lapsePrivacy Policy
Last updated 15 October 2026
This policy explains how Ioannis Stavrou, trading as Lapsenitor, Ifestou 1, 2571 Nisou, Cyprus ("we", "us"), handles personal data when you use Lapsenitor at lapsenitor.com. We are the data controller. For any privacy question or request, email [email protected].
What we collect
- Account details: your email address, an optional separate address for alerts, a hashed password (we never see or store the password itself), when you signed up and when you confirmed your email.
- Monitored domains: the domains you add, any client group names you give them, and the results of each check, such as expiry dates, registrar, certificate issuer, DNS and SPF/DMARC records, and a history of changes and alerts sent. Domain registration data can include a registrant's details where the registry publishes them; we only keep the registrar name and expiry date.
- Billing: your plan, billing interval, renewal date and the customer and subscription IDs Stripe gives us. Your card details, billing name, address and VAT number are collected and stored by Stripe, not by us.
- Technical data: your IP address and basic request details in our hosting provider's server logs. The free checker also holds your IP address in memory for up to one hour to apply its rate limit, and does not save the domains you look up.
Why we use it, and on what legal basis
- To run your account, check your domains and send you alerts and service emails such as email confirmation and password resets: to perform our contract with you (GDPR Art. 6(1)(b)).
- To take payments, issue invoices and keep accounting and tax records: our contract with you and our legal obligations (Art. 6(1)(b) and (c)).
- To keep the Service secure, prevent abuse and fix problems, for example with logs and rate limits: our legitimate interest in a working, safe service (Art. 6(1)(f)).
- To email you about material changes to the Service, these terms or this policy: our legitimate interest and, where relevant, legal obligation.
We do not sell your data, use it for advertising, or send marketing emails without your consent.
Cookies and tracking
We set one cookie: a signed session cookie that keeps you logged in and protects forms against forgery. It is strictly necessary, so it needs no consent. We use no analytics, advertising or third-party tracking scripts, and our fonts are served from our own server, so loading a page does not contact anyone else. Stripe sets its own cookies on its checkout and billing pages, under Stripe's privacy policy.
Who processes your data for us
| Provider | What for | Data |
|---|---|---|
| Railway | Hosting the app and its Postgres database | All data above |
| Stripe | Payments, invoices, VAT | Email, billing details, payment method |
| Resend | Sending alert and account emails | Email address and email content |
Each provider acts on our instructions under a data processing agreement. Some of them are based in the United States or use US infrastructure. Those transfers are covered by the EU-US Data Privacy Framework where the provider is certified, or by the European Commission's Standard Contractual Clauses.
To run the checks, Lapsenitor sends the domain names you add, never your personal details, to public registry RDAP and WHOIS services, DNS servers and the domains' own web servers.
How long we keep it
- Account details and domains: for as long as you have an account. Removing a domain deletes it and its check history. Deleting your account deletes your account details and all your domains.
- Billing and invoice records: for as long as tax and accounting law requires, which is 6 years in the Republic of Cyprus.
- Server logs: up to 30 days.
- Database backups: up to 27 days, after which deleted data is gone from backups too.
Your rights
Under the GDPR you can ask to access, correct, delete or receive a copy of your personal data, and object to or restrict how we use it. You can change your alert address in Settings and remove domains from the dashboard yourself. You can delete your account at any time from Settings. This immediately and permanently deletes your account, monitored domains and alert history. Copies in our database backups are overwritten within 27 days. We keep billing records (invoices held by Stripe) as long as tax law requires. For anything else, email [email protected] from your account's address. We reply within one month.
You can also complain to a data protection authority, in particular the one where you live or work, or ours: the Commissioner for Personal Data Protection in Cyprus.
Security
Passwords are hashed with bcrypt, the site is served only over HTTPS, forms are protected against cross-site request forgery, and access to the database is limited to the people who run the Service. No system is perfectly secure; if a breach affects your data, we will tell you and the authority as the GDPR requires.
Children
Lapsenitor is a business tool and is not meant for anyone under 18.
Changes to this policy
We will post any update here and change the date above. If a change materially affects how we use your data, we will email account holders before it applies.