LapseZero

Privacy Policy

Effective date: 2026-09-30 Version: 2026-09-30

1. Scope and controller

This Policy explains how Shanghai Jihuxian Technology Co., Ltd. (上海极狐线科技有限公司) ("LapseZero", "we", or "us") processes personal data when providing TLS/SSL certificate automation through lapsezero.com, cn.lapsezero.com, and related services. We are the controller or personal information processor for the processing described in this Policy.

lapsezero.com and its subdomains are also used for email, delegated DNS, and other technical infrastructure. Privacy questions and rights requests may be sent to [email protected].

2. Data we process

Depending on the features you use, we process:

  • Account data: email address, display name, password hash, email-verification status, Google or GitHub OAuth identifier, account region, and language preference.
  • Certificate and configuration data: domain names, certificates, certificate chains, certificate private keys, validation methods, DNS or cloud-provider credentials, SSH credentials, deployment targets, and automation settings.
  • Operational and security data: IP address, User-Agent, request and job logs, login and security events, issuance, deployment, monitoring, and renewal history, and error context.
  • Billing data: plan, subscription, order, amount, payment status, and customer or transaction identifiers supplied by a payment provider. Full card or payment-account details are handled by the payment provider and are not stored directly by us.
  • Support data: support-request subject, messages, status, account email, and notification metadata.
  • Website and preference data: page path, referrer, browser, operating system, device type, country or region, access time, and cookies or local-storage data used for login and language preferences.

Do not submit unrelated sensitive personal data in support requests, domain notes, or other fields where it is not needed for the Service.

We process data to:

  • create and maintain accounts, verify identity, and provide support;
  • request, validate, deploy, monitor, renew, and revoke certificates;
  • perform the DNS, cloud, and SSH operations you configure;
  • process orders, subscriptions, payments, and accounting records;
  • protect accounts, the Service, and infrastructure and prevent fraud and abuse;
  • diagnose errors, understand public-site usage, and improve the Service; and
  • comply with law, handle disputes, and protect legitimate rights.

Where GDPR or UK GDPR applies, we rely on performance of a contract, legitimate interests, legal obligations, or consent where appropriate. You may object to specific processing based on legitimate interests or withdraw consent-based processing. Withdrawal does not affect processing already performed lawfully.

4. Storage locations and international processing

LapseZero's primary database, cache, and application services are hosted in the Hong Kong Special Administrative Region. Static content, CDN, error monitoring, analytics, email, OAuth, payments, CAs, and DNS, cloud, or deployment services selected by you may process necessary data in other countries or regions.

4.1 Mainland China accounts

When you create an account through cn.lapsezero.com and use the Service, account and Service data is transferred to and processed in Hong Kong:

  • Personal information processor: Shanghai Jihuxian Technology Co., Ltd.; contact [email protected].
  • Overseas processing environment and recipients: application, database, cache, hosting, and operations environments that we control or commission in Hong Kong, together with providers processing data for the relevant functions.
  • Data categories: the account, certificate and configuration, operational and security, billing, support, and website preference data described in Section 2, depending on the features you use.
  • Purposes and methods: automated storage, retrieval, transmission, backup, and troubleshooting required for certificate management, deployment, monitoring, renewal, billing, support, and security.
  • Exercising rights: contact [email protected] to request access, correction, copying, or deletion, or to request that processing no longer necessary be stopped.

When a mainland China account is created, the system records the legal bundle and cross-border notice version then applicable. If you ask us to stop Hong Kong processing necessary to operate the Service, we may be unable to continue providing account features and may need to close the account. Providers may change as infrastructure evolves; you may contact us for current information about the main provider categories in use.

4.2 Accounts in other regions

International-site account data is also processed primarily in Hong Kong and may be transferred elsewhere through the third-party services described above. Where mandatory international-transfer requirements apply, we will take measures required by applicable law. If those requirements prevent us from providing the Service reasonably, we may limit use of a feature or region.

