How we handle your data

Version 1.0, 12 September 2026.

Who is responsible

Upstream Consulting bv, Schoolgatweg 2, 1501 Buizingen (Halle), Belgium, company number BE 0648.724.221. Questions: .

What we keep and why

• your email address and password (stored encrypted), to run your account and alert you;
• the domain names you add, to produce the reports;
• the reports and history, for as long as the account exists or the plan provides;
• your language, notification settings and your phone number if you want alerts by SMS;
• for a paid plan: company name, address and VAT number, for invoicing;
• the time of registration and confirmation, as proof of consent;
• your IP address at registration and sign-in, solely to prevent abuse.

The examination of your domain

A report is built from public sources: DNS, registration data, publicly issued certificates, reputation sources and what the web server itself answers. We do not log in and try no passwords. Active tests run only on a domain whose ownership you have confirmed.

You may only add domains you are responsible for or have a legitimate interest in.

What we measure about a domain. What we measure are public facts about infrastructure: which nameservers are declared, whether a certificate is valid, what a mail policy allows. That is about technology, not about people, and we build no profiles from it. Sometimes such a public source does contain a personal detail, for example a contact address in a registration or a name in a certificate. We use that only for the report of the domain it belongs to. We do not combine measurements across customers, we do not enrich them with other sources and we do not sell them. We do not work out who is behind a domain and we do not record it. Based on what we store, we therefore cannot link a domain to a person ourselves.

On what basis

The contract with you (art. 6.1.b GDPR) for delivering and invoicing the service; our legitimate interest (art. 6.1.f) for security and abuse prevention; your consent (art. 6.1.a) for messages not needed for the service, withdrawable from your account.

For how long

As long as your account exists. If you end it, we anonymise or pseudonymise your data and reports within thirty days: whatever refers to you as a person is removed or replaced by a code, so that nothing can be linked to you any more. What we are legally required to keep, such as invoices and the accounting data belonging to them, is kept for seven years. A registration never confirmed is erased after thirty days. IP addresses are kept for seven days.

Who else sees it

• our own infrastructure in a Belgian data centre, running the website, the customer portal and mail, and holding your account data and reports;
• the measurement points that run the checks, at European hosting providers in several countries. They receive only the domain name being measured, no account data;
• Cloudflare, for the check on the registration, sign-in and contact pages that verifies you are not a robot (Turnstile). That check processes your IP address and technical characteristics of your browser, solely to make that decision; it builds no profile and does not track you across websites. Cloudflare is certified under the EU-US Data Privacy Framework and applies the European standard contractual clauses;
• Mollie, as payment provider when you choose a paid plan: Mollie processes your payment data as an independent controller; we store no card or account numbers ourselves and only see that a payment succeeded;
• SMSBOX (Jaan), the Belgian service through which we send SMS alerts, only if you enable them: SMSBOX then receives your phone number and the text of the message, on our behalf.

Your data is not resold. It is stored in the European Union; only Cloudflare's anti-bot check may be processed outside the European Economic Area, under the safeguards above. We have a data processing agreement with every processor.

Cookies

No tracking cookies. For visitor statistics we use Matomo on our own server, cookieless and with an anonymised IP address. We do not track individuals and pass nothing to third parties. Details on the cookie page.

Your rights

Everything we hold about you is visible in your account, apart from the technical anti-abuse logs, which disappear after seven days. Viewing, correcting and ending your account you do there yourself. For a copy of your data in a common format, to object to a processing, or if something cannot be done from your account, one message to is enough. You may complain to the Belgian Data Protection Authority, Rue de la Presse 35, 1000 Brussels, dataprotectionauthority.be.