Updated 11 October 2026 · Informação em português · Terms of service
The operator of Renewatch (https://renewatch.com) is the controller of the personal data described here. Operator identification is shown below when supplied; the project name alone is not a complete legal identification. Questions, or any request about your data: alerts@renewatch.com.
Operator identification has not yet been provided. Paid subscriptions are not available during launch preparation. This notice does not replace the identification required by law.
What a domain check observes — expiry dates, nameservers, mail records, certificates — is public information read from the registry and the DNS. A domain can identify a person, and your watch list links those domain names to your account. Shared snapshots and alert deduplication records are stored separately from the account; records for domains no longer watched are removed by scheduled cleanup.
Only cookies the service cannot work without, which is why there is no consent banner — none of them track you, and EU law (ePrivacy art. 5(3)) requires consent only for cookies beyond these:
These companies receive data to run the service: Cloudflare (hosting, the database, and the routing of mail sent to us), Resend (delivers the alert emails), Stripe (payments), and — only when you choose to sign in with them — Google or Microsoft (identity). Their roles depend on the processing: hosting and email delivery are covered by applicable processing agreements, while payment and identity providers also process information for their own purposes. Transfers outside the EEA require an applicable safeguard, such as an adequacy decision covering the recipient and processing or standard contractual clauses. A US provider is not automatically covered by the EU–US Data Privacy Framework. See Cloudflare's DPA, Resend's DPA and Stripe's privacy notice.
Every day, each domain you watch is looked up where the facts are public: at its registry (over RDAP, or over WHOIS for the few registries that have no RDAP), in public DNS through Cloudflare's resolver, and at the domain's own server for its TLS certificate. Those lookups carry the domain's name and nothing about you. When you run a check on an unregistered domain, its name (never yours) is sent to the registry's RDAP service and to Porkbun's public price API.
Running the account, the watches and the alerts is performance of our contract with you (GDPR art. 6(1)(b)). Abuse limits — the sign-in IP, rate limiting — are our legitimate interest in keeping the service available (art. 6(1)(f)). Billing records are retained by Stripe under their legal obligations.
You can access, correct, export or erase your data, object to processing, and complain to your supervisory authority. Erasure needs no request: the account page has a delete button that removes the account, its watches and its sign-in code from the active database, and stops any paid subscription with it. Shared domain observations and alert records have a separate cleanup; providers, logs, backups, tax records and information needed to resolve a dispute can have different retention periods. Deletion from the application does not automatically erase a provider's legally retained records. For anything else, write to alerts@renewatch.com and it is handled by a person. We respond within one month; where the GDPR permits an extension, we explain it within that initial month. You may also request restriction or portability where applicable and complain to CNPD or your local supervisory authority. No automated decision-making with legal or similarly significant effects is used.