5. Sharing and third-party services

We do not sell personal data or use it for third-party advertising. We share data only as necessary to provide the Service, perform operations you authorize, comply with law, or protect legitimate rights, including with:

  • Certificate Authorities: domain names, necessary account information, and validation responses are sent to CAs currently supported by the product (currently including Let's Encrypt). Domain and certificate information is published in Certificate Transparency logs.
  • External systems you select: DNS, cloud, and SSH credentials are used to perform validation and deployment you configure.
  • Infrastructure and CDN providers: hosting, database, cache, network, and static-content delivery services in Hong Kong and globally.
  • Error monitoring: scrubbed error events and necessary context used for diagnostics and security analysis.
  • Site analytics: Umami Cloud processes public marketing-page statistics. We retain utm_* campaign parameters, remove other query parameters and URL hashes, and respect browser Do Not Track settings.
  • Identity providers: Google or GitHub processes OAuth requests, identifiers, and email when you choose that login method.
  • Payment providers: Stripe for the international site; Alipay, WeChat Pay, bank transfer, or another method shown at checkout for the mainland China site.
  • Email and support providers: email address and message content required for verification, alerts, and support notifications.
  • Legal and security recipients: information required by valid law, court or regulatory order, or reasonably necessary to investigate fraud, abuse, or a security event.

6. Security

We use technical and organizational measures appropriate to the risks of the Service. Sensitive DNS, cloud, and SSH credentials and certificate private keys are encrypted with AES-256-GCM before persistent storage; passwords are stored as non-reversible hashes; and known tokens, credentials, and sensitive parameters are scrubbed from error reporting.

No internet transmission or software system can be absolutely secure. You should use a strong password, protect third-party accounts, minimize credential permissions, and promptly revoke credentials that are no longer needed or may have been compromised.

7. Retention

We retain data only as long as necessary to provide the Service, meet security needs, handle disputes, and comply with law:

  • Account and configuration data is retained while the account is active. A verified closure request is normally completed through deletion or anonymization within 30 days, except for statutory records, dispute evidence, and security data.
  • Certificates, private keys, and deployment settings are retained while the related resource exists. Residual copies are removed through backup rotation after a resource or account is deleted.
  • General request and job logs are normally retained for no more than 30 days. Security-event, abuse-investigation, and audit records may be retained longer where necessary.
  • Encrypted backups currently rotate on a 30-day schedule. Temporary copies created for recovery are removed after the recovery purpose is complete.
  • Order, payment, tax, and accounting records are retained as required by applicable law.
  • Certificate Transparency records are published by CAs or log operators and cannot be deleted by us.

8. Your rights

Subject to applicable law, you may request to:

  • access, copy, or export personal data about you;
  • correct inaccurate or incomplete data;
  • delete an account or data no longer necessary;
  • restrict or object to specific processing;
  • withdraw consent-based processing; or
  • lodge a complaint with a competent authority.

Contact [email protected] from your registered email address. We may require reasonable identity verification and will respond within the time required by applicable law. Some requests may be limited by legal obligations, security, the rights of others, or dispute-handling needs.

9. Cookies, local storage, and analytics

We use essential cookies and local storage for login state, language preference, and security information. Public marketing pages use cookie-free Umami Cloud analytics. We do not currently use advertising trackers. If we later introduce non-essential cookies or marketing tools that legally require consent, we will provide the required choice before enabling them.

10. Automated processing

LapseZero automates certificate issuance, deployment, monitoring, and renewal based on your configuration. These processes execute technical tasks you authorize and are not used to make credit, employment, insurance, or similar decisions about individuals with significant legal effects.

11. Children

The Service is not directed to children under 14 or a higher minimum age required in their jurisdiction. If we discover such data, we will take reasonable steps to delete it and close the account.

12. Policy updates

We may update this Policy to reflect changes in features, providers, law, or operations. We will provide notice of material changes through the Service, email, or another reasonable channel and obtain renewed confirmation where required by law. The version and effective date identify the current text.

13. Contact

  • Privacy and legal: [email protected]
  • General support: [email protected]
  • Operating entity: Shanghai Jihuxian Technology Co., Ltd. (上海极狐线科技有限公司), Jinshan District, Shanghai, China
  • Mainland China ICP filing: 沪ICP备2026018290号-3