Data controller
Trocalia Digital S.L. (NIF B70751490), Barcelona. For any privacy matter, write to info@dmarcado.com.
What data we process and why
The X-ray: the domain you type and the result of querying its public DNS. The result is kept for 30 days at an address that cannot be guessed and that search engines do not index, and is then deleted. We do not store your IP address: to limit use we keep only an anonymous fingerprint of it, in memory and for one day. Basis: our legitimate interest in offering the tool and preventing abuse.
Contact and order data (name, company, email, phone, the domains and what you answer in the questionnaire: which services send email with your domain, where you manage your DNS and, if you give it to us, the email of whoever manages it): to do the work, deliver it to you and look after you. Basis: performance of the contract.
Billing and payment data: payment is handled by Stripe; we neither see nor store your card details. Basis: the contract and our tax obligations.
Aggregate DMARC reports for your domains: we process them on your instructions, as explained below.
Messages from the contact form: to reply to you. Basis: your request.
IP address and technical server logs: for the security of the service and to prevent abuse. Basis: our legitimate interest.
DMARC reports: data processing on your behalf
When you publish the DMARC record we give you, email providers (Google, Microsoft, Yahoo and others) begin sending an aggregate daily report about your domain to informes@dmarcado.com. These reports contain the IP addresses of the servers that have sent email using your domain, the number of messages and the authentication result. They do not contain the content, subject or recipients of any message.
With respect to that data you are the controller and we act as data processor (Article 28 of the GDPR): we use it only to show you who sends with your domain and to decide with you when to raise the policy. The terms and conditions set out that processing arrangement.
We read the reports for as long as the service lasts (90 days from payment, and one more year for each Watch purchased). When it ends we tell you how to stop sending them to us and we delete those we hold within a maximum of 30 days. Reports that arrive for a domain we no longer handle are discarded without being stored.
Who else is involved
We use providers who process data on our behalf, under contract and with safeguards: Stripe (payments), SMTP2GO (sending our emails) and our hosting and mailbox providers, in the European Union.
Some are in the United States or have sub-processors there. In those cases the transfer is covered by the EU-US Data Privacy Framework or by the European Commission’s standard contractual clauses.
We do not sell your data or use it for third-party advertising. We do not use the domains that go through the X-ray to write to their owners.
How long we keep it
Order and billing data, six years, under commercial and tax obligations.
The record sheet and the sealing record, for as long as your private page remains active, so that you can consult them again. You can ask us to delete them sooner.
DMARC reports, as stated in the previous section. Contact messages that do not lead to an order, one year.
Your rights
You can request access, rectification, erasure, objection, restriction and portability of your data by writing to info@dmarcado.com. If you believe we are not handling it properly, you can complain to the Spanish Data Protection Agency (aepd.es).
If you are the holder of a domain and prefer that it cannot be analysed in the X-ray, write to us and we will exclude it.