Privacy policy
Last updated: [TO BE COMPLETED]
Spamr follows a data minimisation principle: only the data needed for the service is collected, and it is deleted automatically after the periods below.
Data controller
- Controller
- [TO BE COMPLETED: company name and address]
- Data protection officer
- [TO BE COMPLETED: name or department, and contact details]
Processing, purposes and legal bases
Scanning a domain
- Data
- Domain name entered; public DNS and RDAP results for the variations checked.
- Purpose
- Producing the scan report.
- Legal basis
- Legitimate interest.
- Retention
- 30 days if domain ownership is not verified; 12 months after verification.
Abuse prevention
- Data
- IP address, processed in memory to limit the number of requests and never stored in the database; anti-bot token (Cloudflare Turnstile).
- Purpose
- Preventing automated or abusive use of the service.
- Legal basis
- Legitimate interest.
- Retention
- For the rate-limiting window, a few hours at most.
Domain ownership verification
- Data
- E-mail address, domain, date, summary counts of the report.
- Purpose
- Proving domain ownership, giving access to the full report, contacting you about this report.
- Legal basis
- Steps taken at your request before entering into a contract.
- Retention
- 3 years from verification.
Waitlist
- Data
- E-mail address; chosen plan and domain if provided.
- Purpose
- Telling you when continuous monitoring opens.
- Legal basis
- Consent, given when you sign up.
- Retention
- 3 years from your latest sign-up.
News about Spamr (optional box)
- Data
- E-mail address.
- Purpose
- Sending you news about the service.
- Legal basis
- Consent.
- Retention
- Until you withdraw your consent.
AI-written summary
- Data
- Scanned domain and aggregated scan results. No e-mail or IP address is sent.
- Purpose
- Writing a plain-language risk summary.
- Legal basis
- Legitimate interest.
- Retention
- The summary is kept with the report; retention by the provider: [TO BE COMPLETED according to the contract].
Recipients and processors
Your data is never sold. It is processed by the following providers on Spamr's behalf:
- Website hosting: [TO BE COMPLETED: provider and location]
- API and database hosting: [TO BE COMPLETED: provider and location]
- Anti-bot check: Cloudflare (Turnstile)
- Verification e-mails: Resend
- Summary writing: Anthropic (Claude model)
Transfers outside the European Union and applicable safeguards: [TO BE COMPLETED: to be specified for each provider]
Cookies and local storage
Spamr uses no advertising cookies and no audience measurement. A preference cookie remembers the language you choose. After ownership verification, an access token for the report is kept in your browser's local storage; you can remove it at any time by clearing the site's data. Cookies possibly set by the anti-bot check: [TO BE COMPLETED: to be checked]
Security
- Encrypted connections (HTTPS) between your browser, the site and the API.
- Verification links and access tokens are only stored as hashes.
- Spamr's application logs contain no e-mail address, IP address or scanned domain. Access logs kept by the hosts: [TO BE COMPLETED: retention to be specified]
Your rights
You have the right to access, rectify, erase, restrict, object to and port your data, and to withdraw your consent at any time. To exercise these rights: [TO BE COMPLETED: contact address]
You can also lodge a complaint with the supervisory authority (CNIL, www.cnil.fr).