Privacy statement

1.Who processes your data

The controller, in the sense of the GDPR, is:

• [nog in te vullen]
• [nog in te vullen]
• Chamber of Commerce number: [nog in te vullen]
• VAT identification number: [nog in te vullen]
• Email for privacy matters: [nog in te vullen]

We have not appointed a data protection officer; for an organisation of this size and this kind of processing, that is not required. Questions about this statement can go straight to the address above.

2.What we process

Your account. Your email address, optionally your name, an encrypted representation of your password (never a readable one), your language preference, and whether your address has been confirmed.

Signing in through someone else. If you sign in with Google, GitHub or Microsoft, we store which one it was and the account id they hand back. We never receive a password.

Your organisation. Its name, the plan it is on, the roles of its members, and invitations you send (the invited address).

Payment data. Payments run through Stripe. We store no card details ourselves; only the customer reference Stripe gives us, so a subscription stays attached to the right organisation.

Use of the service. The domains you monitor, earlier versions of your SPF records, the records we publish for you, your API keys (stored encrypted), and a log of administrative actions: who changed what, and when.

Public scans. When someone runs a domain through the public checks, we keep the domain, when it was first and last looked at, and how often. Deliberately not: who ran the scan. That link does not exist in our database.

Technical data. Your IP address is used to limit abuse of the public scans. That happens in the server's memory only and is gone within minutes; it is never written to the database.

3.Why, and on what legal basis

To provide the service. Creating an account, monitoring domains, publishing records and signing you in. Basis: performance of our contract with you (Article 6(1)(b) GDPR).

To bill you. Subscriptions, payments and invoices. Basis: performance of the contract, and for keeping invoices a legal obligation (Article 6(1)(c) GDPR).

To reach you about the service. Confirmation mail, password resets, and alerts about the domains you monitor. Basis: performance of the contract.

To keep the service secure. Limiting abuse of the public scans, and the administrative log that makes a change traceable to whoever made it. Basis: our legitimate interest in a safe, working service (Article 6(1)(f) GDPR).

We do not use your data for advertising, do not sell it, and do not profile you.

4.Cookies

SPF Pletter sets one cookie, and only once you have signed in. It holds your session, cannot be read by scripts in the browser (HttpOnly), travels only over a secure connection, and is not sent to other sites (SameSite=Lax).

There is no analytics, no tracking pixel, no advertising network and no third-party script watching what you do. That is also why you see no cookie banner: a cookie strictly necessary to deliver a service you asked for does not require consent.

5.How long we keep things

Your account and everything attached to it is kept while you use it. Ask us to delete it and we remove your account, your domains, your stored records and your API keys straight away.

Two exceptions, and why:

• Invoices and payment records are kept for seven years. That is not a choice: Dutch tax law (Article 52 AWR) requires it.
• The administrative log survives, but we detach it from you: the record of who did something is made untraceable. The log needs to show that a change happened; who made it does not have to be kept afterwards.

Public scan data contains no personal data: it holds a domain name and nothing about who looked at it. Answers from DNS are cached for at most an hour.

6.Who else sees your data

We involve as few other parties as possible. These are they, and this is what they do:

• Hetzner Online GmbH (Germany) — our servers and database run there. Data stays inside the European Union.
• Stripe Payments Europe Ltd (Ireland) — processes payments and holds the card details we deliberately do not want.
• Google, GitHub or Microsoft — only if you choose to sign in with them. They then know you sign in here; choose a password instead and there is no contact with them at all.

Our email is sent by our own mail server, so there is no third-party mail provider between you and a confirmation message.

Beyond that we disclose data only where the law requires it, for instance on a valid order from a competent authority.

7.Transfers outside the European Economic Area

Our own processing happens entirely within the EU. The one structural exception is Stripe: our contracting party is Stripe Payments Europe Ltd in Ireland, but within the Stripe group data may reach the United States.

That transfer is covered by the European Commission's Standard Contractual Clauses, together with the measures Stripe applies alongside them. If you would like to see the detail, ask at [nog in te vullen].

8.How we protect it

Concretely, so you can judge whether it is enough:

• All traffic runs over HTTPS; unencrypted traffic is refused.
• Passwords are stored only as a one-way hash. We cannot read them back, even if we wanted to.
• API keys are stored the same way: you see a key once, when you create it.
• The session cookie cannot be read by scripts and is not sent to other sites.
• Administrative actions are written to a log that cannot be written over.
• The public scans are rate-limited per IP address, so they cannot be turned into a weapon against somebody else.

If something goes wrong with your personal data anyway and it is likely to be a risk to you, we report it to the Dutch Data Protection Authority and, where the GDPR requires it, to you directly.

9.Your rights

Under the GDPR you have the following rights, and you can exercise any of them at [nog in te vullen]:

• Access: a copy of the personal data we hold about you.
• Rectification: have incorrect data corrected.
• Erasure: have your data deleted, except where we are legally required to keep it.
• Restriction: have the use of your data paused, for instance while a correction is being made.
• Objection: object to processing based on our legitimate interest.
• Portability: receive your data in a common file format.

We respond within a month. To avoid handing data to the wrong person we may ask you to confirm you are who you say you are; we keep that as light as we can.

If you disagree with how we handle your data you can complain to the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). We would appreciate the chance to sort it out first.

10.Automated decision-making

We take no decisions about you based solely on automated processing that produce legal effects for you.

The score a scan gives a domain is a judgement about that domain — about DNS records that are public — not about a person.

11.Changes to this statement

When the service changes, this statement changes with it. The date at the top says when that last happened.

For a change that actually matters to you — a new purpose, a new party seeing your data — we tell you by email rather than quietly editing this page.

12.Contact

Questions, requests or complaints about your personal data: [nog in te vullen].

Anything else about the service: [nog in te vullen].