Last updated June 16, 2026
This Privacy Policy explains how Trovaru ("Trovaru", "we", "us", "our") collects, uses, shares, and protects your information when you use the Trovaru domain and SSL operations platform at trovaru.com (the "Service"). It also describes your rights and choices. By using the Service you agree to the practices described here. This Policy should be read together with our Terms of Service.
For most personal information, Trovaru is the data controller. For Customer Data you load into your workspaces (such as the domains, certificates, and records you monitor), Trovaru generally acts as a processor on your behalf, processing it under your instructions to provide the Service.
We collect only what we need to operate the Service:
We collect information directly from you (when you register, configure workspaces, or connect Credentials), automatically (through your use of the Service), and from third parties you authorise — including Google (sign-in), Paddle (billing status), and the registrars, DNS resolvers, certificate authorities, blocklist operators, and reputation providers we query on your behalf.
We do not sell your personal information, and we do not use your workspace data to train third-party AI models.
Where the GDPR or similar laws apply, we rely on the following legal bases: performance of a contract (to provide the Service you sign up for), legitimate interests (to secure, maintain, and improve the Service, and to prevent abuse), consent (where required, such as for optional integrations you choose to connect), and legal obligation (to comply with tax, accounting, and other laws). You may withdraw consent at any time where processing is based on consent.
We use only strictly necessary cookies and local storage required to authenticate you, maintain your session, and keep the Service secure. We do not use advertising or cross-site tracking cookies, and we do not run third-party ad networks. Because these cookies are essential to the Service, they cannot be disabled without breaking sign-in.
We share data only with service providers ("sub-processors") that help us operate the Service, each bound to protect it and to process it only on our instructions:
We may also disclose information if required by law, regulation, legal process, or governmental request, or to protect the rights, property, safety, and security of Trovaru, our users, or the public. If Trovaru is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction, subject to this Policy.
When you connect a third-party service — a registrar, notification channel, or PSA platform — you direct us to exchange data with that service to provide the feature. Those services process data under their own privacy policies, over which we have no control. Disconnecting an integration stops future data exchange but does not retrieve data already sent.
Trovaru operates from Nepal and uses providers that may store or process data in other countries, including outside your own. Where required by law, we rely on appropriate safeguards — such as standard contractual clauses or equivalent mechanisms — for international transfers of personal data.
We keep personal data and Customer Data for as long as your Account is active and as needed to provide the Service:
When you delete your Account, we remove your personal data and workspace contents within 30 days, except where we must retain certain records to meet legal, tax, or accounting obligations. Connected Credentials are deleted when you disconnect them or delete your Account.
We take the security of your data seriously. Registrar, provider, and integration Credentials are encrypted at rest using per-purpose encryption keys. We use TLS to protect data in transit, scoped access controls to isolate data between workspaces and accounts, and regular automated security checks (including static analysis with Brakeman and dependency and importmap vulnerability scans). No system is perfectly secure, but we work hard to protect your data and will notify you and any relevant authority of a breach affecting your personal data as required by law.
You can access, correct, export, or delete much of your personal data directly from your account settings, or by contacting us. Depending on your location, you may have additional rights under the GDPR, UK GDPR, the CCPA/CPRA, or similar laws, including the rights to:
We do not sell or share personal information for cross-context behavioural advertising, so there is nothing to opt out of in that respect. We will respond to verified rights requests within the time required by applicable law and will not discriminate against you for exercising your rights.
We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing.
The Service is not directed to anyone under 16, and we do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will delete it.
Because we do not track users across third-party sites for advertising, we do not respond to browser "Do Not Track" signals differently; our processing is limited to operating the Service as described here.
We may update this Policy from time to time. Material changes will be announced on this page with a new "last updated" date and, where appropriate, by email. Your continued use of the Service after changes take effect means you accept the updated Policy.
Questions about this Policy or your data, or to exercise your rights? Email [email protected]. For general support, email [email protected].