Privacy policy

Controller

Henrique Medeiros, DomainRadar

c/o Ricardo Moura

Täfernstrasse 26

5405 Baden-Dättwil

Switzerland

Email: info@domainradar.ch

Contact for data protection: Henrique Medeiros

Scope and principle

This policy applies to the website domainradar.ch, the trial and your customer account in the DomainRadar application. The website is an information page: it uses no analytics tools, sets no cookies and loads no fonts, scripts or content from third parties. The visitor statistics are an exception (section “Visitor statistics”). One exception is described in the section “Google ads (measuring trial sign-ups)”: if you reach the website through one of our Google ads, we use the click identifier that Google adds to the address to measure whether the ad led to a confirmed trial sign-up. You can enter data in the free domain check on the home page and when signing up for the free trial at testphase.domainradar.ch; what happens to it is described in the sections “Free domain check” and “Signing up for the free trial”. We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP) and, where it applies to visits from the EU, the General Data Protection Regulation (GDPR).

Cookies and browser storage

This website sets no cookies and stores nothing in your browser (no localStorage, no sessionStorage). For the language choice on the home page, only the language your browser sends anyway (Accept-Language) is evaluated, once, for the redirect; it is not stored. That is why no cookie banner is needed.

Server logs at the hosting provider

When you visit the website, the web server automatically records technical data: IP address, date and time, requested address, referrer, browser identifier (user agent) and status code. This is necessary for secure operation (troubleshooting, defending against attacks). Under the GDPR, the legal basis is our legitimate interest in secure operation (Art. 6 para. 1 lit. f GDPR).

The website is hosted by Infomaniak Network SA in Geneva. Infomaniak processes this data as a processor in data centres in Switzerland.

Server logs are deleted after 10 days. They are not combined with other data and not used to build profiles.

Free domain check

When you check a domain on our website, your browser sends this domain to our checking service. We only query public DNS records of the domain and do not download any content from it. The domain is only part of the request body, not of the requested address. If you also enter a DKIM selector, we use it only for this one query.

To prevent abuse, we store your IP address only as a checksum with a key that changes daily; after one day at the latest it can no longer be linked to an address and is deleted. Likewise, we keep the checked domain only as such a checksum in memory, to limit repeated checks of the same domain. We do not store the result; the domain and the selector appear in no log. We only count how many checks succeeded or were rejected – without IP address, cookies or domain.

Link to the result: if you open a link to our domain check that contains a domain after the # sign, this part is not sent to any server. The domain only appears in the check field; the check starts only when you click. We store nothing for this.

Under the GDPR, the legal basis is the check you request or our legitimate interest in preventing abuse (Art. 6 para. 1 lit. b and f GDPR).

Result as a PDF by email

After the domain check, you can have the result sent to you as a PDF by email. The form opens on our website; your browser sends your details directly to our service at testphase.domainradar.ch. We process your email address, the checked domain, the selected language, the time of your consents and, after sending, the grade of the result. Under the GDPR, the legal basis is your consent (Art. 6 para. 1 lit. a GDPR).

If the domain of your email address matches the checked domain (the same domain or a parent domain), we send the PDF right away. Otherwise we first send a confirmation link (double opt-in), valid for 24 hours and stored only as a checksum; unconfirmed requests are deleted after 24 hours. Every email contains a link to stop further emails and have your details deleted immediately.

After sending, we keep the email address, domain, language, grade and your consents for 6 months to be able to prove the request and – only if you ticked the optional box – to contact you about email security. We then delete them automatically. You can withdraw your consent to be contacted at any time, by email to info@domainradar.ch or via the link in our email. We do not pass these details on to third parties.

So that nobody floods an address with requests, we keep the email address for up to 7 days only as a checksum with a separate key, and for 6 months after you stop further emails so that no more emails are sent; we keep daily counters without personal reference for 30 days. Abuse protection as for the trial: a small computing task instead of a captcha service and the IP address only in memory, for at most 1 hour. We send the emails via Microsoft 365 (Microsoft as processor, data located in Switzerland).

Visitor statistics

We measure page views and events such as sign-ups with Growbot, without cookies and without storing the IP address. Visitors are only recognised anonymously within a single day.

Free PHP check

When you check a website on the “Check PHP version” page, your browser sends the domain to our check service. It then fetches at most 14 public addresses of that website (for example the home page, robots.txt and, for WordPress, the descriptions of linked plugins), just like a normal visitor, and only evaluates the responses. The domain is only in the body of the request, not in the address called.

We only process the domain and IP address transiently in memory: to prevent abuse, we count requests per IP address and per checked domain only as a checksum with a random key that changes when the service restarts. The result is kept in memory for at most 10 minutes, stored under a checksum of the domain. We do not write the domain, the IP address or the result to logs or a database.

Only check websites you own or are authorised to check. The legal basis under the GDPR is the check you request or our legitimate interest in preventing abuse (Art. 6(1)(b) and (f) GDPR).

