Privacy policy

• Your account: e-mail address, the name on your sign-in account, and your organization's name. We need them to sign you in, for your organization's membership, and as the default recipients of alerts. The legal basis is the performance of a contract.
• Domains: the domain names you add and the public DNS records (SPF, DKIM, DMARC, MX) we query.
• DMARC aggregate reports: the reports mailbox providers (for example Google, Microsoft and Yahoo) send to our mailbox about your domain. They hold the IP addresses of servers sending as the domain, message counts and SPF, DKIM and DMARC results; they hold no message content and no recipient addresses. We keep the detail for 30, 180 or 730 days depending on your plan, and daily totals until we delete them at your request or with your account.
• Alerts: the e-mail addresses of the alert recipients you set, and a delivery log (when an alert was sent, and to whom, with the alert's subject and text).
• Microsoft SNDS: the report link you enter, stored encrypted.

Everything without a period stated above (your account, domains, alert recipients and the delivery log, the SNDS link) is kept while the account exists and deleted within 30 days of a deletion request. The legal basis for all of this processing is the performance of a contract.

If you connect a Google account with Google Postmaster Tools, Reputo accesses Google data with the scopes openid, email, https://www.googleapis.com/auth/postmaster.domain and https://www.googleapis.com/auth/postmaster.traffic.readonly.

• What we read: the connected account's e-mail address (to name the connection), the account's list of domains in Postmaster Tools and their verification state, and, for the domains you monitor with us, the daily rates (user-reported spam, DMARC authentication success, delivery errors, inbound TLS) and Google's sender-requirement verdicts.
• Why: to show them in your domain's Gmail section, to judge the delivery and reputation dimensions, and to open incidents and send the alerts you set up. Nothing else.
• Adding a domain: at your request we add one of your monitored domains to your Postmaster Tools account and ask Google to verify it, using a TXT record that you publish; we change nothing else in your Google account.
• Storage: the connection's tokens are stored encrypted, and the rates and verdicts we read are stored in our database; both on servers in the EU (Hetzner, Nuremberg, Germany). Alert texts that contain them are kept in the delivery log.
• Sharing: we do not share Google data with third parties, do not sell it, and do not use it for advertising or to train artificial intelligence models. Our staff look at it only when needed to fix a problem you reported, or when the law requires it. Google-derived values in an alert go only to the alert recipients you set, through our e-mail provider, and to no one else.
• Deletion: when you disconnect, we delete the connection's credentials and ask Google to revoke the grant. Daily rates and requirement verdicts already stored belong to the domain and are deleted at your request or with your account. You can also revoke access at any time in your Google account's settings.

The statement above is Google's required disclosure; it applies to all data Reputo receives from Google APIs.

• Hetzner Online GmbH, Germany: server hosting.
• Neoserv, Slovenia: e-mail (sending alerts and the DMARC report mailbox).

Sign-in runs on Keycloak, which we operate ourselves on the same servers.

The app's own code sets no cookies and keeps no data in browser storage. The sign-in library briefly keeps a record of the sign-in state while you sign in, and removes it when you return from signing in. The sign-in server sets only the cookies it needs to sign you in and keep your session. This website uses no cookies and no analytics.

You have the right of access, rectification, erasure, restriction, portability and objection. Send your request to hello@gostly.si; we reply and act within 30 days. We delete an account within 30 days of the request.

You can lodge a complaint with the Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana (www.ip-rs.si).

We update the date at the top with every change, and tell users of material changes by e-mail.