Privacy & Cookie Policy
Version 1.0.0 · Effective 18 October 2026
1. Personal Information
Controller and contact
Solkrone Ltd trading as zuperssl is the controller for the account, sales, support, usage statistics and advertising measurement data described here. Registered office: Suite 11076, 5 Brayford Square, London, United Kingdom, E1 0SG. Company number: 17368118. To exercise data rights or ask a privacy question, email privacy@zuperssl.com or write to that address. The privacy contact above handles data protection requests. We are registered with the UK Information Commissioner’s Office under registration reference ZC209513.
Information we use
We use account/contact details, sign-in security settings such as two-factor authentication if you enable it, subscriber and organisation details, domains and SANs, public keys/CSRs and validation material, private keys generated for your account with your express authorisation, orders, billing references, support messages and attachments. For OV and EV certificates, validation material can include the organisation’s registration details, registered address and telephone number, the applicant’s name, role and contact details, and documents the CA requests to confirm the organisation and the applicant’s authority. For each domain we keep the domain-control validation method, the approver address, the DNS record or file the CA asked for and the validation status it reports. Security and service records include timestamps, IP addresses and source ports, user agents, acceptance choices, document versions, certificate details and access/download events. Stripe collects payment-card details; we keep payment references, the card brand and the last four digits of the card number, and limited results such as authentication and address/security-code check outcomes, not the full card number, the expiry date or the security code. If you are signed in, you can keep several billing addresses in your account, either by choosing to save the address at checkout or by adding them under Billing addresses; after a verified payment we also copy the street address Stripe collected onto the address you used, so your next order and the payment page start filled in. Each order keeps its own copy of the billing details it was placed with; changing or deleting a saved address later does not alter that copy. If we invite your account to a customer group with its own prices, your account records that group; a discount code you use is kept with the payment and the orders it reduced, together with what it took off. We do not intentionally collect special category data, and the service is not directed at people under 18. Our usage measurement records the pages a visit opened, the buttons it used, the free tools it used (for the CSR and CAA generators, which run in your browser, only that a generator was used, never what you entered), the catalogue filters and search terms used, whether a sign-up or sign-in attempt succeeded or was refused, how far it got towards an order, whether a payment attempt was declined, expired unpaid or turned away by our checks (with the reason code the card network or those checks gave) and the site or campaign link it arrived from, together with a coarse device, browser and system class, the interface language and, behind our CDN, a country code; it records no IP address, no browser agent string and no card details. It groups one day’s pages into a visit through the session cookie described in the cookie section and, while you are signed in, is linked to your account.
Purposes and legal bases
We use your information to create an account, take and fulfil your orders, validate your certificate requests and provide support where necessary for our contract with you or steps you request before contracting. Where the customer is an organisation and you act as its contact or representative, we rely on our legitimate interests in administering that relationship and supplying the requested service, balanced against your rights. The same balancing applies to security, abuse prevention, service diagnosis and dispute handling. Accounting and other legally required records are kept to meet legal obligations. Information may come from you, the authorised purchaser or Subscriber, the CA and payment provider, and relevant public domain or company registers. Required account, payment and validation information is needed to supply the requested service; without it we may be unable to proceed. Measuring how our site is used, including which pages, steps and site or campaign links lead to sign-ups and orders, so that we can see where people give up and improve the site, is our legitimate interest under Article 6(1)(f); you can object at any time, as explained under "Objecting to usage statistics". Google Ads purchase measurement requires your separate, prior consent under Article 6(1)(a) and applicable rules for cookies and similar technologies, and stays off unless you allow it. Neither is required to browse, buy or receive support. Contract acceptance and an early-performance request do not provide marketing or measurement consent. You can change your choices and withdraw consent through Privacy choices. We keep a limited record of choices to show that we honour them and to meet our accountability obligations.
Privacy choicesObjecting to usage statistics
You can object to our usage statistics at any time and free of charge: switch off "Usage Statistics" in Privacy choices or let your browser send a Global Privacy Control or Do Not Track signal. We then stop recording visits from that browser, including later events of a visit already recorded, such as its payment. An objection is remembered in that browser for 180 days, as described in the cookie section; use Privacy choices in each browser you use. To have records already collected about your signed-in account deleted, email privacy@zuperssl.com. Objecting does not affect browsing, buying or support.