Contact by email

If you email us (for example via “Request a demo”), we process your details (company, name, email address, optional phone number, content) to answer your request. The pre-filled text only asks for what is necessary; you decide what you send. Legal basis under the GDPR: steps prior to entering into a contract (Art. 6 para. 1 lit. b GDPR) or our legitimate interest in answering enquiries (Art. 6 para. 1 lit. f GDPR).

We delete the details when they are no longer needed for that purpose and no statutory retention obligation applies.

We receive and send emails via Microsoft 365 (Microsoft as our processor, data location Switzerland).

Booking an appointment

After the domain check you can arrange an appointment with us via “Book a free initial call”. The button opens the Microsoft Bookings page in our Microsoft 365 account (Microsoft as our processor); our website does not pass anything on, not even the checked domain. What you enter there (name, email address, optional phone number and topic) we process to hold the appointment. Legal basis under the GDPR: steps prior to entering into a contract (Art. 6 para. 1 lit. b GDPR).

We delete the details when they are no longer needed for that purpose and no statutory retention obligation applies. Microsoft’s privacy information also applies to the booking page itself.

Signing up for the free trial

If you sign up for the 14-day trial at testphase.domainradar.ch, we process the details in the form: company name, optional UID, business address, first and last name of the contact person, work email address, up to five domains and the chosen language, plus the time and version of your acceptance of the terms and the privacy policy. If you came through a Google ad, we also store the click identifier (section “Google ads (measuring trial sign-ups)”). The purpose is to set up the trial, check your domains and send you the results by email. Legal basis under the GDPR: pre-contractual measures (Art. 6(1)(b) GDPR).

Email confirmation (double opt-in): we send a link to the address given; the trial is only set up after you click it. The link is valid for 24 hours and stored only as a hash. We delete unconfirmed sign-ups after 24 hours, and confirmed ones not yet set up after 48 hours. After set-up, your details are carried over into your customer account (see terms); from the sign-up itself we remove names and address immediately and delete the rest after 90 days. To prevent multiple sign-ups, we keep the email address and domains for up to 90 days, only as a hash.

Company and address search: for the company search we keep a copy of the public commercial register (Zefix, open government data of the Swiss Confederation) on our own server. It contains company name, UID, legal form and registered address, so for sole proprietorships also names of natural persons. We use it only as an input aid and replace it completely every week. Your company search terms are processed only on our server; we do not store them and do not pass them to the federal administration. Only if you enter a UID that is not yet in our copy do we look up that UID in the commercial register (Zefix/LINDAS). For the address search our server sends the search term to geo.admin.ch. Your IP address is not passed on. We keep address search results in memory for at most 10 minutes.

Protection against abuse: instead of a captcha service, your browser solves a small calculation that our own server issues and checks; no third-party services are included. The sign-up page sets no cookies and stores nothing in your browser. To limit the number of requests, our server keeps your IP address (for IPv6 only the network range) in memory only and for at most 1 hour after your last request; it is stored neither in the database nor in logs. Our operating logs contain only numbers and fixed event words, never your input.

We send the emails for the trial via Microsoft 365 (Microsoft as our processor, data location Switzerland).

Notice if a trial was already used

If one of the domains signed up already had a trial in the last 90 days, we do not set up a new one. The page shown after submitting is the same as for every sign-up. If all domains signed up belong to the domain of your email address, we instead send you a short email with this notice, at most one per address and day. For this purpose only, we store your email address and the chosen language and delete them when sending, at the latest after 24 hours; in our backups they remain until these expire (at the latest after 30 days).

Google ads (measuring trial sign-ups)

We run ads on Google. If you click one of them, Google adds a click identifier to the address of our website (parameter gclid, gbraid or wbraid). Our own script on the website reads this identifier, removes it from the address bar immediately and keeps it only on the open page. It sets no cookie, stores nothing in your browser and sends nothing to Google. If you move to another page of domainradar.ch or to the sign-up at testphase.domainradar.ch, the script passes the identifier on only in the part of the link after “#”; this part is not sent to our servers.

If you sign up for the trial, we store the identifier with your sign-up. Only when you confirm the sign-up via the link in our email do we keep the identifier separately, together only with the time rounded up to the full hour and a random number – without name, email address, company or any reference to your sign-up – and remove it from the sign-up. Google retrieves these records once a day from our server and matches them to the ad click that Google itself recorded. We delete unconfirmed sign-ups, including the identifier, after 24 hours (section “Signing up for the free trial”). We delete the separately kept records after 90 days at the latest.

The recipient is Google (Google Ireland Limited, Ireland, and Google LLC, USA). Google also processes the data in the USA. Google LLC is certified under the EU-US Data Privacy Framework and the Swiss-US Data Privacy Framework; for companies certified in this way, the Swiss Federal Council and the European Commission recognise adequate data protection. Where these frameworks do not apply, standard contractual clauses apply. What Google otherwise does with the data is governed by Google’s privacy policy.

The purpose is to measure whether our ads lead to trial sign-ups, so that we spend the advertising budget sensibly. Under the GDPR, the legal basis is our legitimate interest in this measurement (Art. 6 para. 1 lit. f GDPR); under the FADP, this section informs you about the processing and the disclosure abroad. Because the identifier is in the address on the first visit, it also appears in the server logs at the hosting provider; these are deleted after 10 days (section “Server logs at the hosting provider”).

