Privacy Policy
What personal data statusdns.com collects, why, who we share it with, how long we keep it and how you can exercise your rights.
This Privacy Policy explains how InsideMaps Bulgaria EOOD (“StatusDNS”, “we”, “us”) processes personal data when you visit statusdns.com, use the free tools, hold an account, use the API or contact us. We are the data controller for that processing. Where a business customer uses the Service to process personal data of its own end users, we act as processor under our Data Processing Addendum.
Short version: we collect what is needed to run your account and the checks you ask for; card details never reach us (Paddle handles payment); we do not sell personal data, do not run advertising or third-party analytics, and use only strictly necessary cookies.
1. Who We Are
InsideMaps Bulgaria EOOD, a company registered in Bulgaria (EIK 205550879, VAT BG205550879), Graf Ignatiev St 44-A, fl. 4, 1000 Sofia, Bulgaria. StatusDNS is a brand of this company. We have not appointed a Data Protection Officer because we are not required to; privacy questions go to support@statusdns.com (mark the subject “Privacy”).
2. Scope of This Policy
This Policy covers statusdns.com, the StatusDNS web application, the API, transactional email we send and our support channels. It does not cover third-party websites we link to, Paddle’s checkout pages (see Paddle’s privacy policy), or the systems of the domains you check.
3. Personal Data We Collect
| Category | Examples | Source |
|---|---|---|
| Account data | Name, email address, company name, password (stored as an Argon2id hash), time zone, notification preferences, plan and free-month status, email-verification status | You, at registration and in settings |
| Billing data | Plan, billing cycle, subscription status, Paddle transaction and subscription identifiers, invoice references. We never receive card numbers; Paddle collects payment details and your billing address as Merchant of Record. | Paddle, via checkout and webhooks |
| Usage data — lookups | The domains, host names, IP addresses, selectors and records you query; the tool used; the result status and duration; timestamp; the IP address of the requester (used for rate limiting and abuse prevention) and, for signed-in users, the account ID | You / your browser / your API client |
| Usage data — monitoring | Domains you add, labels, DKIM selectors, check results and history, health scores, alerts, notification channels (email addresses, webhook and Slack URLs you configure) | You; generated by the Service |
| DMARC reports | Aggregate report XML you upload, which contains sending IP addresses, message counts and the reporting organisation’s contact address | You (upload) |
| API data | API key name and prefix, key hash, call counts, last-used time | You; generated |
| Communications | Contact-form messages, support emails, newsletter subscription (email address, IP, time) | You |
| Technical data | IP address, user agent, requested URLs, referrer, timestamps in web-server logs; application error logs; audit log of administrative actions | Your browser; generated |
Most data processed by the Service — domain names, IP addresses of servers, DNS records — relates to infrastructure rather than to identifiable people. Where an IP address or a WHOIS record does identify a person, it is processed only as part of the check you requested.
4. How We Collect Personal Data
Directly from you (forms, uploads, API requests, emails); automatically from your browser or API client (IP address, user agent, cookies described in Section 12); from Paddle after a purchase (transaction status, plan, identifiers); and from public sources as part of a check you request (DNS, RDAP/WHOIS, blacklist responses, certificate data).
5. Why We Use Personal Data and Lawful Bases
| Purpose | Lawful basis (GDPR Art. 6) |
|---|---|
| Create and administer your account, run lookups and monitoring, send alerts and digests, provide the API and support | Performance of a contract (Art. 6(1)(b)) |
| Process purchases, the free month and refunds with Paddle; keep accounting records | Contract; legal obligation (Art. 6(1)(c)) |
| Rate limiting, abuse and fraud prevention, security monitoring, audit logging, backups | Legitimate interests (Art. 6(1)(f)) in keeping the Service secure and available |
| Improve the Service using aggregated, non-identifying statistics (for example which tools are used, average response times) | Legitimate interests |
| Send product updates by newsletter | Consent (Art. 6(1)(a)) — withdraw any time via the unsubscribe link or by email |
| Send service notices (security, terms or price changes, free month or plan ending) | Contract; legitimate interests |
| Respond to legal requests and enforce our terms | Legal obligation; legitimate interests |
We do not use personal data for advertising, profiling for marketing, or selling to third parties.
6. Who We Share Personal Data With
We share personal data only with processors that help us run the Service, under written agreements, and with authorities when legally required. Current processors (see also sub-processor list):
| Recipient | Purpose | Location |
|---|---|---|
| Paddle.com Market Ltd | Merchant of Record: checkout, payment processing, invoicing, tax, refunds. Paddle is an independent controller for the payment data it collects. | United Kingdom |
| Resend Inc. | Delivery of transactional email (account emails, alerts, digests): recipient address, subject, message content | United States (sending region: EU) |
| OVH SAS (OVHcloud) | Hosting of the application, database, backups and logs | Company in France; data centre in Virginia, United States |
| Cloudflare, Inc. | Authoritative DNS for statusdns.com and reverse proxy/CDN in front of the site (sees request metadata including your IP address) | United States, global edge network |
| Google LLC (Google Fonts) | The site loads the Inter typeface from fonts.googleapis.com / fonts.gstatic.com; your browser’s request (IP address, user agent) reaches Google | United States |
| Third-party data sources | By the nature of a lookup, the domain or IP address you query is sent to authoritative name servers, mail servers, DNS-blacklist operators, RDAP/WHOIS registries and public resolvers. They may log the query. No account data is sent to them. | Worldwide |
We may also disclose data to professional advisers, to a purchaser in a merger or sale of the business (with notice to you), and to courts, regulators or law enforcement where required by law.
