Privacy Policy

Last updated: Oct 09, 2026 · Contact: support@domainstabilizer.com · Privacy: security@domainstabilizer.com

Thanks for trusting Domain Stabilizer (“we”, “us” or the “Provider”). This Policy explains how we collect, use and protect your data when you use our sites and the Domain Stabilizer app.

By using the Service, you agree to this Policy. If you disagree, please do not use the Service.

1) Scope and definitions

Service: the Domain Stabilizer software, its APIs, sites and related content.

Customer/User: the person or entity creating an account or using the Service. Personal data: any information that identifies or can identify a person.

Merchant of Record: Paddle (Paddle.com Market Ltd / Paddle Payments Ltd) handles billing and calculates/remits taxes where applicable.

Important: Domain Stabilizer does not send emails from your domains, does not manipulate your DNS and does not act as an email or DNS provider. The only messages it sends for you are the reports and notices to the client contacts you add (see 6.1). We provide diagnostics, alerts and "recipes" (instructions) for you to implement changes.

2) Data we collect

2.1. Data you provide

Account: name, email, language, and limited billing details you enter. You sign in with a one-time code sent to your email; if you turn on two-factor authentication, we store the secret of your authenticator app in encrypted form and your recovery codes as one-way hashes. Service operation: domains you add, policies and preferences (e.g., alert rules), internal notes. Your organization: your company name, your agency branding (name and logo), and the team members you invite (their email and role). Client records: the names of your clients and the commercial notes and details you choose to record about them. Feedback: what you send us through the feedback forms, with your email if you provide it. Client contacts: the name and email of the contacts of your own clients that you add, their profile, their language and their notification preferences. Problem reports: when you report a problem, your description, an image if you attach one, and a technical record of that session (the screen you were on and your most recent requests to the Service, without their content). Payment data (such as card details) is processed directly by Paddle. We do not store your full card number.

2.2. Data generated through use of the Service

Technical metadata: results from DNS/DMARC/SPF/DKIM checks, SSL certificates (issuer, expiry), uptime status, DNS change events, and SPF lookup counts — the technical output of the diagnostics you run. Operational telemetry: we record product events (for example, when an analysis runs or continuous stabilization is turned on for a domain) and, at a low sample rate, client-side error reports, to keep the Service working and diagnose problems. Error reports are truncated and stripped of internal file paths before storage. This telemetry is sent to our own servers — we do not use third-party analytics and we do not follow you on other sites. Visits to the public site: we record the steps of a visit (for example, that a free diagnosis was started or that the sign-up page was opened) under a temporary identifier that exists only while the tab is open, together with the campaign in the link you arrived from, including the click identifier an advertising platform adds to that link. This uses no cookies and stores nothing on your device, it does not record your IP address or the domain you analyze, and it is not shared with third parties. If you create an account, that campaign is recorded with the account. These records are deleted after a limited period (currently 180 days). Logs: IP address, user agent, timestamps and status codes, retained for security and support. For client contacts who access the portal, we record when they sign in and what they open, with their IP address and browser stored only as hashes. Sign-in history: when and from which browser you signed in, and the devices you choose to keep on your list. Public diagnosis: the domain you enter and its results, without requiring an account. Emails to client contacts: if you turn it on in your account, the reports and alerts sent to a client contact include an open indicator (a small image), so that you can see in that contact’s access history whether a message was opened. It is off until you turn it on.

2.3. Third‑party data

DMARC RUA (optional): if you enable aggregate report (RUA) processing, we will process that data to show trends and recommendations. Providers: we may receive information necessary to operate (e.g., hosting, payment gateway or transactional email).

3) What we use data for (legal bases)

We use data to: - provide, maintain and improve the Service; - offer support and maintain security; - manage billing, fraud prevention and tax obligations; - send you the messages the Service requires (sign-in codes, billing and trial notices, alerts and reports); if we ever send product news, it will always carry an opt-out. Our legal bases include performance of contract, legitimate interests, legal compliance, and consent where applicable.

4) Cookies and similar technologies

We use only strictly necessary cookies — for session management and security. We do not use advertising, analytics, or behavioral-tracking cookies, so no cookie-consent banner is required. Some features require these essential cookies to function. We also use your browser’s local storage for interface preferences (such as language and the last workspace you opened). If you choose to keep a device on your list when signing in, a cookie identifies that device for 30 days.

5) Retention

We retain personal data only as long as necessary: Account: while active and for a reasonable additional period after closure. Continuous stabilization and analysis history: retained so you can review and compare past work while your account is active. Security and sign-in logs: typically 30 days to 12 months. Public diagnosis results: typically 30 days. Purchase records: retained as required by tax law (via Paddle). Client contacts: retained as part of your account while it is active. Portal access records and problem reports: typically 12 months.

6) Sharing and recipients

We do not sell your data. We may share data with: Paddle for billing and taxes as Merchant of Record; sub-processors under safeguards (hosting, transactional email, and storage/backup); authorities when required by law; and in business transfers (merger, acquisition or similar) with appropriate protections. We may publish aggregated, anonymized metrics without identifying you.

6.1. Client contacts

When you add contacts of your own clients, you decide what data is added and what those persons receive; we process that data on your behalf to provide the Service: giving them access to the portal and sending them the reports and notices you have enabled. We do not use it for our own purposes. Each report or notice carries a link with which that person can stop receiving them on their own; that decision is theirs and you cannot reverse it. Other requests from those persons regarding their data should be addressed to you; if we receive one directly, we will pass it on to you.

7) International transfers

We operate with infrastructure and providers that may be outside your country. When transferring data, we apply appropriate safeguards (such as standard contractual clauses, contractual protections, and technical/organizational measures).

8) Security

We apply reasonable measures: in-transit encryption, access controls, auditing, environment separation and backups. If you discover a vulnerability, contact us at security@domainstabilizer.com. No method of transmission or storage is 100% secure, but we work to minimize risks with technical and organizational measures.

9) Your rights

Depending on your jurisdiction (EU/EEA – GDPR, UK-GDPR, Brazil – LGPD, California – CCPA/CPRA), you may have rights to access, rectify, erase, restrict, object, request data portability, withdraw consent and not be subject to automated decisions without human intervention (we do not perform sensitive profiling). To exercise these rights, contact us at security@domainstabilizer.com. You can also export all the data of your account from its Security page.

10) Minors

The Service is not directed to individuals under 18. We do not knowingly collect data from minors. If you believe a minor provided data, contact us to remove it.

11) Retention of communications

We may retain support emails, account change audit trails, and digest/alert preferences as needed for operations and legal purposes.

12) Changes to this Policy

We may update this Policy. We will publish the current version with its date. If the change is material, we will notify you through reasonable means (account email or in-app banner). Continued use of the Service implies acceptance.

13) Contact and controller

Data controller: Maikel Pérez Martínez (sole proprietor, RUC 1756396337001), operating as “Domain Stabilizer”, Quito, Ecuador.

Support: support@domainstabilizer.com

Privacy & data requests: security@domainstabilizer.com

Security/vulnerabilities: security@domainstabilizer.com

If you are in the EU/EEA/UK and wish to route inquiries through a representative or external DPO, contact us to coordinate (we will provide details when applicable).

14) Related documents

Terms of Service: /legal/terms · Refund Policy: /legal/refund · Security Policy: /legal/security

Note about Paddle (Merchant of Record): payments are processed by Paddle, who acts as Merchant of Record and calculates/remits taxes where applicable (VAT/GST, etc.). Paddle processes your payment data as an independent controller under its own privacy policy.

Language. This policy is published in English, Spanish, and Portuguese. If there is any discrepancy between versions, the English version prevails.