Privacy policy
Version 5 · Last updated: 2026-11-06
In short
We process what we need to run domain monitoring for you, plus analytics only if you accept them. We do not sell personal data or use it for advertising. Some of our providers are in the United States; the safeguards are listed below. You can export or delete your data and use every right below by writing to privacy@domaincare.io.
1. Who we are
The controller of your personal data is Artificial Systems SRL, Oradea Citadel, Building I, Office 6, Oradea, Bihor County, Romania, trade register number J2024001677058, fiscal code (CUI) 42509655. We operate DomainCare.
Write to privacy@domaincare.io for anything about your data. We have not appointed a data protection officer; privacy@ reaches the people who handle data protection.
When you use DomainCare to process personal data of other people (for example the email addresses of people who receive your alerts), you are the controller of that data and we process it for you under our Data Processing Agreement.
2. What we process, why, and for how long
For each purpose: the data, the legal basis under the General Data Protection Regulation (GDPR), how long we keep it, and whether you have to give it.
| Purpose | Data | Legal basis | How long | Do you have to give it? |
|---|---|---|---|---|
| Create and run your account, and sign you in | Email address, name, profile picture (from Google if you sign in with it), organisation name, sign-in tokens, the terms version you accepted and when | Contract (Art. 6(1)(b) GDPR) | While your account exists. Sign-in links expire after 10 minutes. | Yes: without an email address we cannot create an account |
| Keep accounts secure and detect misuse | IP address and browser of each sign-in session; IP address for rate limits | Legitimate interest in securing the service (Art. 6(1)(f)) | Sign-in sessions last up to 7 days; the session records stay with your account until it is deleted. Rate-limit records last at most one day. | Yes, as part of using the service |
| Teams: invite people to your organisation and manage their roles | Email address of the person invited, role, who invited them, membership | Contract with the organisation; for the invited person, our legitimate interest in delivering the invitation (Art. 6(1)(f)) | While the organisation exists, or until the member is removed | Only if you use teams |
| Monitor your domains and send alerts | Domains, check settings and results, alerts and incidents, notification channels (email addresses, Slack, Discord and webhook URLs), status pages | Contract (Art. 6(1)(b)); for data about other people you enter, see the DPA | Check results: 12 months, the latest result of each check is kept. Alerts, incidents and notification logs: while the organisation exists. Deleted domains and their history: purged 30 days after deletion. | Yes, to provide the monitoring |
| Billing, invoices and tax | Name, email, billing address and country, VAT number if any, plan, payment status; Stripe holds the payment method | Contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) under Romanian accounting and tax law | Invoices and accounting records: 5 years from 1 July of the year after the financial year they belong to (Law 82/1991, Art. 25) | Yes, to buy a subscription |
| Service email: sign-in links, alerts and digests you set up, billing, trial and account notices, a welcome email and one check-in email in your first days | Email address, name, the content of the email | Contract (Art. 6(1)(b)); the welcome and check-in emails: legitimate interest in helping you start (Art. 6(1)(f)) | Delivery logs at our email provider are kept only as long as needed to diagnose delivery problems, at most 90 days | Alerts and billing email: yes. You can ask us to stop the check-in email at any time |
| Answer your support, privacy and legal requests | What you write to us, your email address and name | Contract or legitimate interest in answering (Art. 6(1)(b), (f)); legal obligation for privacy requests (Art. 6(1)(c)) | Up to 3 years after the conversation ends, to handle follow-ups and legal claims | No |
| Product analytics and error tracking, only if you accept analytics cookies | Pages and features used, clicks, errors, device and browser data, IP address, domains typed into our free tools; once signed in: your DomainCare user id, plan and number of domains (not your email) | Consent (Art. 6(1)(a)), which you can withdraw at any time | Kept in PostHog under our project's retention setting; we delete the events linked to your user id when you ask | No: refusing changes nothing in the service |
| Account and billing statistics, and error reports from our servers | Your organisation's internal id, account and billing events (trial started, subscription started or cancelled, payment failed, checkout completed with the Stripe customer id) and technical error reports from our servers | Legitimate interest in understanding how the service is used and paid for and in fixing errors (Art. 6(1)(f)) | Kept in PostHog under our project's retention setting | Yes, as part of using the service; you can object (section 7) |
| Handle a withdrawal from the contract | Your name, email address, the contract, the date and time we received the withdrawal, the refund status | Legal obligation under consumer law (Art. 6(1)(c)) and legitimate interest in proving it (Art. 6(1)(f)) | 3 years after the withdrawal, also after the account is deleted | Yes, to withdraw online; you can also withdraw by email or post |
| Record your cookie choice | Your choice, a consent id, date, the page, your country and a shortened browser description (no IP address is stored with the record) | Legal obligation to prove consent (Art. 6(1)(c) with Art. 7(1)) | The choice is stored in your browser for 6 months, then the banner asks again; we keep the consent record as proof of consent for 3 years after the choice ends | No |
| Free trial follow-up and abuse prevention | Account and trial dates, one trial per organisation | Legitimate interest in preventing abuse of free trials (Art. 6(1)(f)) | A trial that ends without a subscription is paused; its account and monitoring data stay until you delete them | Yes, to start a trial |
Where we rely on legitimate interests, they are the ones named in the table: securing the service, preventing abuse, delivering invitations and helping new users start. You can object to that processing (see section 7).
