Privacy policy

Controller

Fabien Hernoux, publisher of Expansel (see the legal notice). Contact: contact@expansel.com.

Data processed

• Account: name, email address, password (stored hashed, never in clear), display language and theme.
• Service: the sites, backlinks, crawls and domains you declare, check results and notifications.
• Billing: your plan, its dates, your customer and subscription identifiers at Polar, the history of operations (payments, plan changes, refunds) and the proof of your acceptance of the terms of sale. We never receive your card details.
• Technical: IP address and connection logs, for security purposes.
• Emails: a log of the emails sent to you (date, subject, delivery status).
• Expiry reminders (public tools, no account): the email address entered, the domain or site concerned, the language, and a non-reversible fingerprint of the request's IP address.

Purposes and legal bases

• Providing the service, sending alerts and service emails: performance of the contract.
• Billing, bookkeeping, keeping proof of acceptances: performance of the contract and legal obligation.
• Securing the service, preventing fraud and abuse: legitimate interest.
• Sending an expiry reminder requested without an account: consent, given by clicking the confirmation link and withdrawn at any time through the link in every email.

Business prospecting

We may send businesses an email presenting the service, using a business address published on their website, on the basis of our legitimate interest. Each email states the source of the address and contains an immediate unsubscribe link; unsubscribing is permanent.

Recipients and processors

• DigitalOcean: hosting of servers and database.
• Brevo (Sendinblue SAS, France): sending emails.
• Polar Software, Inc. (United States): reseller and merchant of record; it processes payment and billing data as a separate controller, under its own privacy policy.
• Verification machines operated by the publisher: they only receive page addresses and domain names to check, never any account data.
• Public registries (WHOIS, RDAP): queried about domain names, with no data about you.

No data is sold or rented.

Transfers outside the European Union

DigitalOcean and Polar are US companies. Any transfers are covered by the European Commission's standard contractual clauses or by the EU-US Data Privacy Framework.

Retention periods

• Account and service data: as long as the account exists; erased immediately upon deletion.
• Except the two following histories, which are shorter. Crawls of your sites: their figures as long as the account exists; the detailed list of addresses for 90 days, except that of the latest crawl of each site, kept as long as the account exists.
• History of availability and backlink checks: 90 days.
• Billing history: ten years (accounting obligation), including after the account is deleted, in a form detached from it.
• Technical logs: twelve months at most.
• Prospecting: three years after the last contact; an unsubscribed address is kept in a suppression list so that it is never contacted again.
• Expiry reminders: a request that is never confirmed is erased after seven days, a stopped reminder thirty days after it was stopped; an active reminder is kept until it is stopped.

Your rights

You have the right of access, rectification, erasure, restriction, objection and portability, and the right to set instructions for your data after your death. Your account lets you export your data and delete your account yourself. For any other request: contact@expansel.com. You may lodge a complaint with the French data protection authority (CNIL, cnil.fr) or the authority of your country.

Security

Encrypted connections (HTTPS), hashed passwords, strict access control to data, a content security policy on the site, and logging of billing operations.

Cookies

See the cookie policy: only cookies necessary for the service to work are used.