Privacy Policy

Last updated: November 2026

1. Data controller

FairSSL A/S (Denmark) is the data controller for personal data processed through sslbrain.com and sslbrain Cloud (EU). Privacy-related inquiries: info@fairssl.dk.

2. Scope

This policy covers sslbrain.com and sslbrain Cloud. The sslbrain appliance runs On-Premise, and your data stays on the appliance. What the appliance sends to sslbrain Cloud is listed on the architecture page.

3. Data we collect

  • Contact and account details: name, email, company, and the content of your message when you write to us or create an account.
  • The sslbrain Cloud service data: licence and usage information needed to deliver the service.
  • Website analytics: cookieless measurement of visits to sslbrain.com. We record how the site is used and which referral and campaign parameters in the URL brought traffic, including an ad's click ID. No other parameter in the address is sent to analytics.
  • Server access logs: standard web server logs for all requests to our infrastructure, with IP address, browser (user agent), time and the requested address.

4. Purposes

  • Delivering and administering sslbrain Cloud
  • Security monitoring, attack prevention, and incident investigation
  • Operational stability and troubleshooting
  • Internal analytics for the site and our own marketing
  • Ad measurement, once you have agreed to it (section 7)
  • Responding to your inquiries

5. Legal bases

  • Performance of a contract (GDPR Art. 6(1)(b)) for sslbrain Cloud.
  • Legitimate interest (Art. 6(1)(f)) for security, operations, analytics, and internal marketing measurement. You have the right to object.
  • Consent (Art. 6(1)(a)) where we expressly ask for it, for example for the newsletter and ad measurement.

6. Cookies and consent

The marketing site sets no non-essential cookies. All analytics are cookieless and stay on our own infrastructure. The sslbrain.com/cloud portal uses only strictly necessary cookies for login and security. For that reason, we do not show a consent banner.

7. Ad measurement with your consent

When you arrive at sslbrain.com from an ad, the address carries the ad's click ID, for example gclid from Google Ads. Website analytics stores it with the visit, and so do the server access logs. If you then create an account or buy, sslbrain Cloud asks whether we may tell the advertising platform that the ad worked.

  • Yes: we send the click ID and the time of the sign-up or purchase to the platform the ad came from, and for a purchase also the amount. Nothing else: not your name, your email or your IP address.
  • No, or no answer: nothing is sent. If you have not answered, we ask again the next time you log in.
  • Your answer: we store it with the time and the text you answered. You can change it at any time in your account settings, and a no applies from the moment you give it.

8. Data we do NOT collect

As an On-Premise product, we never have access to:

  • Certificate private keys
  • Passwords, SSH keys, or API keys for your servers and devices
  • Internal network information and domain names on certificates not ordered through sslbrain Cloud
  • The appliance’s audit log

See what the appliance sends to sslbrain Cloud on the architecture page.

9. Recipients

We do not share personal data with data brokers or third-party marketing systems. An advertising platform receives only what section 7 describes, and only after you have said yes. The sub-processors that process customer data on our behalf are covered by a written data processing agreement and listed under Sub-processors.

Other suppliers for which we act as data controller

The suppliers below do not process customer data on the customer’s behalf. We use them in our own business, where FairSSL A/S is the data controller. They are therefore not sub-processors.

  • Google Ireland Limited, Ireland: Ad measurement with Google Ads, only with your consent (section 7). Any transfer to Google LLC in the USA is covered by the EU-U.S. Data Privacy Framework (DPF).

We also use payment providers and card acquirers, banks, an accounting system and bank reconciliation to complete and book payments. Data is processed in the EU/EEA, and FairSSL does not receive card data.

10. Retention

  • Server access logs: up to 24 months, for operations, security and incident investigation
  • Account and licence data: life of the account plus 12 months
  • Contact inquiries: up to 24 months
  • Website analytics: individual visits are stored in our own analytics; a click ID is used for ad measurement only within 90 days of the click

11. Your rights

Under the General Data Protection Regulation, you have the right of access, rectification, erasure, restriction, data portability, and objection, including objection to processing based on legitimate interest. Contact us at info@fairssl.dk.

You may also lodge a complaint with the Danish Data Protection Agency (Datatilsynet) if you are not satisfied with how we handle your data.

12. Changes

We update this policy when our practice changes. The last-updated date appears at the top of the page.