Privacy Policy

NOTED

FIRST SEEN 2026-09-05 · VERSION 20260905_rev01 · COMPARED WITH 20260811_rev01

What changed, in plain language

The only change is a section title: "Law Enforcement and Extenuating Circumstances" is now "Law Enforcement Requests and Extenuating Circumstances." Nothing about what Let's Encrypt collects, keeps, or shares changed.

This change appears to be cosmetic (formatting, typos, or contact details).

Changelog

± CHANGEDSection name reworded
A cross-reference in the Subscriber section now points to "Law Enforcement Requests and Extenuating Circumstances" instead of "Law Enforcement and Extenuating Circumstances." The word "Requests" was added to match the heading used later in the policy. The rules themselves are the same.
it will only be shared per "Law Enforcement and Extenuating Circumstances," below
it will only be shared per "Law Enforcement Requests and Extenuating Circumstances," below

Full text changes — 20260811_rev01 to 20260905_rev01

COLOUR MARKS THE SEVERITY OF A FLAGGED CLAUSE · + AND − MARK ADDED AND REMOVED

13	13	## Subscriber
14	14
15	15	If you are a Subscriber, you are requesting a trusted certificate from Let's Encrypt intended to publicly vouch that you control a certain domain name or names that are reachable on the Internet. As part of the process of proving that control, Let's Encrypt will collect various information related to certificate authentication and management. That information includes the IP addresses from which you access the Let's Encrypt service; all resolved IP addresses for any requested identifiers; server information related to any validation requests; full logs of all inbound HTTP / ACME requests, all outbound validation requests; and information sent by or inferred from your client software. We will store this information for a minimum of two years per trusted root program requirements.
16	16
17	17	We need to be able to demonstrate to the public, including those who rely on the trustworthiness of our certificates, that our services perform as expected. As a result, we may be unable to delete information, including IP addresses. This information may be made public in a number of ways, including via public API, public repositories such as Certificate Transparency (CT) logs, and/or public discussions.
18	18
19		You may have the option to provide contact information, such as your email address, for account service and recovery purposes. Your contact information will not be made public, and it will only be shared per "Law Enforcement and Extenuating Circumstances," below. By providing your email address, you are consenting to receive service-related emails from us. You may unsubscribe from service-related emails at any time by clicking the "unsubscribe" link at the bottom of our emails or by contacting us at [privacy@abetterinternet.org](mailto:privacy@abetterinternet.org). We will not use your contact information for marketing or promotional purposes without your consent.
	19	You may have the option to provide contact information, such as your email address, for account service and recovery purposes. Your contact information will not be made public, and it will only be shared per "Law Enforcement Requests and Extenuating Circumstances," below. By providing your email address, you are consenting to receive service-related emails from us. You may unsubscribe from service-related emails at any time by clicking the "unsubscribe" link at the bottom of our emails or by contacting us at [privacy@abetterinternet.org](mailto:privacy@abetterinternet.org). We will not use your contact information for marketing or promotional purposes without your consent.
20	20
21	21	You may need to download client software from a repository such as those run by Debian, Ubuntu, Red Hat, or GitHub. Your interaction with such a software repository is governed by that repository's own privacy policy and/or Terms of Use.
22	22
23	23	## Visitor
24	24
25	25	When you are a Visitor browsing an ISRG web site, you have the option to make a donation. Donations are processed by our trusted payment partners including DonorBox, The Giving Block, Stripe, Shopify, and PayPal, depending on the payment method selected, and stored in ISRG's Salesforce database and Sage Intacct as necessary. We collect your name, mailing address, and email address when you donate. Depending on your gift, we may also collect merchandise preferences (such as t-shirt size) to fulfill donor benefits. Once you donate, we will use your information for our legitimate interest in processing and managing your contribution, including fundraising reminders and renewals or mailing a thank-you gift. We may also use your mailing address to identify and consolidate duplicate donor records in order to maintain the accuracy of our donor database. Your interactions with [DonorBox](https://donorbox.org/privacy), [Stripe](https://stripe.com/privacy/), [PayPal](https://www.paypal.com/us/webapps/mpp/ua/privacy-full), [Shopify](https://www.shopify.com/legal/privacy), [The Giving Block](https://thegivingblock.com/about/privacy-policy/), [Salesforce](https://www.salesforce.com/company/privacy/), [Monday Merch](https://www.mondaymerch.com/us/legal/privacy-policy), [Formstack](https://www.formstack.com/legal), [BoldSign](https://boldsign.com/privacy-policy/), and [Sage Intacct](https://www.sageintacct.com/privacy_policy_website) are governed by their respective privacy policies. We do not collect or retain any credit card or bank information related to donations.