Last updated 6 October 2026

Privacy policy

ZoneOwl watches the SSL certificates, renewals, DNS and lookalike domains of the websites your agency looks after. It's run by one person, me, from the United Kingdom. That makes me the data controller for your account. This page explains what I keep, why, and how to get it removed.

Short version: I only collect what the product needs to work. I don't sell data, I don't run ads, and there are no tracking or analytics scripts in the app.

What I collect

Your account. Your email address and, if you sign in with Google, the name and profile picture Google shares. If you use a password, it's stored as a hash by Supabase, my login provider. I never see it.
Your workspace. Agency name, logo, brand colour, email sender name, timezone, and the people you invite to your team.
Your clients. Client names, the contact email you give for each one, and the day their monthly report goes out.
Domains and results. The domains you add and what each check finds: certificate details, registration dates, DNS records, email security settings and lookalike domains.
Alert settings. Where alerts go: email addresses, and Slack, Microsoft Teams or webhook URLs, including any signing secret you set.
Billing. Payments are handled by Stripe. I keep your plan, your Stripe customer and subscription IDs, and your invoice history. Your card details go straight to Stripe and never touch ZoneOwl.
The free check. If you use the free domain check without an account, I store the domain, the result and a one-way hash of your IP address. The hash only exists to stop people hammering the check.

What the checks look at

Every check uses public information: DNS records, SSL certificates, public registration data (RDAP) and certificate transparency logs. To judge whether a lookalike domain is a real threat, ZoneOwl may also load that lookalike's homepage and compare it with your client's site. It never logs in anywhere and never touches anything that isn't public.

Why I use it

To run the service you signed up for: checks, alerts, reports and billing. This is needed to perform our contract.
To keep ZoneOwl secure, stop abuse and fix things that break. This is my legitimate interest in running a service that works.
To keep invoices and tax records, because the law requires it.
To email you about your account: alerts, reports, team invites and changes to these terms. I don't send marketing email unless you ask for it.

Your clients' details

When you add a client's contact email so their reports can reach them, you decide what goes in and why. For that information you're the controller and I process it for you, only to send the reports and alerts you set up. Please make sure your clients are happy to receive them.

Who else handles it

ZoneOwl runs on a small set of services. Each one only gets what it needs to do its job:

Supabase stores the database and handles sign-in.
Vercel hosts the website and runs the app.
Stripe takes payments and manages subscriptions.
Resend delivers alert and report emails.
Google handles sign-in, if you choose "Continue with Google".
Slack, Microsoft Teams or your own webhook receive alerts, but only if you connect them.

Some of these companies process data outside the UK, including in the United States and the EU. Where they do, I rely on the transfer safeguards in their data processing terms, such as the UK International Data Transfer Addendum.

Cookies and browser storage

The only cookies ZoneOwl sets are the ones that keep you signed in. The app also saves a few things in your browser so it feels quicker: your light or dark theme, whether the sidebar is collapsed, which lookalikes you've already seen, and a short-lived copy of your dashboard data. None of it is used for tracking, and clearing your browser data removes it.

How long I keep it

Account and workspace data stays while your account is open.
Check history is trimmed as it goes. ZoneOwl keeps the latest 30 results of each check type for each domain.
When you delete a workspace in Settings, its domains, clients, results, alerts and settings are deleted with it. To close your login too, email me and I'll remove it.
Invoices are kept for six years, because UK tax rules require it.
Backups and provider logs roll off on their own schedule, usually within a few weeks.

Your rights

You can ask me for a copy of your data, ask me to correct or delete it, ask me to stop or limit using it, or ask for it in a format you can take elsewhere. Email privacy@zoneowl.com and I'll reply within a month, usually much sooner. If you're unhappy with how I've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk. I'd appreciate the chance to put it right first.

Security

Everything travels over HTTPS. Database access is locked down so each workspace only sees its own data. Webhook alerts can be signed so your server can check they really came from ZoneOwl. No system is perfect, though. If something goes wrong that affects your data, I'll tell you quickly and say what I'm doing about it.

Children

ZoneOwl is a tool for businesses and isn't meant for anyone under 18.

Changes

If I change this policy in a way that matters, I'll email account owners before it takes effect. The date at the top shows the latest version. You can also read the terms of service.

Contact

Questions about privacy or your data: privacy@zoneowl.com.