Privacy policy

Version 2026-09-05

This policy explains how Cryodev AB processes personal data when you use sslsnitch.com. If you do not agree with it, please stop using the service.

Data controller

Cryodev AB, Sweden, is the controller for personal data processed on sslsnitch.com. For any privacy question or to exercise your rights, contact privacy [at] cryodev [dot] se .

What data we collect

• Account data: name, email address, hashed password, two-factor settings and passkey public keys.
• Billing data: access passes, amounts, currency and Stripe identifiers. Card details are handled by Stripe and never reach our servers.
• Technical data: IP address and browser user agent in server logs and active sessions.

How we collect your data

You provide most of this data directly when you register, buy an access pass or contact us. We also receive limited data indirectly from our payment provider (Stripe) when it processes a payment and screens it for fraud.

How we use your data

• To create and manage your account and give you access to the search service.
• To process payments for access passes.
• To email you important information about your account and access (see communications below).
• To keep the service secure and prevent abuse.

Legal bases: performance of our contract with you (account and billing), our legitimate interest in keeping the service secure, and legal obligations (bookkeeping).

Data we collect from the Internet

The scanner collects TLS certificates and the IP addresses, ports and timestamps at which they were observed. Certificates are public by design and are presented to any client that connects. An IP address can in some cases be personal data. We process this data on the basis of our legitimate interest in security research and defensive security, and we offer an opt-out for network owners.

How we store your data

Your data is stored on servers within the EU. Passwords are stored only as a hash that cannot be reversed. We never store card or other payment instrument details; those are handled entirely by Stripe.

Retention

Account data is kept while your account exists and is removed when you delete your account. Bookkeeping records are kept for seven years as required by Swedish law, in anonymised form after account deletion. Certificate scan data is kept indefinitely as part of the service, subject to the scanner opt-out above.

Communications and marketing

We only email you about your account and the service, such as email verification, password resets, receipts, data you request and access-pass expiry reminders. We do not send marketing email. You can turn off optional emails, including reminders, or unsubscribe from all non-essential email, in your account settings; essential account emails are always sent.

Sharing your data

We do not sell your data or share it with third parties except the processors below and where required by law.

Processors

• Stripe, for payment processing.
• Google (reCAPTCHA), to protect the registration form against automated abuse. When you open the registration page, Google receives your IP address, browser information and interaction data to judge whether the request is automated. Google's privacy policy and terms of service apply.
• Our hosting provider, for servers located in the EU.

Cookies

We use a session cookie that keeps you signed in and protects against cross-site request forgery (CSRF), and we store your light or dark theme preference in your browser's local storage. We use no tracking, analytics or advertising cookies, so no cookie consent banner is needed. You can block cookies in your browser, but login will not work without the session cookie.

Your data protection rights

Under the GDPR you have the right to:

• Access the personal data we hold about you.
• Rectify data you believe is inaccurate or incomplete.
• Erase your personal data, under certain conditions.
• Restrict our processing of your data, under certain conditions.
• Object to our processing of your data, under certain conditions.
• Data portability: receive your data in a portable format or have it transferred.

You can exercise the main rights yourself at any time: export all data we hold about your account, and delete your account, from your account settings. For anything else, email privacy [at] cryodev [dot] se . We will respond within one month.

Complaints

If you believe we have not handled your data properly, you can lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY):

• Phone: +46 (0)8 657 61 00
• Website: https://imy.se/

Other websites

Our site may link to other websites. This policy applies only to sslsnitch.com, so please read the privacy policy of any site you visit through a link here.

Changes to this policy

We keep this policy under review and publish any updates on this page, with the date at the top. Material changes are announced by email or on the site before they take effect.