Objection: open our website without the link from the ad, for example by typing domainradar.ch directly – then nothing is passed on. If you do not confirm a sign-up, we delete it together with the identifier after 24 hours; nothing is then passed to Google. After confirmation, the separately kept record contains nothing that would let us attribute it to you; it is deleted after 90 days at the latest. For questions: info@domainradar.ch (subject “Privacy”).

Customer account and application

For your customer account in the DomainRadar application, we process as controller: names and business email addresses of users, the details from signing in via Microsoft Entra ID (name, email address, identifiers of the account and the organisation; we never receive passwords), a log of sign-ins and changes, and contract and billing details. The purpose is to perform the contract, operate the application securely and invoice. Legal basis under the GDPR: contract (Art. 6(1)(b) GDPR) and our legitimate interest in secure operation (Art. 6(1)(f) GDPR).

The only recipients are our processors: Infomaniak (servers and database) and Microsoft 365 (emails), both with data location Switzerland, and bexio for accounting and invoices (section “Invoices, accounting and internal customer management”).

Retention: after the contract ends, the account remains read-only for 30 days; 30 days after the contract ends we delete the data (details in the terms). We keep invoices for 10 years (Art. 958f CO).

As the customer, you are responsible for the personal data in the DMARC reports and the other data of your domains; DomainRadar processes them as a processor under the data processing agreement (DPA).

Invoices, accounting and internal customer management

For accounting and invoicing we use bexio (bexio AG, Rapperswil, Switzerland) as our processor. There we keep your company as a contact with billing address, billing email address, contact person and, if provided, phone number and UID. We create quotes and invoices in bexio and send them to you by email via bexio. In DomainRadar we store the number of your bexio contact and the payment status of your invoices (only as a word, for example “open” or “paid”).

For customer care we also run our own internal customer management system (CRM). It runs on a computer of the owner in Switzerland, is not publicly accessible and only the owner has access. For each customer, the CRM retrieves from DomainRadar the company name, the subscription and its status, the domains, the date of the next invoice and the bexio contact number, in order to manage customers, subscriptions and invoices. From bexio it takes the number, date, due date, amount, status and reminder level of quotes, orders and invoices. This is processing by ourselves; the data is not disclosed to any third party.

The CRM can assign emails and appointments that we exchange with you via our Microsoft 365 mailbox to your company. For this it reads only the sender, recipients, subject and date, never the content of an email. We delete entries that have not been assigned after 30 days (appointments 30 days after they end), and assigned entries after 2 years at the latest.

The purpose is to perform the contract, issue invoices, keep our accounts and look after you as a customer. Legal basis under the GDPR: contract (Art. 6(1)(b) GDPR), our legal obligation to keep accounts (Art. 6(1)(c) GDPR) and our legitimate interest in customer care (Art. 6(1)(f) GDPR). We keep invoices and accounting records for 10 years (Art. 958f CO); we delete the other data once it is no longer needed for these purposes.

Disclosure and transfers abroad

We do not sell personal data and do not pass it on to third parties for their own purposes. The exception is the click identifier from Google ads, which Google receives (section “Google ads (measuring trial sign-ups)”). The providers that process data on our behalf (processors) are listed on the “Sub-processors” page: Infomaniak for the website, servers and database, Microsoft 365 for emails – both process the data in Switzerland – and bexio (bexio AG, Rapperswil, Switzerland) for accounting and invoices; according to bexio, its servers are located in Switzerland. Only this click identifier is disclosed abroad (USA); the basis for this is set out in the section mentioned. For visitors from the EU: the European Commission recognises Switzerland as providing adequate data protection.

The servers, database and receipt of DMARC reports of the DomainRadar application are operated by Infomaniak Network SA in data centres in Switzerland. Customers receive a data processing agreement (DPA) on request.

For businesses only

DomainRadar is aimed at companies and organisations, not at children or young people. We do not knowingly process data of persons under 16.

Your rights: access, correction, deletion

You can at any time request access to your data, its correction or deletion, the restriction of processing and a copy in a common format; you can also object to the processing.

How: write to info@domainradar.ch with the subject “Privacy”. We reply within 30 days, free of charge. We only ask for proof of identity if we cannot otherwise identify you reliably.

You also have the right to lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC); people in the EU also with the supervisory authority of their country.

Reporting a security vulnerability or data breach

Have you found a security vulnerability or do you suspect that data has fallen into the wrong hands? Please write to info@domainradar.ch immediately with the subject “Security”. Contact details for security reports are also available in machine-readable form at domainradar.ch/.well-known/security.txt.

We examine every report without delay, contain the incident and assess the risk. If a breach of data security is likely to result in a high risk for the persons concerned, we report it to the FDPIC as soon as possible (Art. 24 FADP) and – where the GDPR applies – to the competent supervisory authority within 72 hours (Art. 33 GDPR). We inform the persons concerned where this is necessary for their protection.

Where we process data on behalf of our customers, we inform the affected customers as soon as possible so that they can meet their own obligations.

Changes

We update this policy when the website changes. The version published here applies. Last updated: 28.10.2026.