privacy policy
This policy explains what data does.software collects when you use the site or visit a subdomain hosted on it, what we use it for, how long we keep it and who we share it with. It applies alongside the Terms of Service.
1. who processes your data
does.software is run by [Nombre y apellidos] (tax ID [NIF]), [Calle y número, CP, Barcelona], Spain, who is the data controller for everything described here. For anything about your data write to help@does.software; reports of abuse or illegal content go to abuse@does.software. Both addresses are also our single point of contact for users and authorities under the EU Digital Services Act.
2. what data we collect
Account: your email, username and password (always as a hash, never in plain text), your language, and whether two-factor verification is on. Requests and subdomains: the name you ask for, the description, the redirect URL and path rules, the forwarding addresses you set, and the files of any static site you upload; if you request as a guest, the contact email you give us. Security: the IP address, browser (user agent) and country of your sign-up and of every login, with its date, and a device token if you tick "remember this device" on the two-factor step. Billing: if you subscribe to Starter or Pro, Stripe gives us a customer, subscription and checkout-session identifier and the payment events; we never see or store your card number. Connections: if you sign in with or connect Google, GitHub or GitLab, the identifier and email of that account and, for GitHub and GitLab, an encrypted access token used only to read the repositories you link. Mailboxes: if you create a real mailbox (Starter, Pro or edu), the messages it receives and sends are stored on our mail server until you delete them. Support and reports: the message you send us, the email you give and the IP it came from. Waiting list: the email you leave to be told when we open.
3. visitors to subdomains and QR scans
This section is for anyone who visits a *.does.software subdomain or scans one of its QR codes, even without an account. For each visit we record the IP address, browser (user agent), referring page, the requested path and, resolved locally from the IP, the approximate country and city. Mail forwarded through a subdomain is only counted per day, though our mail server keeps its ordinary delivery logs, which include sender and recipient addresses. The owner of the subdomain only sees aggregated figures: browser, operating system, device type, time of day and the domain of the referring page, never an IP address or a location. IP addresses and locations are visible only to does.software administrators, and only for administrative purposes: investigating abuse, telling bots from people, diagnosing outages and answering legal requests. We keep these visit records for 90 days, then delete them. The legal basis is our legitimate interest in running a secure service; you can object by writing to help@does.software.
4. what we use it for
We use your data to provide the service (activate and run your subdomain, forward your mail, host your site, bill your plan), to keep it secure (spot duplicate accounts or abuse from IPs, warn you when a login comes from an unknown device, log you out of other sessions if you change or recover your password), to moderate what is published (see section 6) and to communicate with you (account verification, notices about your requests, subdomains and plan, support replies, in-app notifications). We do not send marketing email and we do not profile you for advertising.
5. legal basis
We process your data because it is necessary to provide the service you asked for (contract); because we have a legitimate interest in keeping does.software secure, free of abuse and working (security logs, visit records, moderation, unknown-device warnings); because the law obliges us to keep certain records, such as invoices for tax purposes (legal obligation); and, for the waiting list and for optional connections such as Google, GitHub or GitLab, because you asked for it (consent, which you can withdraw at any time by leaving the list or disconnecting the account).
6. automated content checks
When you publish a static site we send its text and images to OpenAI's moderation service, and we check redirect targets against Google Safe Browsing. If a check scores above our threshold the publish is blocked automatically and you are told why. No account is suspended by a machine alone: suspensions are decided by a person, you are told the reason by email, and you can appeal from your panel or by writing to help@does.software, where a human reviews the case.
7. who we share it with
We share only what is strictly necessary with providers that process data on our behalf: Contabo GmbH (Germany) hosts our servers, inside the European Union; Cloudflare, Inc. (USA) manages the DNS of your subdomain and proxies the traffic to our servers, so it sees requests in transit; Stripe Payments Europe, Ltd. (Ireland) processes payments; OpenAI, L.L.C. (USA) receives the text and images of sites you publish, for moderation only; Google LLC (USA) receives redirect targets for Safe Browsing checks and, if you sign in with Google, handles that sign-in under its own terms; GitHub, Inc. and GitLab Inc. (USA) only if you connect them yourself. IP geolocation uses a MaxMind database installed on our own server; no IP is sent to MaxMind. Providers in the United States are certified under the EU-US Data Privacy Framework or bound by the European Commission's standard contractual clauses. We may hand over data to the authorities where the law requires it. We do not sell your data to anyone.