Privacy choicesInternal service improvement and AI
Where reasonably necessary and compatible with the purpose for which they were collected, we may use relevant support messages and service feedback to understand recurring problems, improve guidance and evaluate support quality. AI may assist with categorising or summarising requests and preparing response drafts, including through selected external AI services subject to the safeguards below. We rely on our legitimate interests in improving our service only after assessing necessity and the balance with your rights; you may object at privacy@zuperssl.com. We prefer anonymous or aggregated information where suitable. AI output is subject to appropriate human review; an AI assessment alone does not decide account suspension or a legal claim. We keep improvement copies only while needed for this purpose, subject to the retention criteria below.
Preparing content for external AI services
Before content is sent to an external AI gateway or selected model provider, it must be limited to what is needed and unnecessary identifying or sensitive details must be removed or masked. This includes names, contact details, account or order references and identifying domains, URLs or contextual details; private keys, passwords, access credentials and payment-card details must be excluded. Removing or replacing identifiers does not necessarily make the remaining content anonymous. If a person is still identifiable using reasonably available information, we treat the content as personal data and the safeguards in this policy continue to apply. External AI use is conditional on appropriate confidentiality, data-processing and transfer safeguards and on service terms and selected settings that do not permit the submitted support content to be used for the providers’ own general-purpose model training. Relevant recipient, location and retention information is available through privacy@zuperssl.com. Data processed under the DPA remains subject to its separate instructions and conditions.
Business eligibility and contract notices
For EU purchase checks we send the VAT country code and number to the European Commission’s VIES service, which checks Member State tax records. We retain its answer as it was given, its time and any business identity information returned with the purchase evidence; VIES gives a seller without an EU VAT number no consultation number, so this record is our evidence of the check. We compare the billing country you declare with the billing and card countries Stripe supplies and the country our network provider associates with your connection, and for each purchase we record the VAT treatment applied, its amounts and that location evidence. This supports our legitimate interests in restricting EU sales to eligible businesses and maintaining accurate tax and transaction records, and compliance with applicable tax obligations. VAT validity does not by itself prove identity or business status. Withdrawal and termination notices you send us are processed to administer the contract, comply with legal duties and establish or defend claims. They follow the relevant contract and claim retention criteria below.
Who receives information
We share only the information needed for each task with: Stripe and the Stripe entities responsible for the payment service under their applicable privacy notice for payment processing, invoicing and fraud prevention; our upstream digital certificate supplier in the United States, which routes applications to the CAs and manages certificate orders; the issuing CA named at checkout, currently Sectigo Limited (United Kingdom) or DigiCert, Inc. (United States), which validates applicants and issues or revokes certificates; Cloudflare, Inc., whose network sits in front of this website to filter attacks and deliver pages and therefore processes connection data such as IP addresses and also provides the anti-bot challenge on public forms; the providers that host this service and deliver our email; and selected external AI gateways and model providers for the limited support processing described above. Where AI recipients process personal data on our behalf, the applicable processing arrangements must be established before use. A recipient’s role depends on its processing: Stripe, the upstream supplier and the CAs act as independent controllers for their own compliance, fraud-prevention and PKI duties, and their privacy notices explain those activities. Hosting and email providers act on our instructions. Contact privacy@zuperssl.com for information about the recipients involved in your order; we provide specific identities and other disclosures where required by data protection law or an applicable DPA. We may share relevant records with advisers, authorities or payment-dispute participants where necessary and lawful; to answer a chargeback, Stripe and the card issuer receive the order, acceptance, access and correspondence records of the disputed payment. Google, including Google LLC in the United States, receives information for Google Ads purchase measurement only if you allow that purpose. Google explains the responsible entities and its own controller processing in the linked business-data notice. Where applicable law treats advertising disclosures as a sale or sharing, you can opt out through Privacy choices. We honour Global Privacy Control without requiring an account.
How Google uses business dataData Processing Agreement
For activities in which we process personal data on your behalf, the Data Processing Agreement section of our Terms of Service applies. It does not reclassify our own controller activities or the issuing CA’s role. Email privacy@zuperssl.com with the subject “Privacy / DPA” for an email copy and to discuss the required processing details. Any required agreement must be in place before that processing starts; requesting a copy is not a condition of data protection rights.
Read the DPA TermsPublic certificate records
Certificate Transparency logs publicly record certificate data, including domain names and, where applicable, organisation information. Independent log operators maintain those records. Entries can remain public after expiry or revocation; we cannot remove them by closing your account.
