We collect as little as possible. This page describes what is actually stored and why.
Suliman Othman, [email protected], is responsible for the processing of personal data described here.
We have no visitor statistics, no analytics tools and no third-party scripts that follow you. The fonts are served from our own server, and the page loads nothing from other websites. That is why there is no cookie banner.
If you use sign-in, the account forms or your account, a single cookie is set, dfx_session. It protects the forms against forged requests and keeps you signed in. Because it is necessary for the service you are using, no consent is needed.
The cookie is signed so it cannot be altered, but it is not encrypted. When you are signed in it holds an internal id for your account and when you were last active. If a form has to be shown again after an error, what you typed is kept in the cookie for a moment, never your password.
The cookie cannot be read by scripts on the page and is only sent over an encrypted connection. It disappears when you close the browser, and you are signed out after 30 minutes without activity.
Domain names you search are kept in a technical cache for up to seven days. The purpose is to avoid loading the domain registry with the same question repeatedly. The cache is not linked to you.
Your IP address is processed temporarily to count the number of checks per visitor. This is necessary to prevent misuse of the service and relies on legitimate interest under Article 6(1)(f) GDPR. The data sits in memory and is kept no longer than an hour.
The server logs contain the time, which page was requested and the response code, but no IP addresses and nothing you search for or type in. They are used for operations and troubleshooting and are overwritten continuously.
If you email us, your address and the content of the message are kept as long as needed to handle the matter.
When you check an IP address against blacklists, the address is sent as DNS queries to the lists shown, via Cloudflare's DNS. The result is kept in memory for up to 30 minutes so the same check isn't repeated needlessly. It is not linked to you.
A DMARC report you upload is read in memory only, to show the result. The file is not stored, not written to disk and not logged. To show which services sent the email, we look up the sending servers' IP addresses in DNS.
DMARC reports contain details about email servers, such as IP addresses and message counts, but normally no personal data about individuals.
When you check why email isn't arriving, only the domain after @ in the address is used, for DNS lookups via Cloudflare's DNS. The part before @ is only checked for spelling in memory and is never stored or logged. If you enter a sender, only its domain is used too. We send no email and contact no mail servers. If the domain has an MTA-STS policy, it is fetched from the domain's own website. The result for the domain is kept in memory for up to ten minutes and is not linked to you.
If you create an account we store your email address, your name, the company name and organisation number, and a phone number if you choose to give one. We also store which domains you have added for monitoring. Everything except the phone number is required to create an account.
If you do not confirm your email address, the details from the sign-up are deleted automatically after a day.
Your password is never stored in clear text, only as a cryptographic hash that cannot be reversed. Login links sent by email are stored the same way, work for 15 minutes and can only be used once.
The legal basis is performance of the contract to deliver the service, Article 6(1)(b) GDPR. The data is used for your account, for alerts about your domains and to contact you about the service. We send no newsletters and do not share the data for marketing.
The data is kept as long as the account exists. You can cancel the account yourself at any time. It is then deleted 30 days later, and you can change your mind until then. If you want it deleted right away, email us. Records required by Swedish accounting law are kept for seven years.
Each time you log in we store the time, IP address and login method. We do this to detect and investigate unauthorised logins and misuse of the service, which is a legitimate interest under Article 6(1)(f) GDPR. The login history is kept for 12 months from each login, also if the account is deleted in the meantime.
If a wrong password is entered for an email address, we store the address and the time, so that password sign-in can be blocked after repeated attempts. This is a legitimate interest under Article 6(1)(f) GDPR. Failed attempts are deleted after a day. Temporary blocks lift by themselves. A permanent block on an account stays until you sign in with a link from your email, and blocks on addresses without an account are deleted after a day.
When an account is deleted we keep a short summary for 12 months: customer number, company name, organisation number, name, email address and the dates the account was created and deleted. It is needed to answer questions about the account afterwards, for example in case of suspected misuse, which is a legitimate interest under Article 6(1)(f) GDPR. Then it is deleted.
We only disclose data to authorities when we are required to by law.
The server holding the service database is with a Swedish provider in Sweden.
Email from the service, such as login links and alerts about your domains, is sent by Brevo, a French company that processes the data within the EU.
Our mail service is run by Zoho in their European data centre.
The website is protected by Cloudflare, which processes traffic across its global network. Cloudflare is a US company, so data such as your IP address may be processed outside the EU and EEA. The transfer is protected by the EU-U.S. Data Privacy Framework, which Cloudflare is certified under, and by the European Commission's standard contractual clauses.
We do not sell data on and do not share it with anyone beyond the providers needed to run the service.
You have the right to request a copy, correction or deletion of the data we hold about you. You can also ask for the processing to be restricted, and receive data you have provided yourself in a machine-readable format (data portability).
You have the right to object to processing based on legitimate interest. Email us and we will handle it within one month.
If you are not satisfied you can contact the Swedish Authority for Privacy Protection, imy.se.