Privacy policy

Data controller

The data controller is HUCENCY, a limited liability company (SARL) with share capital of €50,000, registered with the Rouen Trade and Companies Register under number 832 080 055, whose registered office is at 313, rue Edouard Delamare Deboutteville, 76160 Saint-Martin-du-Vivier, France. Its full details appear in the legal notice.

Data processed, purposes and legal bases

We process your data only for the purposes described below, each resting on a legal basis within the meaning of Article 6 of the GDPR.

Account management and authentication: account creation, sign-in and security (email address, hashed password, two-factor authentication, third-party sign-in identity where applicable).

Performance of the contract (Art. 6(1)(b))

DMARC monitoring: collection and analysis of the aggregate reports (RUA) for the domains you monitor (source IP addresses, volumes, SPF/DKIM alignment, identification of sending sources). For third-party data contained in those reports, the customer is the controller and HUCENCY acts as a processor.

Performance of the contract (Art. 6(1)(b))

AI assistant “Thomas”: processing of the content of your exchanges with the assistant to help you with DMARC remediation. The anonymous public chat is covered in a dedicated section below.

Performance of the contract (Art. 6(1)(b)) for authenticated users; legitimate interest in providing and improving the assistant (Art. 6(1)(f)) for the anonymous public chat

Transactional emails: sending messages related to the service (verification, notifications, alerts).

Performance of the contract (Art. 6(1)(b))

Billing and payment: management of subscriptions, invoices and VAT.

Legal accounting and tax obligation (Art. 6(1)(c)) and performance of the contract (Art. 6(1)(b))

Prospecting: processing of email addresses left during a public analysis or a contact request.

Legitimate interest in developing our business (Art. 6(1)(f)); consent (Art. 6(1)(a)) where you voluntarily sign up to our communications

Audience measurement: site traffic statistics (page views, derived country, device type), without cookies and without retaining your IP address.

Legitimate interest in measuring and improving our audience (Art. 6(1)(f))

Audit log and security: traceability of actions and prevention of abuse (IP address, actor's email, action performed, timestamp).

Legal security obligation (Art. 6(1)(c)) and legitimate interest in securing the service (Art. 6(1)(f))

Forensic reports (RUF): their collection is disabled by default; when enabled, it covers message excerpts that may contain sensitive data.

Performance of the contract (Art. 6(1)(b))

Account deactivation: measures taken in the event of proven abuse or fraud.

Legitimate interest in preventing fraud and abuse (Art. 6(1)(f))

Free security-testing tools: when a test (for example “WP2SHELL”) is requested on a domain you monitor, verification of domain ownership (DNS TXT token), collection of your explicit consent (timestamp and IP address kept as proof) and a non-intrusive diagnostic of the domain (no vulnerability is exploited).

Performance of a requested service (Art. 6(1)(b)), explicit consent to the test (Art. 6(1)(a)) and legitimate interest in security (Art. 6(1)(f))

Recipients and transfers outside the European Union

Your data is never sold. It is accessible to our technical providers (processors within the meaning of Article 28 of the GDPR), acting solely on our instructions and bound by a data protection agreement:

Hosting

Scaleway (France, fr-par region): hosting of the application and backups. No data is transferred outside the European Union on this basis.

Payment

Stripe (Stripe Payments Europe, Ireland): payment collection and VAT calculation. We store no card data.

Transactional emails

Microsoft: delivery of the service's emails.

Third-party sign-in (SSO)

Microsoft and Google: only if you choose to sign in with one of these accounts.

AI assistant

Anthropic: processing of the requests sent to the assistant “Thomas”. The data transmitted is minimized (no email address, no message content, no raw report) and is not used to train the models.

Some processing may involve a transfer outside the European Union: requests to the AI assistant (Anthropic, United States) and, depending on your email configuration, transactional emails (Microsoft). These transfers are governed by the European Commission's standard contractual clauses. All other processing takes place within the European Union.

Retention periods

We keep your data only for as long as is strictly necessary for each purpose:

Customer account

Until the account is deleted, which is possible at any time from your settings.

DMARC reports (RUA)

The raw report is erased as soon as it is processed; the aggregated detail is kept according to your plan: 30 days (Free), 90 days (Starter), 180 days (Pro), 365 days (Business), 730 days (Enterprise). Monthly aggregates are kept in anonymized form.

Forensic reports (RUF)

30 days, when collection is enabled.

Audit and security log

365 days for security events, 90 days for read access, 180 days for other actions.

Prospects

730 days; lifetime of the account if the prospect becomes a customer.

Anonymous public analyses

90 days.

Anonymous public chat conversations

30 days.

Audience statistics

180 days.

Unverified sign-ups

7 days.

Encrypted backups

30 days.

Free-tool test results (WP2SHELL)

365 days (point-in-time security snapshot); deleted with the account.

Proof of consent to a security test

Lifetime of the contractual relationship (evidential value); deleted when the account is deleted.

Invoices

10 years (legal accounting obligation).

Your rights

In accordance with the GDPR, you have the right of access, rectification, erasure, restriction, objection and portability regarding your personal data. Where processing is based on your consent, you may withdraw it at any time, without affecting processing already carried out.

If you have an account, you can exercise most of these rights directly from your settings (viewing, exporting your data, deleting the account). For any other request, use the contact address given below; we respond within one month.

You may also lodge a complaint with the CNIL (the French data protection authority), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr.

We do not make any automated decisions producing legal effects concerning you. The assistant “Thomas” makes recommendations, but the decisions remain yours.

Cookies

The site uses only cookies strictly necessary for its operation (session, authentication, two-factor authentication, third-party sign-in, language preference). It sets no audience-measurement cookie, and no third-party or advertising cookie; no consent banner is therefore required.

Conversations with Thomas (public analysis)

If you chat with Thomas without an account, from the public analysis, we keep the analyzed domain, your answers to Thomas's two opening questions (the tone you prefer and, if you tell us, how you heard about us) and the conversation for 30 days, then delete them automatically. A team member may review them to improve Thomas. We record neither your email address nor your IP address with these exchanges: they are tied to no account and cannot be linked back to a person (non-identifiable data within the meaning of Article 11 of the GDPR). For any question about them, write to us with the domain and the date.

Changes to this policy

This policy may change, in particular to reflect technical or regulatory developments. The date of the last update appears at the top of the page.

Contact

For any question about your personal data or to exercise your rights, contact our data officer at: dpo@hucency.com