Privacy policy

Who is responsible

Excubitor is run by Rui Aliu, in Portugal. For any question about your data, write to support@excubitorsecurity.com.

The free check

When you check a domain, we only look at public information: DNS records, the certificate the site presents and the headers of one page. We do not break into anything and we do not scan ports.

We do not keep the result of the check or your IP address. To prevent abuse we keep, for at most 2 days, a fingerprint of the IP (a code computed with a secret key, from which the IP cannot be recovered) and the domain checked, with a request counter.

Monitoring ("Notify me")

If you ask to be notified, we keep your email, the domains you want watched, the site type you chose and your language. We also keep the fingerprint of the request's IP, to limit abuse.

A request that is not confirmed through the link in the email is deleted after 24 hours. Requests received before email sending was switched on were kept on a waiting list, which is deleted after 180 days if not acted on.

While you are subscribed, we keep the latest result for each domain, to compare with the next one, and the alerts we send you.

To cancel, reply to any email from us or write to the contact above. We delete your account, your domains and your alerts within 30 days.

Why we may process this data

For monitoring, because you asked for the service and confirmed it through the link in the email (performance of a contract, Article 6(1)(b) GDPR).

For the request limits, because we have a legitimate interest in protecting the service and third parties' domains against abuse (Article 6(1)(f)).

Who we share it with

We do not sell data and we do not use advertising. Your data only goes through the providers that make the service work:

• Netlify (hosting of the site and functions), in the United States.
• Supabase (database), with servers in Ireland.
• Resend (email sending), with servers in Ireland.
• Cloudflare (DNS and email reception). Email sent to our contact address is forwarded to a Gmail (Google) mailbox.
• TypeSafe (rating how serious each problem found is). It receives the technical description of the problem and the site type, never your email.

When a provider is outside the European Economic Area, the transfer relies on the EU-US Data Privacy Framework or on standard contractual clauses approved by the European Commission.

When the paid plan opens, payments will be handled by an authorised reseller, which is the seller and processes payment data as an independent controller. We never see or store card details.

Cookies

The site uses no cookies, no analytics tools and no third-party scripts.

Your rights

You can ask for access to, correction, deletion or portability of your data, and object to its processing, by writing to the contact above. We reply within one month.

You can also complain to the Portuguese data protection authority (CNPD), or to the authority of the country where you live: https://www.cnpd.pt

Changes

If this policy changes in a way that affects you, we will email subscribers before the change takes effect.