Privacy Policy

1. Who we are

TrustCtrl is a digital trust monitoring platform built and operated in Denmark by Certiva ApS (CVR: 46450965). References to "we", "us" or "our" in this policy refer to Certiva ApS, which acts as the data controller for the data described below.

For the monitoring data that customers add to the platform, we act as a data processor on the customer's behalf — this is governed by our Data Processing Agreement (DPA).

For questions about this policy, contact us at mail@trustctrl.com.

2. What data we collect

• Account data: company name, your name, email address, and password (stored bcrypt-hashed — we never store or see your plain-text password)
• Monitoring data: the domains and hostnames you add, and technical observations about them collected during scans — certificate metadata, DNS records, HTTP responses, page content, email-authentication records and scan results
• Technical and log data: IP addresses, session identifiers and security-relevant logs needed to operate and protect the platform
• Web analytics: first-party, anonymous visit statistics on this website — collected only if you consent via the cookie banner (see the Cookie Policy)
• Communication data: messages you send us by email

The Service is free during early access, and we do not collect any payment details.

3. How we use your data

• To provide and operate the TrustCtrl platform
• To send service-related notifications — for example down/up alerts, certificate expiry reminders and the weekly digest
• To respond to support requests and enquiries
• To keep the platform secure and improve how it works
• To comply with legal obligations

We do not use your data for advertising, and we do not sell it or share it with third parties for marketing purposes.

4. Legal basis (GDPR)

Our processing is based on:

• Contract performance (Art. 6(1)(b)) — to deliver the service you signed up for
• Legitimate interest (Art. 6(1)(f)) — to keep the platform secure and improve it
• Legal obligation (Art. 6(1)(c)) — where required by applicable law
• Consent (Art. 6(1)(a)) — for web analytics, which you can withdraw at any time via the Cookie settings link in the page footer

5. Where your data is stored

All data is stored on infrastructure located within the European Union. We do not transfer personal data to countries outside the EU/EEA without adequate safeguards in place.

6. Data retention

We retain account data for as long as your account is active, plus a reasonable period thereafter to fulfil legal obligations. Monitoring data is retained while the related domain is being monitored, so the platform can show trends and history. Data that is no longer needed is deleted or anonymised.

You may request deletion of your data at any time by contacting us.

7. Your rights

Under GDPR you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Request erasure ("right to be forgotten")
• Restrict or object to processing
• Data portability
• Withdraw consent, where processing is based on consent
• Lodge a complaint with a supervisory authority — in Denmark, Datatilsynet

To exercise any of these rights, contact us at mail@trustctrl.com.

8. Security

TrustCtrl is built with security as a core requirement. Passwords are bcrypt-hashed, traffic is encrypted in transit with TLS, and stored secrets are encrypted at rest with AES-256-GCM. Two-factor authentication (TOTP) is available and can be enforced organisation-wide, and access within an organisation is governed by fine-grained role-based access control.

9. Cookies

We use necessary cookies for login and security on the application pages, and optional first-party analytics that only run with your consent. The full overview — including every cookie and storage key we use — is in the Cookie Policy. You can change your choice at any time via the Cookie settings link in the page footer.

10. Changes to this policy

We may update this policy from time to time. Material changes will be communicated to registered account holders by email. The "last updated" date at the top of this page reflects the most recent revision.

11. Contact

For any privacy-related questions or requests:
Certiva ApS (CVR: 46450965)
Denmark
Email: mail@trustctrl.com
Web: trustctrl.com/contact