1. Introduction
Top-Secured takes the protection of your personal data very seriously. We process your personal data in accordance with the applicable data protection regulations, including the European General Data Protection Regulation (GDPR).
This Privacy Policy explains what data we collect, why we collect it, how it is used, and what rights you have regarding your data.
2. Data Controller
3. Data We Collect and Why
What we record depends on what you do on the site. For each case: the data, the purpose and how long we keep it.
3.1 Browsing the site
- Technical server logs (IP address, page requested, browser), for the security of the site.
- Cookies: see section 8. Google Analytics and reCAPTCHA are loaded only if you accept them.
- Audience measurement with Matomo, hosted on our own servers, without cookies and with your IP anonymised — it needs no consent and nothing is shared with third parties.
3.2 Contact and requests
- When you write to us with the contact form: your name, e-mail address, subject and message.
- When you suggest a site, ask for a re-test, contest a result or ask for the removal of a domain: the domain, your e-mail address, your name and position if given, and your message.
Requests that include an e-mail address are processed only after you confirm that address, with the link or the 6-digit code we send to it.
3.3 Weekly e-mail
When you subscribe to our weekly e-mail: your e-mail address and language, recorded only after you confirm it from the link we send you.
3.4 SMS and e-mail checks
- a log of each check: date and time, IP address, type (SMS or e-mail), verdict and your choice about being contacted again — never your e-mail address;
- the full content of the message (text, headers, links, contact details found in it), with your IP address and browser, readable only by our server, to improve detection. Your e-mail address is noted with it only if you agree to be contacted again;
- the addresses of links judged very dangerous, without their parameters (site and path only), with the first and last day they were seen and the number of reports — without IP address, e-mail or time of the check — so that later visitors are warned.
The message may contain personal data of other people (sender, recipient): do not paste passwords, card numbers or confidential documents.
Links are compared with a copy of the public URLhaus database (abuse.ch) kept on our own servers: no link from your messages is sent to anyone.
3.5 How we open the links
- A link already known as dangerous (URLhaus or our previous reports) is not opened at all.
- Otherwise our server opens it, from its own address — the site never sees yours — after removing the parameters that could identify you (e-mail address, token, random identifier). The path of the link is kept: an identifier hidden in it can still reach the site.
- Opening a link can sometimes take effect (unsubscribe, confirmation): if in doubt, remove it before pasting.
- We also look up the public WHOIS directory to know the age of the domain; this does not contact the site.
3.6 Website and server checks
The technical results of a check (domain, scores, findings) are kept, to follow how a site evolves. The IP address of the person who ran it and, if proven, their e-mail address are kept 365 days. The e-mail address is never stored in clear: it is encrypted, or replaced by a pseudonym that cannot be reversed without our key.
Internal operator reports are deleted after 365 days; they contain your e-mail address only if you agreed to be contacted again.
3.7 Proof of e-mail address and of domain ownership
- To prove your e-mail address, we send you a 6-digit code; only a fingerprint of it is kept, in your session, for 15 minutes at most.
- To prove that you control a domain, you publish a DNS TXT record; we keep your proven e-mail address, your token and the dates. Unverified requests are deleted after 30 days; verified ones are kept while the domain is followed, and your rights end when your record is removed from the DNS.
3.8 Credits and payment
Full reports use credits. Payment is handled by Stripe: we never see your card number. We keep your proven e-mail address with the number of credits bought and left.
4. Legal Bases
- Contract: providing the checks, reports and credits you ask for, and answering your requests.
- Legitimate interest: the security of the site and of our free checks, the fight against fraud and abuse, and improving detection.
- Consent: the weekly e-mail, Google Analytics and reCAPTCHA, and being contacted again after a check. You can withdraw it at any time.
- Legal obligation: when required by applicable law.
5. Retention Periods
- Server logs: retained for 12 months.
- Contact form data: retained for a maximum of 3 years after the last exchange.
- Confirmed requests (suggestion, contest, removal): 3 years after the last exchange.
- Requests never confirmed by e-mail: 30 days, then deleted.
- IP addresses used to limit abuse of our forms: 24 hours.
- Weekly e-mail: until you unsubscribe (one click in each e-mail); your address is then deleted.
- Log of SMS and e-mail checks: 365 days.
- Content of messages submitted to the checks: 30 days.
- Addresses of dangerous links (anonymous): 2 years after they were last reported.
- Website and server checks: technical results kept; IP address and e-mail (encrypted or pseudonymised) erased after 365 days.
- Operator reports: 365 days.
- Credit balance: kept while your account is used; deleted on request.
- Client data: retained for the duration of the contractual relationship plus 5 years.
Deletions run automatically every day.
6. Recipients
We do not sell, rent, or share your personal data with third parties for marketing purposes. We may share data with:
- OVHcloud (France), which hosts our servers.
- Stripe, for payments. Stripe may transfer data outside the European Union with the safeguards required by the GDPR.
- Google (Analytics and reCAPTCHA), only if you accept them in the cookie banner.
- Legal or regulatory authorities when required by law
No link or message you submit to our checks is sent to abuse.ch (URLhaus) or to any other service.
7. Data Security
Top-Secured implements appropriate technical and organizational security measures to protect your personal data against unauthorized access, loss, destruction, modification, or disclosure.
As a server security specialist, data security is at the core of our operations. All data transmissions use TLS encryption.
8. Cookies
Our website uses cookies and similar technologies to remember your language preference and improve your browsing experience.
The cookies we use:
- ts_lang: Stores your selected display language. Duration: 1 year.
- PHPSESSID: Session cookie used to maintain your session. Deleted when the browser is closed.
- ts_consent: Stores cookie-banner choices (analytics / reCAPTCHA). Duration: 30 days. Set in the browser after you choose.
We do not use advertising or third-party tracking cookies. You can disable cookies in your browser settings, but some website functionality (such as language memory) may be affected.
9. Your Rights (GDPR)
Under the GDPR and other applicable data protection laws, you have the following rights:
- Right of access: You can request a copy of the personal data we hold about you.
- Right to rectification: You can request that inaccurate or incomplete data be corrected.
- Right to erasure: You can request that we delete your personal data ("right to be forgotten").
- Right to restriction: You can request that we limit the processing of your data.
- Right to portability: You can receive your data in a structured, machine-readable format.
- Right to object: You can object to the processing of your data based on legitimate interest.
To have a message you submitted to a check deleted before the end of the 30 days, write to us with the approximate date and time of the check.
To exercise any of these rights, use our contact form, subject “personal data”: we confirm your e-mail address and answer within one month. Contact us
You also have the right to lodge a complaint with the competent supervisory authority (in France: the CNIL at www.cnil.fr).
10. Changes to This Policy
We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated date. We encourage you to review this page periodically.
11. Contact
For any question or request regarding this Privacy Policy or the processing of your personal data: