Privacy Policy

This policy explains what personal data Dokyma collects, why, who it is shared with and how long it is kept. Dokyma is operated by Gauja Labs SIA (reg. No. 40203736314), Šarlotes iela 18A - 3, Rīga, LV-1001 ("Dokyma", "we"), which is the controller of the personal data described here. Questions and requests: [email protected].

1. Data we collect

Your account

• Name, email address and a hashed password, or, if you sign in with Google, your Google account ID, name, email and profile picture.
• Two-factor authentication secrets and hashed backup codes, if you turn 2FA on.
• Email preferences, your team, your role in it and who invited you.

Security and session data

• For each signed-in session: IP address, browser user agent, device type, browser and operating system, and a device fingerprint hash.
• An audit log of security and team events (sign-ins, new devices, password and 2FA changes, member and domain changes), with the IP address and user agent involved.
• Failed sign-in counts, used to lock an account temporarily after repeated failures.

Billing

Payments are handled by Stripe. We never see or store your card details. We store the Stripe customer and subscription IDs, your plan, subscription status and billing period.

The domains you monitor

The domains you enroll, their verification status, your notification channel settings (stored encrypted) and the results of every scan.

Abuse reports you send

When you report a lookalike site to its registrar, the email names you as the reporter ("Reported by <your name and email> on behalf of <brand>"), replies go to your email address, and you and your team's owners are copied. We store the report, the recipients and your good-faith attestation.

The free brand check and email grade

If you use the free check at /check without an account, we store the brand name you check, your IP address, a random browser session ID, the page that referred you and any campaign (UTM) parameters, and your email address if you choose to give it. The email security grade stores nothing about you; results are cached per domain for one hour, and our servers record the domain and grade as a product event linked to the random browser session ID.

How you found Dokyma

When you create an account, we store how you first arrived: the referring page, any campaign (UTM) parameters including the ad keyword, a shared-scan code if you followed one and, only if you accepted cookies, the Google Ads click ID (gclid) of the ad you clicked. We use it to learn which campaigns and ads bring people who find Dokyma useful, and record it with your sign-up in our product analytics.

Advertising measurement

We advertise Dokyma on Google. If you reach us from one of our ads and accepted cookies, we may tell Google Ads that the click led to a sign-up, an activated account or a paid plan, by sending the click ID, the type and time of the conversion and, where Google supports it, a one-way hash of your email address so Google can match the conversion to the ad. Google uses this to report and optimise our campaigns. We do not let Google or anyone else use Dokyma's data to show you ads elsewhere, we do not build advertising profiles, and we do not place advertising or retargeting cookies. Without your consent, nothing is shared with Google for advertising.

Product analytics

If you accept analytics cookies, PostHog (hosted in the EU) records how you use Dokyma in your browser: page views, clicks, errors, performance, and session recordings in which everything typed into form fields is masked. When you are signed in, these events are linked to your email, name and sign-in method. If you do not accept, none of this is loaded. Separately, our servers record product events in PostHog (for example sign-up and sign-in, password resets, team and domain changes, scans, detected threats and notifications sent), linked to your account or, for the free check, to the random browser session ID.

2. Data about other people and other websites

To find sites impersonating your brand, Dokyma processes public information about third-party domains: DNS records, registration data (registrar, creation and expiry dates, name servers), TLS certificates from public Certificate Transparency logs, domain lists from registry zone files, and screenshots and page HTML of the brand's site and of lookalike sites. This information is about websites, not individuals. Where a registration record or a captured page happens to contain personal data, we use it only to assess and report impersonation, which is our legitimate interest and yours.

3. Why we use it (legal bases)

• To provide the service (performance of our contract with you): accounts, scans, alerts, abuse reports, billing.
• To keep Dokyma secure (legitimate interest): sessions, audit logs, rate limits, bot protection, lockouts, new-device alerts.
• To improve Dokyma: analytics in your browser only with your consent; server-side product events and error reports on the basis of our legitimate interest.
• To measure our advertising: storing how you found us at sign-up (referrer and campaign parameters) on the basis of our legitimate interest; the Google Ads click ID and sharing conversions with Google only with your consent.
• To meet legal obligations: tax and accounting records.

We do not sell personal data, and we do not use it to show you ads or let others do so. The only advertising use is measuring our own Google Ads campaigns, with your consent, as described above.

4. Who we share it with

We use these service providers (subprocessors), each only for the purpose listed:

For every AI request that contains your data, we instruct OpenRouter to use only model providers that do not retain or train on it. Notification destinations you set up yourself (Slack, Discord, Microsoft Teams, Telegram, webhooks) receive the alerts you route to them under those services' own terms. Abuse reports go to the registrar or abuse contact you choose. We may also disclose data if the law requires it.

Some providers are located outside the European Economic Area, including in the United States. Where that happens, transfers rely on the provider's adequacy-decision certification or Standard Contractual Clauses.

5. How long we keep it

• Account data is kept while your account exists. When you delete your account, we delete your profile and any team you own alone together with its domains and scan results, and cancel that team's subscription.
• Sessions expire after 30 days. Password-reset links expire after one hour, and email-verification and team-invitation links after seven days.
• Security audit records are kept after account deletion with the link to your account removed. They may still contain the IP address and browser details of the event.
• Screenshots and page captures are deleted when you remove the domain they belong to. Captures no longer linked to any threat are cleaned up.
• Free check records (including IP address) are kept to enforce usage limits and prevent abuse. Anonymous results stop being viewable after seven days.
• Billing records are kept as long as tax and accounting law requires.
• To enforce the one-free-scan rule, we keep a record of which domains have used their free scan even after the domain is removed.

You can ask us to delete specific data earlier; see your rights below.

6. Cookies and browser storage

Always on, because the service needs them: your sign-in token, a session ID for the free check, interface preferences and your cookie choice, all in your browser's local storage, and a Cloudflare Turnstile cookie that tells people and bots apart. So we can show that we asked, we also keep a record of each cookie choice on our servers: a random ID held in your browser, accept or reject, the banner version, the page and the time. It contains no IP address and is not linked to your account.

Only with your consent: PostHog analytics, which stores an analytics identifier in a cookie and in local storage, and the campaign, referrer and Google Ads click ID that brought you to Dokyma, kept in local storage so a later sign-up can be traced to it. Without consent, the campaign and referrer are kept only until you close or reload the page, and the click ID is never sent to us. We do not load Google's advertising tags or set advertising cookies.

You can change your choice at any time; withdrawing consent stops analytics and clears its stored identifier and any stored click ID. To stop us sharing conversions for an account you already created through an ad, email us and we will remove its click ID. Cookie settings

7. Your rights

Depending on where you live, you can ask to access, correct, delete or export your personal data, to restrict or object to how we use it, and to withdraw any consent you gave. You can delete your account yourself in your security settings. For everything else, email [email protected]; we will answer within one month. You also have the right to complain to your data protection authority.

8. Security

Data is encrypted in transit. Passwords and backup codes are stored as hashes, notification credentials are encrypted, and access to production systems is restricted. Sites we scan are visited from an isolated browser that has no access to our database or secrets.

9. Children

Dokyma is a business service and is not intended for anyone under 18.

10. Changes

We will update the date at the top of this page when this policy changes, and email account holders about material changes before they take effect.