Account-generated private keys
If you expressly authorise generation during order setup, we process the domain and subject information you provide, generate a private key and CSR, and store the private key encrypted on our server for retrieval from your account. The record is linked to its order and matching CSR, including earlier generated keys when the order later uses another CSR. We record your generation and storage instruction, the displayed text and version, time, and download events without putting the private key into ordinary application logs or acceptance evidence. Private-key downloads require your current account password. This processing supplies the service you request under our contract; where you act for an organisation, the relationship-administration basis described above applies. A separate, unselected email option records your request, risk acknowledgement and chosen recipient address. If selected, our mail provider and the receiving mail systems process an unprotected .key attachment; it is not end-to-end encrypted. The recipient’s mailbox may be operated outside the UK or EEA and follows its provider’s handling and retention. We do not archive private-key attachments or the bodies of private-key messages in our outbound email log. Supplying your own CSR does not send its matching private key to us. These account functions are separate from the browser-only generator and temporary conversion tools below.
SSL tools and submitted files
The standalone browser CSR generator creates keys in your browser and does not send those generated private keys to us; the CAA record generator also runs only in your browser. The CSR decoder processes the CSR you submit on our server. The certificate format converter processes submitted certificates, PFX files and, where the conversion needs them, private keys and file passwords on our server. Submit these only through that dedicated tool over HTTPS, not through support or certificate-application forms. Tool processing uses temporary working files and is designed to remove them when the request finishes; files and key material are not added to your account or order record. Web-server upload buffering and exceptional failures can require subsequent temporary-file cleanup. Checker and mixed-content requests connect to the submitted public site; the chain resolver may fetch issuer certificates from certificate-specified addresses, disclosing our server’s network address and the requested resource to those servers. Normal request/security metadata follows the retention criteria below. Only submit a private key if the Subscriber’s authority, applicable CA terms and your security policy permit that processing; otherwise use a local conversion tool.
International processing
Certificate validation and payment processing involve recipients outside the United Kingdom, mainly in the United States: our upstream digital certificate supplier, DigiCert, Inc., Stripe, Inc., Cloudflare, Inc. and, with your advertising-measurement consent, Google LLC. Sectigo Limited processes data in the United Kingdom and may use group companies elsewhere. Our hosting and email infrastructure providers process data in the United Kingdom or the European Economic Area; transfers from the UK to the EEA are covered by the UK adequacy regulations. External AI processing may also involve recipients outside the United Kingdom or EEA, including in the United States, depending on the selected gateway and model provider. These transfers rely on the safeguards recognised by UK and EU data protection law: a relevant adequacy decision, including the UK-US Data Bridge and the EU-US Data Privacy Framework where the recipient is certified, or otherwise the UK International Data Transfer Agreement or Addendum or the EU Standard Contractual Clauses. The recipient’s location alone does not establish a lawful safeguard. Contact privacy@zuperssl.com for a copy of the safeguard applying to your data. Public CT disclosure is explained separately above.
Retention
We retain account information for account administration and active services. After closure, we delete or anonymise information no longer needed, while retaining records necessary for outstanding services, legal obligations, security investigations or actual or reasonably anticipated claims. UK tax rules generally require accounting records to be kept for at least six years from the end of the relevant financial year; order, agreement, payment and refund evidence may also be needed for applicable claim periods. Our copies of the invoices, receipts and credit notes Stripe issues for your payments are part of those accounting records and are kept for 6 years after the end of the financial year of the payment, so that you can open them from your account after Stripe’s own links expire; when Stripe changes a document, such as a receipt after a refund, the new copy is kept beside the earlier one. Support correspondence is kept while the enquiry is open and afterwards only as needed for the related service, dispute or claim; relevant contract evidence follows that contract’s retention needs. Raw supplier payloads on order audit rows are removed after 730 days; the audit row remains. Checkout acceptances not linked to a payment, or linked to a payment confirmed as failed or expired without completion, are deleted after 90 days. If a payment outcome is unresolved, we keep its acceptance evidence while we reconcile the payment, so a potentially paid purchase is not treated as abandoned. Sign-in records (account, time, IP address and source port, browser identification and the outcome of each attempt, including failed attempts, as well as password changes and pauses of the two-factor step) are kept for 400 days for account security, fraud prevention and to evidence use of purchased services in a payment dispute; for an account with a payment dispute, older sign-in records are kept while the dispute is open or until 400 days after the dispute was opened. Operator alert records, which can name an order, an account or a network address involved in a payment or security event, are kept for 400 days. Application request logs, which record each request together with the values a form sent (passwords, security codes, keys and card data masked) to diagnose errors and protect the service, use a 30-day rotation. Our web server’s access records (time, IP address and source port, the address requested, the response status and browser identification, but not what a form sent) are kept for 365 days, so that a connection can be traced when a competent