Privacy Policy
This policy explains what personal data DomainScan (domainscan.tech) processes, why, and what rights you have under the EU General Data Protection Regulation (GDPR, in Polish: RODO).
1. Controller
The controller of your personal data is Denis Kasperowicz, Gdynia, Poland (unregistered business activity, działalność nierejestrowana). For any privacy question or request, write to support@domainscan.tech. We have not appointed a Data Protection Officer, as we are not required to.
2. What data we process and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Email address and password (stored only as a bcrypt hash) | Creating and securing your account, logging in, sending security alerts and service messages | Art. 6(1)(b) — performance of the contract |
| Domains you add, verification tokens, scan results (findings, open ports, service versions, subdomains and their IP addresses), scan history | Providing scans, reports, monitoring and alerts | Art. 6(1)(b) |
| Plan, subscription status, Stripe customer and subscription identifiers | Managing your subscription and limits | Art. 6(1)(b); accounting records — Art. 6(1)(c), legal obligation |
| White-label brand name and colour (Agency plan) | Branding your PDF reports | Art. 6(1)(b) |
| API keys (stored only as a SHA-256 hash and a short prefix) and the time they were last used | Authenticating API access | Art. 6(1)(b) |
| Technical data in server logs: shortened IP address (the last part is removed, e.g. 95.49.255.0), browser user agent, requested URL and time | Security, abuse prevention, troubleshooting | Art. 6(1)(f) — our legitimate interest in running a secure service |
| Messages you send us (support, complaints, abuse reports) | Answering and handling them | Art. 6(1)(b) or 6(1)(f) |
We do not ask for your name, address or phone number. An email address and password are the only data needed to use the Service; without them we cannot create an account.
We do not sell personal data, do not use it for advertising, and do not use analytics or tracking tools.
3. Payment data
Payments are handled by Stripe. Card details are entered on Stripe's pages and never reach our servers. We receive from Stripe only the information needed to manage your subscription (customer and subscription identifiers, plan and payment status). Stripe acts as an independent controller for some payment data; see the Stripe Privacy Policy.
4. Cookies and local storage
We do not use cookies. After you log in, the dashboard keeps your login token and email address in your browser's local storage so that you stay signed in. This is strictly necessary for the Service and is removed when you log out. Fonts and all other page resources are served from our own server; your browser does not contact third parties when you visit our pages, except Stripe's checkout pages when you subscribe.
5. Recipients and processors
We use the following service providers, who process personal data on our behalf or as independent controllers where indicated:
| Provider | Role | Location |
|---|---|---|
| Hetzner Online GmbH (Germany) | Server hosting; all application data and databases | EU (data centre in Finland) |
| Stripe Payments Europe, Ltd. (Ireland) | Payment processing | EU; transfers to the USA under the EU–US Data Privacy Framework and Standard Contractual Clauses |
| Resend (USA) | Sending emails (alerts, service messages) | EU region (Ireland); transfers to the USA under Standard Contractual Clauses |
| OVH SAS (France) | Domain name and DNS services | EU |
We may also disclose data to public authorities when required by law, and, in the case of an abuse report, to the affected party or its hosting provider to the extent necessary to handle the report.
6. How long we keep data
- Account data and domains: for as long as your account exists. You can delete your account at any time in Plan & API → Delete account; the account and all its data are deleted immediately (copies in backups disappear within 30 days).
- Scan results: scans older than 90 days are deleted automatically; the most recent report of each domain is kept while the domain is in your account. When you delete a domain, its whole scan history is deleted with it.
- Records of payments: for the period required by Polish tax and accounting law (generally 5 years from the end of the year in which the payment was made).
- Server logs: rotated automatically and kept only as long as needed for security and troubleshooting.
- Database backups: deleted automatically after 30 days.
- Correspondence: as long as needed to handle the matter and to defend against possible claims.
7. Your rights
You have the right to access your data, to have it rectified or erased, to restrict its processing, to data portability, and to object to processing based on our legitimate interest. You can delete your account yourself in the dashboard. To exercise any other right, write to support@domainscan.tech from the email address of your account. We respond within one month.
You also have the right to lodge a complaint with the Polish supervisory authority: Prezes Urzędu Ochrony Danych Osobowych (President of the Personal Data Protection Office), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl, or with the supervisory authority of your country of residence.
8. Data about scanned systems
Scans collect technical information about the domains you verify, such as certificates, HTTP headers, open ports, service banners and subdomain IP addresses. This information describes systems, not people; where it nonetheless relates to an identifiable person, we process it only to provide the Service to the user who verified the domain, under Art. 6(1)(b) and (f).
9. Security
Connections to the Service are encrypted with TLS. Passwords and API keys are stored only as hashes. Databases are not accessible from the internet. Access to servers is restricted to the operator.
10. Automated decision-making
We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. Security grades describe scanned systems, not people.
11. Children
The Service is not intended for persons under 16, and we do not knowingly collect their data.
12. Changes
We will publish changes to this policy on this page and, if they are material, notify registered users by email.