7. International Data Transfers
The Service is hosted by OVHcloud in a data centre in Virginia, United States; personal data is therefore stored outside the EEA. OVH SAS is a French company and the hosting is covered by its data-processing agreement incorporating the EU Standard Contractual Clauses (SCCs). Transfers to Resend, Cloudflare and Google in the United States rely on the EU–US Data Privacy Framework where the recipient is certified, and otherwise on the SCCs with supplementary measures. Transfers to Paddle in the United Kingdom rely on the European Commission’s adequacy decision for the UK. For UK users, transfers rely on the UK International Data Transfer Addendum. Copies of the relevant safeguards are available on request.
8. How Long We Keep Personal Data
| Data | Retention |
|---|---|
| Account data | For the life of the account; deleted within 30 days after you close it |
| Monitoring history (check results, alerts) | For the history period of your plan — 7 days (Free), 30 days (Starter), 1 year (Professional), 3 years (Enterprise) — then automatically deleted; all deleted within 30 days of account closure |
| Lookup logs (tool, query, requester IP) | 90 days |
| Web-server and application logs | 90 days |
| Uploaded DMARC reports | Until you delete them or close the account |
| Sent-email records (address, subject, delivery status) | 30 days |
| Billing and invoice records | 10 years, as required by Bulgarian accounting and tax law; invoices themselves are issued and retained by Paddle |
| Newsletter subscription | Until you unsubscribe; then a suppression record of the address to honour the opt-out |
| Database backups | Rolling 14 days |
| Contact-form messages | 24 months |
9. Your Rights
EU/EEA and UK (GDPR / UK GDPR). You have the right to access your personal data, to rectification, to erasure, to restriction of processing, to data portability, to object to processing based on legitimate interests, and to withdraw consent at any time without affecting prior processing. Most of this is available directly: Account → Profile & Security lets you edit your details, change your email, export all your data as JSON, or delete the account entirely; Account → Notifications controls alert and digest emails. For anything else email support@statusdns.com with the subject “Privacy request”; we respond within one month (extendable by two months for complex requests, with notice). We may ask you to verify your identity.
California (CCPA/CPRA). California residents have the right to know what personal information we collect, use and disclose; to delete it; to correct it; to opt out of “sale” or “sharing” (we do neither); to limit use of sensitive personal information (we collect none); and not to be discriminated against for exercising these rights. Requests: support@statusdns.com. Because we do not sell or share personal information and do not track users across sites, no opt-out mechanism is required; “Do Not Track” and Global Privacy Control signals therefore have nothing to switch off.
Other jurisdictions. Residents of other countries with data-protection laws (for example Brazil’s LGPD, Canada’s PIPEDA, Australia’s Privacy Act) may exercise the equivalent rights by contacting us.
10. Children’s Privacy
The Service is intended for businesses and adults. We do not knowingly collect personal data from anyone under 18 (or under 16 where the GDPR sets that age for information-society services). If you believe a minor has created an account, contact us and we will delete it.
11. Security
We apply technical and organisational measures appropriate to the risk: TLS for all traffic, Argon2id password hashing, hashed API keys, CSRF protection, secure HttpOnly cookies, rate limiting, parameterised database access, least-privilege service accounts, audit logging and daily database backups. Details are on the Security page. No system is perfectly secure; if we learn of a personal-data breach that is likely to result in a risk to you, we will notify the competent authority within 72 hours and inform you without undue delay where the law requires it.
12. Cookies and Similar Technologies
We use only strictly necessary cookies: sdns_session (session cookie for signed-in use and CSRF protection) and, if you tick “Remember me”, sdns_remember (30 days). No advertising or analytics cookies are set by us. Paddle’s checkout sets its own cookies during purchase. Full details, including how to control cookies, are in the Cookie Policy.
13. Automated Processing and Decisions
Health scores, grades, alerts and generated records are produced automatically by rules applied to public DNS and network data. They concern domains and servers, not people, and produce no legal or similarly significant effect on you. We do not carry out profiling of individuals or automated decision-making within the meaning of GDPR Article 22.
14. Changes to This Policy
We may update this Policy. The version and “Last updated” date appear at the top. Material changes are announced by email to account holders and on this page before they take effect.
15. Complaints
If you are unhappy with how we handle your personal data, please contact us first so we can put it right. You also have the right to lodge a complaint with a supervisory authority. Our lead authority is the Bulgarian Commission for Personal Data Protection (Комисия за защита на личните данни), 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria, www.cpdp.bg. EU/EEA residents may complain to the authority of their own country; UK residents to the Information Commissioner’s Office (ico.org.uk).
16. Contact
InsideMaps Bulgaria EOOD, Graf Ignatiev St 44-A, fl. 4, 1000 Sofia, Bulgaria · support@statusdns.com (subject “Privacy”) · Mon–Fri 09:00–18:00 EET.