Retained with the email indefinitely |
| CT log data | Public metadata: domain names, certificate serials, issuer names, issuance dates | Indefinitely (public data) |
| Enrichment data | HTTP status codes, page titles, DNS records for matched domains | 90 days |
Legal basis (GDPR)
- Article 6(1)(b) — Contract performance: account data is processed to deliver the monitoring service you applied for.
- Article 6(1)(f) — Legitimate interests: security research, fraud prevention, and abuse detection.
- Article 6(1)(a) — Consent: research updates and newsletters, where explicitly opted in.
How we use it
- Deliver monitoring alerts to your email address
- Verify domain ownership via DNS TXT record
- Generate aggregate Observatory statistics (no individual user data appears in published stats)
- Prevent fraud, abuse, and false applications
- Comply with legal obligations if required
Who we share with
Nobody. We don't sell data. We don't share with third parties except where legally compelled (court order, law enforcement request under applicable law). Email delivery uses our own SMTP infrastructure — no third-party email marketing platforms.
Your rights under GDPR (Articles 15–21)
- Access — request a copy of the data we hold about you
- Rectification — correct inaccurate personal data
- Erasure ("right to be forgotten") — we'll delete your account data within 30 days of request
- Restriction — limit how we process your data while a dispute is resolved
- Portability — receive your data in a machine-readable format
- Objection — object to processing based on legitimate interests
To exercise any right, email [email protected]. We'll respond within 30 days.
KVKK (Turkish Personal Data Protection Law)
We process personal data in accordance with Turkey's Personal Data Protection Law (KVKK, Law No. 6698). Data subjects may exercise their rights under Article 11 — including access, correction, deletion, and restriction — by writing to [email protected]. Requests will be addressed within 30 days.
Cookies
We use one functional cookie: al-theme — stores your light/dark mode preference in browser localStorage. No tracking cookies. No analytics. No advertising cookies. No third-party scripts.
Data transfers
Server infrastructure is located in the European Union. We do not transfer personal data outside the EEA unless legally required.
Changes to this policy
We'll notify active users by email before material changes take effect, with at least 14 days notice. The "last updated" date at the top of this page will change accordingly.
Privacy questions: [email protected]