Privacy policy

1. Who is responsible

TrackName’s operator is the controller for account administration, service security and the other purposes described here. This policy covers visitors, account holders, alert recipients and people whose details appear in the public records we monitor.

Where we process information solely on a business customer’s instructions, our role and obligations must be set out in a separate data-processing agreement. This policy does not replace that agreement.

2. Information we use

Information you provide

• Account details: your name, email address, password hash, verification status and any optional authentication credentials, such as passkeys or two-factor settings.
• Monitoring settings: domains and URLs, selected checks, keywords and alert preferences.
• Alert recipients: email addresses, membership history, and delivery records. An account holder may provide your address; you do not need to have an account yourself.
• Enquiries: your email address and any name, company, domain, domain count or message you choose to provide. We also record which audience page you used, when you submitted the form and the privacy-notice version shown. Enquiries are stored in the application for operator review. The enquiry record does not include your IP address or browser details; separate security and session records may contain them.
• Other messages: information you send when asking for support, cancellation or help with personal data.

Information collected when the service runs

We process IP addresses, browser information, session identifiers, sign-in activity and diagnostic records to operate and secure the website. Monitoring produces registration, DNS and certificate records, website responses, response times, page text, screenshots, observations and change history.

Public registration records may include a person’s name, organisation, email, telephone number and location. We obtain those records from registries, registrars and registration-data services. Website operators publish the page content and images we check. DNS resolvers and certificate-transparency services supply other technical records.

We do not bypass redaction or access controls to obtain private registration contacts. Publicly accessible data can still be personal data. We use published contact details to compare registration records, not as a marketing list.

Test checkout and future billing

Stripe processes subscription payments. TrackName stores the domain, chosen domain count and billing period, amount, currency, checkout and subscription references, payment status and a hashed browser token used to protect the receipt. We also record when you acknowledge the monitoring service and accept the terms, together with the notice version shown. A verified event record supports payment confirmation and retries. Stripe receives a purchase reference and plan identifier; details entered into its hosted checkout are handled by Stripe. TrackName does not store full card numbers.

Test checkout makes no real charge. Monitoring starts only after confirmed payment, account claim and domain setup. Use Stripe’s test details when trying it. Live subscription billing, production payment arrangements and the retention schedule for test purchase records must be confirmed before launch.

3. Why we use it

Where the GDPR applies, we use the following legal bases. The basis depends on the person, information and purpose involved:

• Providing your service: account access, requested monitoring, notifications, support and subscription administration are necessary to perform our contract with you. Required account details must be provided for an account to work.
• Answering your enquiry: we use your contact details and message to respond to what you requested. This may be a step towards a contract at your request, or our legitimate interest in answering a business enquiry. Submitting a form does not create an account, start monitoring or subscribe you to marketing.
• Operating and securing the service: preventing abuse, investigating faults, administering business customer accounts and maintaining relevant technical history serve our legitimate interests in a reliable service.
• Monitoring public records and delivering requested alerts: where information concerns someone other than our customer, the intended basis is our and our customers’ legitimate interest in identifying changes affecting a domain. We must balance that interest against the person’s rights and limit the data used.
• Meeting legal duties: we retain or disclose information where needed for accounting, tax, court orders or other applicable legal obligations.
• Optional uses based on consent: if we introduce optional marketing or non-essential tracking, we will explain it separately and obtain consent where required. You can withdraw that consent without affecting earlier lawful processing.

Domain checks can automatically generate alerts. They do not make decisions about a person’s credit, employment or similar matters with legal or comparably significant effects.

4. Sharing and international transfers

Monitoring results are provided to the customer who requested the check and their configured recipients. Infrastructure and service suppliers may process the information needed to host the application, store data, deliver email, support payments and maintain security. Suppliers must have appropriate contractual and security safeguards.

A monitoring request reveals the requested domain or hostname to the relevant data source, DNS resolver or monitored server. It may also reveal the monitoring server’s IP address and request details. These requests do not require us to send your account password or payment information.

We may disclose information where legally required, to protect people or the service, or in connection with a business transfer subject to appropriate safeguards and notice. We do not sell personal data or share it for behavioural advertising.

Production hosting and email providers, their processing locations and the payment-provider arrangements have not yet been confirmed. These details must be completed before launch. We do not currently make an EU-only hosting claim.

If personal data is transferred outside the EEA, applicable safeguards must be in place, such as an adequacy decision or approved contractual clauses with any necessary additional measures. The final provider information will identify relevant transfers. You may request information about those safeguards through our contact address.

5. Cookies and local storage

The application uses a session cookie to maintain your visit and sign-in state, and a request-security cookie to help prevent forged requests. If you choose “Remember me”, a persistent authentication cookie keeps you signed in. These are used for the site and account functions you request.

Your light or dark appearance preference is stored in your browser’s local storage. You can change it through the theme control or remove it through your browser settings. Blocking essential cookies may prevent sign-in or other account functions.

This version of the site has no advertising or analytics tracking integration. If that changes, we will update this policy and provide any required choices before non-essential tracking starts.

6. How long we keep data

We keep information for the purpose it serves, then delete it or remove identifying details when it is no longer needed. Retention depends on the type of record:

• Landing-page enquiries: the current configuration schedules routine removal after 90 days. Any later support correspondence or agreed customer relationship has its own retention requirements. The production schedule and backups must be confirmed before public launch.
• Account and support records: for account administration, the support request and any applicable legal or dispute period. The production deletion and backup schedule still needs confirmation.
• Monitoring history: the current configuration sets routine pruning thresholds of 400 days for observations and 400 days for changes. Current baselines, observations needed to explain a retained change, and unresolved delivery evidence may be kept longer while required.
• Page text and screenshots: routine removal after the configured retention period since they were last observed. Re-observing an unchanged page can extend that period.
• Published registration contacts: raw contact values are subject to separate removal after monitoring stops and from older records. Comparison hashes and disclosure status may remain; a hash is not automatically anonymous data.
• Billing, security and legal records: for the statutory retention period or for as long as needed to investigate a specific incident or establish, exercise or defend a legal claim.

Removing an alert recipient stops future alerts but does not immediately remove delivery history. Closing an account does not necessarily erase records we must lawfully retain. The production schedule for recipients, logs, backups and account-linked monitoring data must be finalised before launch; the technical thresholds above are not a promise that every copy disappears on an exact day.

We use access controls, secure authentication and other measures appropriate to the information involved. No system can guarantee absolute security. Please do not include passwords or unnecessary sensitive information in support messages or monitoring settings.

7. Your rights

Depending on the law that applies, you may ask to access or correct your personal data, have it erased, restrict its use, or receive eligible data in a portable format. You may object to processing based on legitimate interests, including the use of your details in public-record monitoring. These rights apply to people in monitored records and alert recipients as well as account holders.

You can withdraw consent for processing based on consent at any time. Withdrawing consent does not affect processing that was lawful before withdrawal. A deletion request may be limited by a legal obligation or another lawful reason to retain particular information; we will explain any such limitation.

Contact us to make a request. Tell us how to locate the information, for example your account email or the domain and record concerned. We may ask for proportionate evidence of identity. Under the GDPR, we normally respond within one month. If a lawful extension is needed, we will explain it within that first month.

You may complain to the data-protection authority in the country where you live or work, or where you believe an infringement took place. You do not have to contact us first. Other local privacy rights continue to apply where the relevant law provides them.

8. Changes to this policy

We will update the date on this page when the policy changes. Where a change materially affects how we use personal data, we will provide an appropriate notice before it takes effect and seek new consent where required. Questions about this policy can be sent to the contact address above.