Terms of service.

1. The service

ArgusLeaf monitors public Certificate Transparency logs and other public data sources for domain names that statistically resemble brand terms you provide. The service is operated by an independent security researcher ("Operator"). We reserve the right to modify, suspend, or discontinue the service at any time, with reasonable notice where possible.

2. Beta status and no SLA

ArgusLeaf is in public beta. Access for the first 50 registered organisations is provided at no charge for the duration of the beta period. We make no commitment as to how long the beta period lasts or what pricing may apply afterwards — active users will receive at least 30 days' notice before any paid tier is introduced.

We will make reasonable efforts to notify active users of planned maintenance, but reserve the right to modify, suspend, or discontinue any part of the service at any time.

3. Eligibility

You must be authorised to request monitoring for the domain(s) you submit. You represent that you have the authority to act on behalf of the organisation you name in your application.

Submitting a domain you don't control — to monitor a competitor, an individual, or an organisation you're not affiliated with — is a material breach of these terms and may be referred to law enforcement. We verify domain ownership via DNS TXT record before activating monitoring.

4. What the service is not

ArgusLeaf is not a legal service. We do not provide legal advice. A finding from ArgusLeaf is an automated signal — not a confirmed case of abuse, phishing, or trademark infringement.

5. Acceptable use

You may not use ArgusLeaf to:

• Monitor individuals — only organisations and brands;
• Attempt to identify private persons;
• Circumvent the DNS ownership verification process;
• Submit false information to obtain monitoring access;
• Reverse-engineer, scrape, or overload the service infrastructure;
• Use the service in any way that violates applicable law.

6. Data you provide

By applying for monitoring, you provide: organisation name, contact name, email address, phone number (used for identity verification at sign-up only), LinkedIn profile URL, sector, and brand terms. We use this data only to provide the monitoring service. We don't sell it, share it with third parties, or use it for advertising. See our Privacy Policy for full details.

Retention. We retain data for the following periods:

• CT log metadata (domain name, issuer, serial, date) — indefinitely; this is public data available to anyone.
• Enrichment results (HTTP status, page title, DNS records, screenshots) — 90 days, then purged.
• Account data (name, email, organisation, phone, brand terms) — retained while your account is active, then deleted within 30 days of closure. Deletion does not apply to the archived application email and its associated metadata (see below).
• Application metadata (browser fingerprint, timezone, submission timestamp included in the application email) — retained with the archived application email indefinitely for identity-verification purposes in the event of a dispute about authorisation.

7. Unsubscribe and cancellation

Unsubscribing from alerts is a one-click action: every alert email contains an unsubscribe link in its footer. Clicking it stops alert delivery immediately. Unsubscribing stops email delivery only — monitoring continues to run and matches continue to be stored under the §6 retention periods until you close your account. Your monitoring account remains open and can be reactivated by emailing us.

Closing your account is a separate action: email [email protected] with "account closure" in the subject. We will delete your watch-list, contact details, and alert history within 30 days. CT log metadata is not deleted — it is public data we did not generate and that others independently retain.

8. Observatory

Observatory data — aggregate sector statistics and campaign trends — is published openly under CC BY 4.0. Aggregate statistics may be reproduced with attribution. Individual monitoring findings (Watch data) are never published.

9. Liability

The service is provided as-is, without warranty of any kind, express or implied. We are not liable for: missed detections, false positives, service outages, data loss, or any actions you take based on alerts. To the maximum extent permitted by applicable law, our total liability to you is zero monetary damages.

Nothing in these terms excludes or limits liability for wilful misconduct, gross negligence, death or personal injury caused by our negligence, or any liability that cannot be excluded under applicable law — including rights under GDPR and KVKK.

10. Termination

We may terminate your monitoring account at any time for breach of these terms. You may close your account at any time following the process in §7; deletion timelines in §6 and §7 apply. Upon termination for breach, account deletion follows the same §6 and §7 schedule.

11. Governing law

These terms are governed by the laws of the Republic of Türkiye, where the Operator is resident. The Istanbul Courts and Enforcement Offices shall have exclusive jurisdiction over disputes arising from these terms. You agree to submit to the personal jurisdiction of those courts.

This governing law clause does not limit any data-subject rights you hold under applicable data-protection law (including GDPR and KVKK), which are described in the Privacy Policy and apply regardless of jurisdiction.

12. Changes to these terms

We'll email active users at least 14 days before material changes take effect. Continued use of the service after that period constitutes acceptance of the revised terms. We'll keep past versions accessible at this URL with a dated changelog.

Questions about these terms: [email protected]