Privacy Policy
What we collect to run RiskBits Monitor, why, and your rights. We collect as little as we can.
Effective 24 October 2026
1. Who is responsible
The data controller is Ionuț-Robert Sandu, Persoană Fizică Autorizată (PFA), CUI 51596898, B-dul Bucureștii Noi 136, parter, ap. 5, Sector 1, Bucharest, Romania. Privacy questions: hello@riskbits.net.
2. What we collect
- Account: your email address and a salted hash of your password (PBKDF2) — never the password itself.
- Monitoring: the domains you add and the results of their checks (public technical data about those domains), score history, and optional extra alert addresses (Pro).
- Billing: Stripe processes payments; we receive your customer and subscription IDs, plan and payment status — never your card details.
- Security: short-lived counters of sign-in attempts to stop password guessing.
We set one strictly necessary cookie, rbm_token, to keep you signed in. No analytics, advertising or tracking cookies.
3. Why (legal basis)
To provide the Service you signed up for (contract), to secure it and prevent abuse (legitimate interest), and to keep billing records (legal obligation).
4. Who processes data for us
- Cloudflare — hosting, storage (Workers KV) and email delivery.
- Stripe — payments and invoices.
Checks query public services such as Cloudflare DNS, Cert Spotter, crt.sh and domain registries with the domain name only — never with your personal data. We do not sell or share personal data with anyone else.
5. How long we keep it
Account and monitoring data for as long as your account exists; deleted within 30 days after you delete the account (Stripe and accounting records are kept as the law requires, typically 10 years for invoices in Romania).
6. Your rights
You can access, correct, export or delete your data, object to processing and restrict it — most of it directly in Settings, the rest by email. You may also complain to the Romanian data protection authority (ANSPDCP) or the authority in your country.
7. International transfers
Cloudflare and Stripe may process data outside the EU under the European Commission's Standard Contractual Clauses and their data processing agreements.