Privacy Policy

Last updated: January 2025

1. Controller

domainexpirycheck.com is operated as a sole trader from Braga, Portugal. For privacy matters, contact us at [email protected].

This policy is governed by Portuguese law and EU Regulation 2016/679 (GDPR). As an EU-based operator, you have full GDPR rights with respect to your personal data.

2. Data we collect

Data	Purpose	Basis
Email address	Magic link login; expiry notifications	Contract performance
Domain names	WHOIS checks; expiry monitoring	Contract performance
Billing data	Payment processing	Contract; processed by Stripe
Usage analytics	Improving the service	Consent (opt-in via cookie banner)

3. Analytics and cookies

We use two analytics tools, both only activated after you explicitly accept via our cookie banner:

Google Analytics 4 — page view and event tracking. Data may be processed in the US under Standard Contractual Clauses. IP anonymisation is enabled. See Google's privacy policy.
PostHog — product analytics (clicks, flows, feature usage). We use the EU-hosted endpoint (eu.i.posthog.com) so data stays within the EU. See PostHog's privacy policy.

If you decline or have not yet responded to the cookie banner, neither tool is loaded and no data is sent.

Privacy-friendly usage analytics (no consent required)

Separately, we record basic, fully anonymous usage statistics — page views and product actions (such as adding a domain or starting a checkout). This runs for all visitors because it collects no personal data and sets no cookies:

No IP address is stored — your IP is only used momentarily to derive a coarse country code, then discarded.
No cookies, no localStorage, and no browser fingerprinting.
A session is a random identifier held only in your browser's memory for the current visit; it is never written to your device and cannot be linked to you or across visits.
We keep only the page path (without query string), a traffic-source label, a coarse country, and a device category (Desktop/Mobile/Tablet).

Because this data is not personal data under the GDPR/ePrivacy rules, it needs no consent. Records are automatically deleted after 12 months. Legal basis: legitimate interest (Art. 6(1)(f)) in understanding aggregate product usage.

Cookies we set

Name	Purpose	Duration
session	Authentication — keeps you logged in	30 days
dec-theme	Stores your dark/light mode preference	1 year
dec-consent	Remembers your analytics consent choice	1 year
lang	Remembers your preferred language	1 year
_ga, ph_*	Google Analytics / PostHog (only if consent given)	Up to 2 years

4. Data storage and transfers

Your account data and domain records are stored on a server in the EU (Hetzner, Germany). Backups are encrypted at rest. Payment data is handled entirely by Stripe, Inc. — we never see or store card details.

Google Analytics may transfer data to the US under Standard Contractual Clauses. PostHog data remains within the EU.

5. Retention

Account and domain data: retained while your account is active, deleted within 30 days of account closure
Server logs: 30 days
Email logs: 90 days
Billing records: 7 years (legal obligation under Portuguese law)

6. Your rights (GDPR)

Under GDPR you have the right to access, rectify, erase, restrict, and port your data, and to object to processing. To exercise these rights:

Delete your account at any time from the settings page
Email [email protected] for data export requests
Withdraw analytics consent at any time by clicking "Decline" in the cookie banner
Complain to the Portuguese data protection authority (CNPD) at cnpd.pt if you believe your rights have been violated

7. Contact

[email protected]
Braga, Portugal