Privacy policy

Who is responsible

The controller for the processing described here, under the EU General Data Protection Regulation (GDPR), is the operator of NetworkAI, reachable at support@networkaitools.com.

For any privacy question or request, write to support@networkaitools.com. We have not appointed a data protection officer, as the law does not require one for a service of this size.

Your account

When you sign up we store your email address and a hashed password, or, if you sign in with Google or GitHub, your email address and the account identifier that provider returns. We create an organisation record for your account and store your role in it.

We use this to log you in, to send you alerts and service messages, and to run your subscription. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).

Domains you monitor and alert settings

For each domain you add we store the hostname and port, and the result of each check: certificate dates, issuer, serial number, fingerprint, subject alternative names, chain and revocation status, key and signature algorithm, domain registration expiry and DNS status. This data describes public servers, not people, but it is linked to your account.

For notifications we store the destinations you configure: email addresses (including any To, CC and BCC recipients you add), Slack incoming-webhook URLs and custom webhook URLs. Webhook URLs and signing secrets are kept encrypted at rest. We keep a record of which alerts were sent, to avoid sending the same alert twice.

Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR). If you add colleagues' email addresses as recipients, please make sure they expect our alerts.

Payments

Paid plans are billed by Stripe. You enter your card or payment details on Stripe's pages; they never reach our servers. We store only your Stripe customer ID, your plan, its status and the end of the current billing period.

Legal basis: performance of our contract (Art. 6(1)(b) GDPR), and our legal obligation to keep invoices and accounting records (Art. 6(1)(c) GDPR).

Free tools

The free checkers work without an account. When you run one, the hostname, domain or URL you enter is sent to our server, which performs the lookup and returns the result.

• Results are cached for 10 minutes, keyed by the input, so repeated checks of the same domain do not hit the target again.
• A result is stored for 30 days only if you click Share, so the share link works. It is then deleted automatically.
• Rate limiting uses a salted, one-way hash of your IP address, never the address itself. The counters expire after at most one day.
• We count tool usage as anonymous events (which tool, which language, what happened), with no IP address, input or user ID.

Our lookups identify themselves to the servers they contact; see how NetworkAIBot behaves. Legal basis: our legitimate interest in offering the tools and protecting them from abuse (Art. 6(1)(f) GDPR).

Waitlist and contact form

If you join a waitlist we store your email address, your language and the page you signed up from. We send a confirmation email first, and only add you once you confirm (double opt-in). Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by writing to us.

If you use the contact form we store your name, email address, company, the domain-count range you chose and your message, and forward it to us by email so we can reply. Legal basis: steps taken at your request before entering a contract (Art. 6(1)(b) GDPR).

Visiting the website

Our hosting provider processes your IP address and request details to deliver pages and keeps short-lived server logs for security and debugging. We count page views with our hosting provider's cookieless web analytics, which does not track you across sites. Legal basis: our legitimate interest in running a secure, working website (Art. 6(1)(f) GDPR).

Google Analytics (only with your consent)

If you click Accept analytics in the cookie banner, we load Google Analytics 4, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. If you decline or ignore the banner, Google Analytics is not loaded at all and Google receives nothing from us.

With your consent, Google Analytics sets cookies (_ga and _ga_<ID>, kept for up to 2 years) and records which pages you view, the address of the page (including any query string, such as a hostname you opened a tool link with), where you came from, your device, browser and approximate location, and events such as running a free tool (which tool, which language and whether it passed), signing up, starting checkout and completing a purchase. It does not receive what you type into a tool or your email address. Google Analytics 4 does not log or store IP addresses. We have turned off Google signals and ad personalisation, and we run no ads.

We use this to see which pages and tools are useful and where people get stuck, so we can improve them. Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time with Cookie settings at the bottom of every page; we then stop collection and delete the _ga cookies. Google may process data in the United States; Google LLC is certified under the EU–US Data Privacy Framework. Data in Google Analytics is kept for 14 months.

Cookies and local storage

We use no advertising cookies. The only cookies that need your consent are the Google Analytics cookies described above, which are set only after you accept them in the cookie banner. Everything else is what the site needs to work, which German law (§ 25(2) TDDDG) permits without consent:

• Login session cookies, set by our authentication provider when you log in.
• A language preference, so the site stays in the language you chose.
• Your light or dark theme choice, saved in your browser's local storage (networkai-theme). It never leaves your device.
• Your answer to the cookie banner, saved in your browser's local storage (networkai-analytics-consent), so we don't ask again on every page. It never leaves your device.

Who processes data for us

We use the following categories of providers. Each processes data only on our instructions under a data processing agreement, except where noted. A current list of the providers by name is available on request from the address in the first section.

• Hosting provider — delivering the website, running scheduled checks and cookieless page-view counting.
• Database and authentication provider — storing your account and monitoring data, and handling log-in.
• Email delivery provider — sending alert, confirmation and service emails.
• Cache provider — rate-limit counters (hashed only) and the 10-minute result cache.
• Stripe — payment processing. You see Stripe's pages when you pay; Stripe is also an independent controller for its own fraud prevention and legal obligations.
• Google — Google Analytics, only if you consent to it (see above).
• Google and GitHub — only if you choose to sign in with them.
• Slack or your own endpoint — only for the alert channels you configure.

Some of these providers are based in the United States or may process data there. Where that happens, transfers rely on the EU–US Data Privacy Framework for certified providers, or on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). We do not sell personal data or share it for advertising.

How long we keep it

• Account, domains and alert settings: while your account exists. When you delete your account, they are deleted.
• Check results: 90 days, then deleted automatically.
• Shared free-tool results: 30 days. Cached results: 10 minutes. Rate-limit counters: at most one day.
• Google Analytics data (with consent only): 14 months, then deleted by Google.
• Billing records: as long as tax and commercial law requires, which in Germany is up to 10 years.
• Waitlist: until you unsubscribe or the waitlist is closed.
• Contact enquiries: until the conversation is finished, and no longer than 12 months.

Your rights

Under the GDPR you can ask us for a copy of your data (Art. 15), to correct it (Art. 16), to delete it (Art. 17), to restrict its processing (Art. 18), and to receive it in a portable format (Art. 20). You can object to processing based on legitimate interest (Art. 21), and withdraw consent at any time without affecting what happened before (Art. 7(3)).

To use any of these rights, including deleting your account, email support@networkaitools.com from the address on your account. We answer within one month.

You also have the right to complain to a data protection supervisory authority, in particular the one where you live or work.

Security

All traffic to and from NetworkAI is encrypted with TLS. Database access is restricted by row-level security so each organisation sees only its own data, and channel secrets are encrypted at rest. Our checks are read-only: we connect to the servers you name the way a browser would, and never try to log in or change anything.

Other points

We make no decisions about you by automated means that have legal or similarly significant effects. NetworkAI is a service for professionals and is not directed at children.

If we change this policy we update the date at the top of this page, and for material changes to how your account data is used we tell account holders by email in advance.