Privacy Policy & Data Hygiene
SubdomainWatch is engineered with privacy-by-design principles: zero advertising trackers, ephemeral edge processing, and strict multi-tenant database isolation.
1. Data Controller & Scope
Under the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, SubdomainWatch acts as the Data Controller for account registration details and billing identity, and as a Data Processor when executing automated DNS and attack surface reconnaissance on behalf of authenticated organizations.
2. Ephemeral Edge Localization & Zero IP Persistence
When you visit SubdomainWatch, edge routing proxies (Vercel Edge Network / Cloudflare) evaluate standard incoming HTTP country headers (e.g., x-vercel-ip-country, cf-ipcountry) strictly to present relevant pricing currencies:
- United Kingdom (GB) → Great Britain Pounds (£ GBP)
- Eurozone (EU) → Euros (€ EUR)
- Rest of World → US Dollars ($ USD)
3. Categories of Data Collected
Email address, hashed password (managed securely via Supabase Auth), organization workspace name, and billing references (Stripe Customer ID).
Monitored apex domains, enumerated subdomains, public DNS records (A, AAAA, CNAME, MX, TXT), TLS certificate validity periods, and detected dangling CNAME incidents.
Incident delivery email addresses and customer-configured Slack Incoming Webhook URLs.
4. Cookies, Local Storage & Sub-Processors
SubdomainWatch uses strictly essential cookies only to manage authenticated sessions (Supabase Auth JWT tokens stored in secure, HttpOnly, SameSite=Lax cookies).
sw_selected_domain: Preserves your active target domain selection in the Defense Console across page reloads.sw_incident_filter: Stores your active UI status filter (All / Active / Resolved).
Both items are strictly functional, stored locally on your device, and never transmitted to advertising networks.
- Supabase Inc. (PostgreSQL Database & Auth, Hosted in AWS EU Ireland)
- PostHog Inc. (Product Analytics & Error Diagnostics, Hosted in AWS EU Germany / Frankfurt)
- Vercel Inc. (Edge Compute & Application Hosting, Global Anycast)
- Stripe Inc. (PCI-DSS Level 1 Billing & Payment Gateway)
- Resend Inc. (Transactional Alert Email Delivery, USA)
- Fly.io Inc. (Daemon Reconnaissance Runner)
We do NOT load advertising trackers, retargeting pixels, or third-party ad network scripts. Product diagnostics via PostHog are hosted exclusively in the European Union and are governed by your consent preferences.
5. Multi-Tenant Data Isolation & Security
All perimeter scan telemetry, incident records, and organization settings are partitioned using PostgreSQL Row-Level Security (RLS). Every query executed in the Defense Console is cryptographically bound to the authenticated user's organization_id.
6. Your Statutory Rights (UK GDPR)
You have the right to request access to, rectification of, or erasure of your personal data, and to restrict or object to processing. To exercise these rights or request account deletion, contact privacy@subdomainwatch.com.