---

Part A — Data about our users

1. What we collect

• Account data. Your email address, the date you signed up, the IP address used at sign-up and at each login, your API token, and — if you sign in with Google — your Google account ID, email, and name as provided by Google. We never see or store a password.
• Billing data. Your subscription plan, its expiry date, and identifiers assigned by our payment provider, Stripe (customer, subscription, and checkout session IDs). Card numbers and other payment details are entered directly on Stripe's pages and are never stored on our servers.
• Usage data. For each API request and download we log the date and time, the method called, the zone or dataset requested, your API token, and your IP address.
• Technical data. Standard web-server logs (IP address, browser type, pages visited, referring page). We also use your IP address to estimate your country in order to show prices in the right currency.
• Correspondence. Anything you send us by email.

2. How we use it and on what legal basis

• To create and secure your account and send you one-time sign-in codes — performance of a contract.
• To process subscriptions, invoices, and renewals through Stripe — performance of a contract, legal obligation (tax and accounting records).
• To operate, monitor, and protect the Service, enforce plan limits, and prevent abuse or fraud — legitimate interests.
• To send you service emails such as welcome messages, sign-in codes, payment confirmations, and notices about changes to the Service or these policies — performance of a contract / legitimate interests. We do not send marketing newsletters.
• To answer your questions and provide support — legitimate interests.

3. Who we share it with

We do not sell your personal data. We share it only with service providers that help us run the Service:

• Stripe — payment processing and subscription billing.
• Postmark — delivery of transactional emails (sign-in codes, notifications).
• Google — optional "Sign in with Google" and reCAPTCHA bot protection on sign-in forms.
• Cloudflare — content delivery and protection against attacks.
• Hosting providers that run our servers in the European Union.

These providers process data on our behalf and under their own privacy commitments. We may also disclose data when required by law or to protect our rights and the security of the Service.

4. Cookies

We use a single first-party session cookie to keep you signed in. It is essential for the Service and does not track you across other websites. Google reCAPTCHA on our sign-in pages may set its own cookies according to Google's privacy policy. We do not use advertising cookies.

5. How long we keep it

• Account data — for as long as your account exists, and up to 12 months after you close it.
• Billing records — as long as required by tax and accounting law (usually 7–10 years).
• API and login logs — up to 24 months, for security and billing disputes.
• Web-server logs — up to 90 days.

6. International transfers

Our servers are located in the European Union. Some of our providers (Stripe, Postmark, Google, Cloudflare) may process data in the United States or elsewhere. Where that happens, transfers are covered by the EU Standard Contractual Clauses or an equivalent safeguard.

Part B — Data contained in our datasets

Our basic product is a list of registered domain names, which is public information taken from registry zone files and other public sources. Our enriched datasets additionally include technical details (nameservers, IP addresses, registration and expiry dates, registrar) and, where publicly published on the website itself, contact details such as email addresses and phone numbers.

We collect this information by crawling publicly accessible web pages. We do not collect data from pages behind a login, and we do not combine it with data from other sources to build profiles of individuals. Our legal basis is our legitimate interest, and that of our customers, in security research, brand protection, and business intelligence.

Our customers are contractually required (see our Terms of Use) to use the data lawfully and, in particular, not to send unsolicited communications in violation of anti-spam or data-protection law.

If your email address or phone number appears in our datasets and you want it removed, email [email protected] with the domain name concerned. We will remove the record from future dataset builds, normally within 30 days.

Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent where processing is based on consent. To exercise any of these rights, email [email protected]. We will respond within one month. If you are in the EU/EEA or the UK you also have the right to lodge a complaint with your local data-protection authority; our lead supervisory authority is the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus.

Security

All traffic to the Service is encrypted with TLS. Sign-in uses one-time codes instead of passwords, so there are no passwords to leak. Access to production systems is restricted to authorised staff. No system is perfectly secure, so please keep your API token confidential and tell us immediately if you suspect misuse.

Children

The Service is intended for businesses and professionals and is not directed at children under 16. We do not knowingly collect data from them.

Changes to this policy

We may update this policy from time to time. The current version is always available on this page and the "Last updated" date shows when it was changed. We will notify account holders by email of any material changes.

Contact

Data controller: ZoneStats.io, Republic of Cyprus
Email: [email protected]

See also our Terms of Use.