8. signing in with Google
If you use the Sign in with Google button, or connect Google to an account you already have, Google sends us a signed identity token. We read two things from it: the stable identifier of your Google account and your verified email address. We ask Google for no other permission, so we have no access to your Gmail, your Drive, your contacts, your calendar or any other Google service. We use those two values only to create your does.software account, or to recognise the one you already have when you sign in. We store them with the rest of your account data on our servers inside the European Union, for as long as your account exists. We do not sell them, hand them to data brokers, use them for advertising or profiling, or use them to develop, improve or train artificial-intelligence or machine-learning models. You can disconnect Google whenever you want from your account settings: that erases the identifier and leaves you signing in with your email and password. If you delete your account, everything goes with it. What we do with the information we receive from Google's APIs follows the Google API Services User Data Policy, including its Limited Use requirements.
9. cookies and local storage
does.software sets no cookies of its own and uses no analytics or advertising trackers, so there is no cookie banner: everything we store in your browser is needed to run the service or is a preference you chose. In localStorage we keep your session token, a random identifier for your browser, used to apply fair rate limits and to keep the free trial to one per person, your language, your theme, the 30-day trusted-device token if you asked for it, whether you have seen the onboarding, and the plan you picked before signing in; sessionStorage holds a one-time value during a Google, GitHub or GitLab sign-in. Cloudflare, which sits in front of our servers, may set purely technical cookies to tell browsers from bots. On the login page, if Google sign-in is enabled, Google's sign-in script is loaded from Google's servers, so Google sees that request. Stripe's checkout and portal, and Google's sign-in window, run on their own domains and may set their own cookies there, outside our control.
10. how long we keep it
Account and subdomain data: while your account exists. Visit records of subdomains and QR codes: 90 days. Login history (IP, browser, country): 12 months. Support messages and reports: 12 months after they are closed. Administrative audit log: 24 months. Free trial fingerprints (Your email, your browser identifier and your Google, GitHub or GitLab account, stored as an encrypted code that cannot be reversed): until 90 days after your trial ends, even if you delete your account. Web and mail server logs: up to 30 days. Invoices and payment records: as long as tax law requires, currently up to 6 years. Mailbox contents: until you delete them or the mailbox. You can delete your account yourself from your profile: we ask for a confirmation code by email and, once you confirm, you have 7 days to cancel before we permanently delete the account, your subdomains, forwards, mailboxes and hosted files. If we delete it for another reason, we keep the minimum needed to meet legal obligations or investigate abuse for a limited time, then remove it.
11. your rights
You can ask us to access your data, correct it, delete it, restrict its processing, object to it, hand it to you in a portable format, and withdraw any consent you gave, without affecting what was done before. Write to help@does.software from the address of your account and we will answer within one month. If you think we got it wrong, you can complain to the Spanish Data Protection Agency (www.aepd.es) or to the authority of the EU country where you live.
12. security
Your password and your mailbox passwords are always stored as a hash. Connections to the site, the API and our mail server are encrypted, and mail carrying sensitive links (verification, password recovery, deletion codes) travels encrypted. Access tokens of connected accounts are stored encrypted. Whenever you change your password, whether from your account or through a recovery link, we close every other open session. You can turn on two-factor verification from your account. Nobody on the team reads the contents of mailboxes; we only see storage totals.
13. minors
You must be at least 16 years old to create an account or request a subdomain. If we learn that an account belongs to someone younger, we delete it.
14. changes to this policy
We may update this policy from time to time. When we do, we change the date shown above, and if the change matters to you (new purposes, new providers receiving your data) we also email the address of your account before it takes effect.
Questions about your data? Write to help@does.software.