WaystoSecure WAYSTOSECURE

Privacy policy

Last updated: 2 November 2026

This English version is provided for convenience only. In the event of any discrepancy, the Catalan version prevails.

1. Data controller

Josep Maria Bella, sole trader, domiciled in Sabadell. Privacy contact: info@waystosecure.com.

2. What data we process and why

Account and contact data (name or company name, tax ID if you give it to us, email address, language, two-step verification): to create and manage your account, provide the contracted service and issue invoices. Legal basis: performance of the contract and legal obligations (tax and accounting).

The assets you place under monitoring (email addresses, domains) and what we find about them: to provide exactly the contracted service — checking whether they appear in data leaks or present risks, and alerting you. Legal basis: performance of the contract.

Third-party data that appears in the monitoring. The leaks we find often belong to accounts of people around you (for example, employees with an address on your domain), and email reports and lookalike domains contain third parties' IP addresses or registration data. We process them only to alert you and protect your domain, with clear-text passwords encrypted with a key that only you hold. Legal basis: the legitimate interest, yours and ours, in security (art. 6.1.f GDPR).

The contact form (name, company, email, phone, message and the IP address you write from): to reply to you. Legal basis: your consent and any pre-contractual steps you request.

The Guard form (name, company and tax ID, email, phone, the company's sector and size, the infrastructure you describe and how you would like us to contact you): to prepare the meeting and the proposal. Legal basis: the pre-contractual steps you request.

If you have the Guard, the testing authorisation and the findings about your infrastructure: to provide the service. The findings may include third-party data (for example, addresses or usernames of your employees), which we process only to prepare the report. Legal basis: performance of the contract; for third-party data, the legitimate interest in security (Art. 6.1.f GDPR).

Acceptance of the terms (which version you accepted, when, from which IP address, and the accepted text): so that we can show what you contracted. Legal basis: performance of the contract and legal obligations.

We do not use your data for third-party advertising and we do not sell it to anyone.

3. Recipients and transfers

To provide the service we work with these providers, who process data on our behalf under a contract compliant with art. 28 GDPR or act as independent controllers:

  • Hostinger International Ltd. (Cyprus): the server (in Frankfurt, Germany), its daily snapshots (in Lithuania), DNS and the sending of emails.
  • Hetzner Online GmbH (Germany): backups and logs, encrypted with a key that only we hold.
  • Stripe Payments Europe, Limited (Ireland): payments; we never see your card.
  • LeakRadar (European Union): the leak source; it receives the domains and addresses we monitor and, when you choose a password in the portal, the first five characters of a fingerprint of it, which do not reveal what it is.
  • Microsoft (Azure Key Vault, in Spain): stores the key that opens our secrets vault; it receives no personal data.
  • CrowdSec SAS (France): the collaborative intrusion detection system (see "Security logs").
  • VirusTotal (Google, USA), rdap.org and public blocklists: they receive domain names and server IP addresses, to check their reputation and registration.
  • When you order the takedown of a fake domain, we report it (the domain and the name of the impersonated brand) to safe-browsing services and to that domain's registrar and hosting provider.

Other services we use (availability monitoring, certificates) receive none of your data. Transfers outside the European Union: Stripe may access data from the United States under its safeguards; Hostinger's email sub-processors (MailChannels and Proofpoint, in the USA) may take part in sending emails; and WhatsApp, if you decide to write to us through it (see "Contact channels"). There are no other disclosures, except where required by law.

4. Contact channels

You can write to us by email, through the contact form, from the portal or, if you prefer, by WhatsApp, at the number shown in the portal. WhatsApp is a service of Meta Platforms Ireland Ltd., which processes your phone number, your profile name and message metadata under its own terms and privacy policy, and may transfer them outside the European Union. That is why we use WhatsApp only at your initiative: we will never write to you first on this channel, never send alerts, reports or any data from your account through it, and never ask you for passwords. Please do not send passwords or sensitive data through it either: that is what the portal is for. WhatsApp conversations are kept on the company device for one year and, if they lead to an action, whatever is needed is moved to the portal. Legal basis: your consent, which you give by writing to us, and performance of the contract when the enquiry concerns the service.