authority lawfully requests it and to investigate abuse of the service; other hosting, security and backup records have their own operational retention, subject to necessity and legal holds. We review continued retention rather than treating account closure as erasure of every record. Contact privacy@zuperssl.com for the retention or deletion position for your records. CA and public CT records follow their separate obligations. An issued certificate and its chain are kept with the order record for as long as that record is needed as evidence of the contract; the certificate itself is public information that the CA also publishes to CT logs, and our copy is held encrypted. Account-generated private keys and their matching CSRs are kept with the account and order for the requested retrieval service, including earlier generated keys after a CSR change. We review the need to retain those keys when the account is closed or deletion is requested; financial or agreement evidence can remain without retaining a private key solely as accounting evidence. Contact privacy@zuperssl.com to request deletion and discuss the effect on future downloads. Usage measurement records are kept for 365 days, including daily breakdowns containing search terms, referring hosts, campaign labels or payment outcome reasons. We retain anonymous daily totals and breakdowns by public categories; those retained summaries exclude account and payment references. Copies of the service emails we send you (recipient, subject, content and delivery outcome) are kept for 400 days as evidence of what was sent and to diagnose delivery problems; the content is stored encrypted and messages carrying a sign-in link or private key are kept without their content, and attachment contents are not archived. We remember privacy choices for 180 days. We retain the limited record of each privacy choice for 24 calendar months from that choice, including an objection, withdrawal or rejection. These are our reviewable retention periods, not statutory fixed periods. The record contains random references, the choice, time, expiry, language, policy version and the text shown. We do not add your IP address, browser user-agent or account identity to it. When we prepare a purchase event, we link the payment and its consent record to evidence permission. This record is deleted with the related consent record and does not prove that Google received the event. Google applies its own retention rules to information already received.
Security reviews and account closure
Abuse reports and account-review records may include allegations, relevant technical evidence and the explanation for a decision. We assess their relevance and accuracy and restrict access to those who need them for security, compliance or dispute handling. Account closure does not immediately erase required transaction evidence. We consider erasure requests against the retention criteria above; where lawful, you may ask us to correct inaccurate information or review a restriction.
Your choices and rights
If you wish to exercise your data protection rights, including access, correction or deletion, or request a Data Processing Agreement (DPA), please contact us at privacy@zuperssl.com. Your account name and email address cannot be edited in self-service; ask support to correct them and we will do so after verifying your identity. Saved billing addresses can be edited or deleted in your account without contacting us; the copy kept with each order is part of the order record and is retained with it. Depending on the applicable law, you may also request restriction or portability, and object to processing based on legitimate interests, including our usage statistics. You may withdraw consent without affecting earlier lawful processing. Some records must be retained to comply with law or defend claims. We may verify your identity before releasing data. You can complain to the UK Information Commissioner’s Office (ICO), 4th Floor, No.3 Circle Square, 5 Hawkshaw Street, Manchester, M1 7BL, United Kingdom, telephone 0303 123 1113, or to the competent authority where you live. Automated security, eligibility and payment checks may block a request or flag it for review. Some run after a purchase: where a card issuer or network reports a payment as unauthorised, an automated response refunds the order in full, cancels it and asks the CA to revoke any certificate issued for it, and we email you that this has happened. Automated limits on declined payments, account openings and failed sign-ins can temporarily pause checkout, sign-up or sign-in for an account or an internet connection; these limits lift by themselves as the counted attempts age, and repeated patterns can also flag an account for review. Repeated wrong two-factor or recovery codes pause that step for the account, first for 15 minutes and longer if it happens again; we email the account holder when this happens and when the account password changes. Stripe and the CA apply their own checks in addition. In every case you may contact us to request human review of the decision, explain your circumstances and contest inaccurate information, and we will explain the decision as far as the law allows; where a decision is reversed we restore what we reasonably can and a new order can be placed at any time. We do not describe an automated report or rejection as proof of fraud.
Email a privacy requestData protection complaints
You can complain about our handling of your personal data using the public contact form, emailing privacy@zuperssl.com or writing to Suite 11076, 5 Brayford Square, London, United Kingdom, E1 0SG. No account or purchase is required. We acknowledge complaints within 30 days, investigate, keep you informed and provide the outcome without undue delay. A complaint does not replace a request to exercise your rights or extend the separate deadlines for those requests. You may also complain to the ICO or your competent supervisory authority.
Send a data protection complaintContact the regulator
You can contact the UK Information Commissioner’s Office at 4th Floor, No.3 Circle Square, 5 Hawkshaw Street, Manchester, M1 7BL, United Kingdom or on 0303 123 1113.
Complain to the ICOSecurity and updates
Access is restricted to people who need it. We use encryption for protected records and HTTPS for the public service; no method eliminates every risk. This policy is updated when processing changes. Material changes will be explained through the website or appropriate account communication. Earlier order agreements remain in your order record.