Last updated:
This policy explains what data score.email collects, why, for how long, who it is shared with and what your rights are. It is written to be read: if anything is unclear, write to us.
Olivier Damiano, sole proprietor — 1455 chemin des Terriers Longuettes, 83470 Saint-Maximin-la-Sainte-Baume, France (SIREN 994 678 407). Contact for any question about your data: privacy@getscore.email.
Free scan. The domain name you enter, the scan result (public DNS records, score, findings), the language, the date, and a pseudonymized fingerprint of your IP address (a salted hash — never the raw IP) used only to limit abuse. Legal basis: our legitimate interest in providing and protecting the service. A domain name is public data; it can nevertheless identify a person (a surname, a sole trader) — which is why we treat it as personal data.
Full report and waitlist. Your email address, the associated domain, whether you act for clients (agency, freelancer) and, for the agency waitlist, the rough number of domains you manage. Your email is used to send the report or notification you asked for (performance of your request). After a report, we send you the real state of the scanned domain, re-checked at day 2, 7, 14 and then monthly (six emails at most, with our monitoring offer). If the domain sends us its DMARC reports (see below), we also send you, once, a statement of what they contain — only if your address belongs to that domain. Legal basis: our legitimate interest in following up the service you requested (B2B prospecting tied to that service). You can object at any time through the unsubscribe link in every email, or by writing to us.
Monitoring (subscription). Your email, the monitored domain(s), the history of checks and alerts, the bulletins sent, and the subscription data passed on by Paddle (transaction ID, plan, status, billing country — never your card number, which we do not see). Legal basis: performance of the contract.
DMARC reports. When you publish our reporting address in your DMARC record (rua=), mailbox providers (Google, Microsoft, etc.) send us aggregate reports about email received in your domain's name. These reports contain the IP addresses of sending servers, volumes and authentication results — technical data about third parties (your sending tools, or impersonators). Purpose: detect who sends in your name and alert you. Legal basis: the domain owner's legitimate interest in securing its use, at their request. We use these reports only for your domain; any statistics we publish are aggregated and identify neither a domain nor a server.
Email exchanges. If you write to us, we keep the exchange for as long as needed to handle it and refer back to it.
Free scans: 12 months, then kept as aggregate statistics without domain or IP fingerprint. Contacts who requested a report or joined a waitlist: until you unsubscribe, and at most 3 years after your last interaction with us. Monitoring customers: for the duration of the subscription, then 5 years (contractual limitation period); accounting records are kept 10 years (legal obligation). DMARC reports: 7 days for a domain not under monitoring; for a monitored domain, during the subscription and at most 12 months afterwards. Pseudonymized IP fingerprint: 12 months.
We never sell or rent any data. It is processed by the following providers, on our behalf and instructions:
Supabase, Inc. — database, data hosted in the European Union (Paris region).
Vercel Inc. (USA) — hosting of the website and application; audience measurement (see § 6).
Resend, Inc. (USA) — delivery of our emails (reports, bulletins, alerts, tips).
OVH SAS (France) — mailbox receiving DMARC reports.
Paddle.com Market Ltd (United Kingdom) — sale and collection of subscriptions as Merchant of Record: Paddle is the data controller for payment and billing data, under its own privacy policy.
Anthropic, PBC (USA) — AI-assisted writing of bulletins and guides: the domain, its check results and report aggregates are sent to produce the text; no email address is sent. Anthropic does not use this data to train its models.
Transfers outside the European Union. Vercel, Resend and Anthropic are established in the United States; Paddle in the United Kingdom (a country recognized as adequate by the European Commission). Transfers to the United States rely on these providers' certification under the EU-U.S. Data Privacy Framework and, failing that, on the European Commission's standard contractual clauses. You can obtain a copy at the address above.
Encryption in transit (HTTPS everywhere, HSTS), restricted and logged database access, no passwords: the customer area opens with a link sent to your address. We never edit your DNS zone: you paste the values we give you yourself.
The site sets no advertising or tracking cookie and uses no ad network. To learn what helps our visitors and improve it, we measure site usage ourselves, without cookies: a randomly drawn visit identifier is kept in your browser's session storage (it disappears when you close the tab), along with where the visit came from: an ad's campaign or keyword, the ad network it came from (we never keep the click identifier it adds to the address), the referring site and the landing page. It is used to record, on our own servers, the steps of the visit: pages viewed, scan launched, form shown or filled in, clicks on the main buttons, and which version of a page was shown when we test two. Neither your IP address nor your email address is stored there; this data is not shared or used for advertising, and is deleted after 13 months. When you run a scan, leave your email or subscribe, this origin is recorded with the scan, your email or your subscription, so that we know which ads and pages actually bring customers. Legal basis: our legitimate interest in measuring the effectiveness of our own campaigns; it follows the retention period of the data it is attached to, and you can object to it (section 7). Vercel Web Analytics, when enabled, sets neither cookie nor identifier (ephemeral request hash, discarded within 24 hours). The customer area uses a session cookie strictly necessary for your login. At payment time, the Paddle checkout module is loaded at your request (when you click the purchase button) and uses the cookies needed for the checkout to work, as described in its policy.
You have the right to access, rectify, erase, restrict the processing of, object to (in particular processing based on legitimate interest) and port your data, and to withdraw your consent at any time without affecting past processing. Under French law you may also set instructions on what happens to your data after your death. To exercise these rights: one email to privacy@getscore.email — answer within one month. If you believe your rights are not respected, you can lodge a complaint with the French data protection authority, the CNIL (cnil.fr), or with the authority of your country of residence.
This policy may evolve with the service; the date at the top of the page shows the latest version. A substantial change is announced by email to monitoring customers. See also the terms of sale and the legal notice.