We never read the content of your websites, your customers' data or anything behind a login. Each check is a request a browser, mail server or DNS resolver could make on its own.
3. Data we receive from someone else
- If someone invites you to their organisation, we receive your email address from them, to send you the invitation. The invitation email names the person who invited you and links to this policy. If you do not accept, the invitation expires; ask the organisation or us to remove it.
- If a customer adds your email address as an alert recipient, we process it for that customer under the DPA. Ask that customer first; we help them answer you.
- If you sign in with Google, it sends us your name, email address and profile picture. We no longer offer GitHub sign-in; an account created with it before 5 November 2026 keeps its GitHub link (your GitHub user id) until you remove it under Settings, Account, Linked accounts.
- Stripe sends us the billing country, whether you gave a VAT number and the status of your payments.
- Domain registries(RDAP, WHOIS) return registration data for the domains you monitor. We keep the registrar, dates and name servers, not the registrant's contact details.
4. Who receives your data
Our processors, listed with their location and transfer basis on the subprocessors page: our server host in Bucharest, Romania (database and background jobs), Vercel (hosting, in Frankfurt), SMTP2GO (email, in the EU), Google Workspace (our mailboxes), Stripe (payments), PostHog (analytics, stored in the EU: in your browser only with your consent; account and billing statistics and error reports from our servers), Bunny (delivers the cookie banner script) and Upstash (rate limits). We send the domain names you monitor, and nothing else, to page-speed, reputation and DNS services listed on the same page.
Others: Google when you sign in with it, the push service of your browser if you turn on push alerts, the Slack, Discord or webhook endpoints you set up, and public authorities when the law requires it. We do not sell personal data and do not share it for advertising.
5. Transfers outside the European Economic Area
Your account data is stored in Romania and the application runs in Frankfurt, Germany. Some processors are United States companies or process data there: Upstash, parts of Stripe and Google, and Vercel and PostHog for any access from the United States. PostHog stores our analytics in its EU Cloud in Frankfurt. We transfer data to them on the basis of the EU-US Data Privacy Framework where the company is certified, or the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914) in their data processing agreements. SMTP2GO processes email in the EU; it is a New Zealand company, a country the European Commission considers to offer adequate protection. The basis for each provider is on the subprocessors page; ask privacy@domaincare.io for a copy of the safeguards.
6. Cookies and similar technologies
We store a few items in your browser. The necessary ones need no consent because the site or the service you asked for does not work without them. Analytics items are set only after you accept them in the cookie banner. We use no advertising cookies, no social media pixels and no fingerprinting.