5. Retention and erasure

We keep your account and monitoring data for as long as the account exists, whether or not you have an active paid subscription. You can delete the account at any time from the portal ("My account › Close your account") or by writing to us at info@waystosecure.com. When you do:

  • Within 7 days we delete all the information about your exposure: alerts, leak records, monitored domains and email addresses, the status of the checks, dossiers, messages, screenshots of lookalike websites, Guard reports and the content of orders (the order record is kept for billing). During these 7 days you can ask us to stop the deletion if you change your mind or did not request it.
  • For 6 years we keep the contractual and billing data (your identification, the contract and the terms you accepted, the Guard testing authorisation, invoices and payments), as required by the Spanish Commercial Code (art. 30), the General Tax Act and the Civil Code regarding limitation periods; after that period, they are deleted.
  • For the dossiers you have issued, we keep only the record that allows them to be verified (the date, the company and tax ID shown, a summary of what they said and the file's fingerprint) until they are two years old; the PDF is deleted with everything else.
  • Backups, which are encrypted, are renewed by rotation: deleted data may remain in them for up to 44 days (30 days of retention plus the 14 days of the last weekly snapshot; the server provider's daily snapshot lasts 10 days), and they are never restored to recover data from a deleted account.
  • Security logs that record any of your actions are kept as described under "Security logs" and are not deleted with the account.

If you cancel an additional domain without closing the account, what we had found about that domain is kept for one year in case you take it out again, and deleted after the year. The same applies to an address you stop monitoring. Contact form and Guard form data is kept for one year. We keep an encrypted copy of each Guard report for as long as the Guard lasts and one year more, so that we can deliver it to you again; after that it is deleted. Email addresses you have added to monitoring are no longer processed once you remove them or the account is closed.

6. Security logs

To protect the platform, detect and investigate incidents and be able to show what happened, we keep technical logs: access to the website and the portal (IP address, page requested, date and time, browser, result; without cookies or credentials), sign-in attempts (IP address and a fingerprint of the email address), actions taken in the portal (who, what, when: for example, every time a leaked password is viewed), server logs and the decisions of our intrusion detection system. Legal basis: our legitimate interest in network and information security (art. 6.1.f GDPR; recital 49), which is also yours, and any legal obligations that may apply to us.

These logs are kept for 10 years in a storage system separate from our server, located in the European Union (Germany) and configured so that no one, not even we, can modify or delete them before the period expires, encrypted with a key held only by the owner. For website access we also keep a version with the IP address anonymised, which can no longer identify you. These logs are not deleted when you delete your account or exercise the right to erasure, because they serve to protect the platform and other users and to comply with legal obligations (art. 17.3 GDPR).

IP addresses from which attacks are detected (mass access attempts, scans) are shared with CrowdSec (CrowdSec SAS, France), a collaborative intrusion detection system, and we receive from it the list of attacking addresses detected by others. An address from which the service is used normally is never shared.

If you have a domain under monitoring and send us its DMARC and TLS reports, these reports contain the IP addresses of the servers that send email on behalf of your domain; we process them on your behalf, solely to assess your email configuration. The file received is deleted after 30 days and the data we extract from it after 13 months.

7. Your rights

You can exercise the rights of access, rectification, erasure, objection, restriction and portability, and withdraw any consent you have given, by writing to info@waystosecure.com. You can delete your account yourself from the portal ("My account › Close your account"). If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (aepd.es).

8. Security

We apply to our own platform the same measures we recommend to clients: encryption in transit, access control with two-step verification for the team, encrypted backups outside the server, logs that no one can modify or delete, and clear-text leaked passwords encrypted with a key that only you hold. It is our house principle: we do not sell anything we do not apply to ourselves.

9. Minors

The services are aimed at professionals and companies; they are not intended for minors.