Data practices · provenance · opt-out
Public infrastructure facts. No people, ever.
This page is a procurement asset, not a legal chore. Read it before you ask — the answer to “do you have contact data?” is here, and it is no.
Where the data comes from
Three public sources only: gTLD zone files (via authorised registry access), Certificate Transparency logs (public by design), and DNS records (publicly resolvable). We do not buy data, scrape private surfaces, or ingest anything behind authentication.
No personally identifiable information. Permanently.
We record domains, records and providers — never named individuals, mailboxes tied to a person, phone numbers, or anything that identifies a human. At most we surface role accounts (e.g. hostmaster@), and only where a product explicitly ships it. This is a deliberate design choice that keeps the entire compliance apparatus of PII data out of the business — and it is not negotiable, including for agencies who ask.
Retention
We keep the history of infrastructure facts — that history is the product. We do not retain anything about people because we never collect it. Customer account data (billing, auth) is kept only as long as the account is active plus the statutory minimum.
Opt-out
Zone and certificate data are public records we do not originate. If you operate a domain and want it excluded from FirstSeen's commercial products, email optout@firstseen.io from an address at that domain and we will suppress it from paid outputs. We cannot remove a domain from the public CT logs or zone files themselves — nobody can.
Crawler identity
Where we resolve DNS or fetch a well-known policy file, we identify ourselves honestly. See /bot for our user-agent, IP ranges and the records we request.
Nederlands — kort
FirstSeen verwerkt uitsluitend openbare infrastructuurgegevens (zonebestanden, Certificate Transparency, DNS). Wij verzamelen geen persoonsgegevens. Uitsluiten van een domein? Mail optout@firstseen.io vanaf een adres op dat domein. Zie /bot voor onze crawler-identiteit.