🔒 Privacy Policy

Who We Are

ThreatListPro is operated by CalMax Systems, California, United States. Questions about this policy: [email protected].

What We Collect and Why

• Subscription record. When you start a trial or subscribe, we store your email address, the name you give at checkout (if any), your plan, your Stripe customer and subscription IDs, trial dates, account status and your API key. We use this to deliver the blocklist to your firewall, keep your access in step with your subscription, and contact you about your account.
• Payment details. Payments are handled by Stripe. Stripe shares your email, name and subscription details with us; we never see or store your full card number. Checkout and the billing portal at /billing are hosted by Stripe.
• Service emails. We send your welcome email (with your API key) and, for a trial without a card, one reminder before the trial ends. These are sent through our email provider, SMTP2GO, which processes your email address to deliver them. We do not send marketing newsletters from your account data.
• Request logs. When your firewall or browser contacts our API, Cloudflare (our hosting provider) records standard request data such as the IP address, time, requested path (which for blocklist downloads includes your API key), user agent and approximate location. Our application logs can also include your email address when your account changes. We use these logs to run, secure and troubleshoot the service and keep them for about 7 days; Cloudflare keeps its own network security logs under its own policy.
• Rate limiting. The free IP checker counts requests per IP address for 60 seconds to prevent abuse. The counter then expires.
• Website analytics. We use Cloudflare Web Analytics, which counts page views without cookies and without building visitor profiles.
• Support emails. If you email us, we keep the conversation so we can help you.

Third-Party Services on Our Pages

Some pages load content from other services, which receive your IP address and browser details when they load and may set their own cookies under their own privacy policies:

• Stripe (js.stripe.com) on pages with checkout buttons, for payments and fraud prevention.
• Google Fonts (fonts.googleapis.com) for the site's typefaces.
• Tailwind CSS (cdn.tailwindcss.com) for the styling of our 404 page.
• Vimeo for embedded tutorial videos, on the pages that show them (loaded with Vimeo's do-not-track setting).
• Cloudflare, which hosts the site and API.

We do not use advertising networks, social media tracking pixels, session recording or heatmap tools.

How We Share Data

We share personal data only with the providers above, and only to run the service: Stripe (payments), SMTP2GO (service emails), Cloudflare (hosting, logs and analytics) and Microsoft 365 (our support mailbox). We do not sell or rent personal information, and we do not share it for advertising.

Data Retention

• Subscription records are kept while your account exists and for up to 7 years after it ends, for billing, tax and abuse-prevention purposes. Ask us and we will delete your record sooner, unless we must keep it by law.
• Payment records are kept by Stripe under its own retention policy and applicable tax law.
• Request logs are kept for about 7 days. Rate-limit counters expire after 60 seconds.
• Support emails are kept for up to 2 years after the conversation ends.

Your Rights

You can ask us to access, correct, delete or export the personal data we hold about you, or object to how we use it. Email [email protected] and we will respond within 30 days. To manage or cancel your subscription, use threatlistpro.com/billing.

EU and UK residents (GDPR): we process your subscription data to perform our contract with you (Article 6(1)(b)) and request logs for our legitimate interest in running and securing the service (Article 6(1)(f)). Data is processed in the United States; our providers rely on Standard Contractual Clauses or the EU-US Data Privacy Framework for international transfers. You may also complain to your local data protection authority.

California residents (CCPA/CPRA): in the past 12 months we collected identifiers (email address, name, IP address), commercial information (subscription details) and internet activity (request logs), for the purposes above. We do not sell or share personal information for cross-context behavioral advertising, and we will not discriminate against you for exercising your rights.

Security

Data is stored on Cloudflare's infrastructure and sent over HTTPS. Your API key works like a password: keep it private, and contact us if you need a new one.

Children

ThreatListPro is a business service and is not directed at children under 13. We do not knowingly collect their personal information.

Changes to This Policy

If we make material changes, we will update this page and notify subscribers by email.