Necessary
| Name | Purpose | How long | Set by |
|---|---|---|---|
| better-auth.session_token | Keeps you signed in | 7 days | DomainCare |
| better-auth.session_data | Short cache of your session so pages load faster | 5 minutes | DomainCare |
| Other better-auth sign-in cookies (sign-in state, dont_remember) | Protect the sign-in flow and remember a 'do not keep me signed in' choice | Up to 5 minutes, or the browser session | DomainCare |
| grf_consent | Stores your cookie choice | 6 months, then the banner asks again | DomainCare (our Veni Vidi Cookie banner) |
| dc-sidebar-collapsed | Remembers whether you collapsed the app sidebar | 1 year | DomainCare |
| docs-recent-searches, docs_feedback_<page> (local storage) | Your recent searches in the docs and whether you already rated a docs page | Until you clear them | DomainCare |
Analytics (only with your consent)
| Name | Purpose | How long | Set by |
|---|---|---|---|
| ph_<project>_posthog (cookie and local storage) | Distinguishes visits for product analytics | 1 year | DomainCare, set by PostHog |
| __ph_opt_in_out_<project> (local storage) | Remembers that you accepted analytics | Until you clear it | DomainCare, set by PostHog |
Until you accept, the PostHog analytics script does not run in your browser and sends nothing. The choice you make on our website also applies in the app. You can change or withdraw it at any time with Cookie settings in the footer of any website page or the cookie badge on those pages. Withdrawing does not affect what was processed before.
7. Your rights
Under the GDPR you have the right to:
- access your data and get a copy;
- rectify data that is wrong or incomplete;
- erase your data;
- restrict processing in certain cases;
- data portability: receive the data you gave us in a machine-readable format;
- object to processing based on legitimate interests;
- withdraw consent at any time, without affecting earlier processing.
Organisation owners can export the organisation's data and delete the organisation and their account in Settings → Account. Everyone else, and anyone who wants something the settings do not offer, writes to privacy@domaincare.io.
We answer within one month. If a request is complex or we receive many, we may extend this by two more months and tell you why within the first month. It is free; we may ask for information that confirms your identity before acting.
You can complain to the Romanian data protection authority, ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal, dataprotection.ro), to the authority in the EU country where you live or work, or go to court.
8. Deleting your account
When an owner deletes the organisation in Settings → Account, we delete its domains, check history, alerts, settings, members' access, API keys and status pages, and the owner's user account, and we cancel the subscription. We keep invoices and accounting records for the period the law requires (section 2). Stripe keeps its own copy of payments under its privacy policy. Data in backups is overwritten in the normal backup cycle.
If an unpaid account is deleted after 30 days (section 6.8 of the terms), the user's email address is replaced at once and the user record is deleted 90 days later.
9. Automated decisions
We make no decisions about you based solely on automated processing that have legal or similarly significant effects (Art. 22 GDPR). The only automatic step that affects access is the suspension of accounts with unpaid invoices (section 6.8 of the terms); you can contact us at any time during that process and ask for a person to review it.
10. Children
DomainCare is for people aged 16 or over. If you believe a child under 16 gave us personal data, write to privacy@domaincare.io and we delete it.
11. Security
We encrypt traffic with TLS, do not keep the sign-in tokens Google sends us, limit access to production systems to the people who need it, rate-limit sign-in and the API, keep backups, and review our providers and dependencies. If a personal data breach is likely to put your rights at risk we notify ANSPDCP within 72 hours where the law requires it, and we tell you without undue delay when the risk to you is high.
Report security issues to security@domaincare.io.
12. California and the United Kingdom
California residents (CCPA/CPRA): we collect the categories of data described in section 2 for the purposes described there. We do not sell or share personal information as those words are defined in the CCPA, and have not done so in the last 12 months (see Do Not Sell or Share). You may ask to know, delete or correct your data and you will not be treated differently for doing so. Email privacy@domaincare.io with the subject "California Privacy Request"; an authorised agent may act for you with written authorisation. We answer within 45 days, or 90 days for complex requests.
United Kingdom:the UK GDPR gives you the same rights as section 7. Transfers from the UK rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses. You can complain to the Information Commissioner's Office (ico.org.uk).
13. Changes to this policy
When we change this policy we update the version and date at the top. We email account owners at least 14 days before a change that affects how we collect, use or share personal data takes effect. Earlier versions are available on request at privacy@domaincare.io.
14. Contact
- Privacy and data requests: privacy@domaincare.io
- Support: hello@domaincare.io
- Security: security@domaincare.io
- Post: Artificial Systems SRL, Oradea Citadel, Building I, Office 6, Oradea, Bihor County, Romania