Privacy

Last updated: 10 October 2026

1. Controller

Andrii Boiarynov, Lindemannstr. 6a, 44137 Dortmund, Germany
Email for data-protection requests: privacy@tenantzero.eu

2. Hosting and server logs

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA, which also provides the visitor statistics described in section 4. Pages and the domain check run in Vercel’s Frankfurt (Germany) region. When you visit the site, Vercel processes technical data needed to deliver it and keep it secure, such as your IP address, the requested URL, the time of the request and your browser’s user agent, and keeps these in short-lived logs.

Legal basis: Art. 6 (1) (f) GDPR, our legitimate interest in operating a secure and reliable website. Vercel is certified under the EU-US Data Privacy Framework; transfers to the USA are additionally covered by standard contractual clauses in Vercel’s data processing agreement.

3. The free domain check

When you run a check, the domain name you enter is sent to our server. It first asks whether the name is registered: through the registry’s public RDAP service (the server for each ending is taken from a public list published by IANA), or through DNS where a registry has no such service. If the name is taken, we do the same for a few similar names to suggest free alternatives. For registered domains the server then looks up the public DNS records, requests the MTA-STS policy over HTTPS, and queries Cloudflare’s public DNS resolver (Cloudflare, Inc., USA) to test DNSSEC. It also reads the website the way a search engine does: the homepage (with and without www, over http and https), robots.txt, the sitemap, the site icon and the link-preview image, and it checks the website’s security settings: the response headers, whether outdated encryption (TLS 1.0/1.1) is still accepted, the published security contact (security.txt) and the domain’s CAA record. These requests identify themselves as “TenantzeroCheck”. Only public information is read. We need no access to your systems, and we never reserve or register a name you check.

We don’t store the domains you check or their results in a database. The domain appears in the page address and therefore in the short-lived server logs described above. Legal basis: Art. 6 (1) (f) GDPR, our legitimate interest in offering the check you requested.

The security self-check at /secure runs entirely in your browser. Your answers are not stored or sent to us; only if you choose to email us does your email program include the score and the gaps you picked.

4. No cookies; anonymous visitor statistics

This website sets no cookies and uses no advertising or cross-site tracking tools. Fonts are served from our own host, so your browser makes no requests to third-party font services.

To see which pages are used, we use Vercel Web Analytics, provided by Vercel Inc. (see section 2). It works without cookies and stores nothing on your device. When a page loads, it records the page address, the referring page, your country and the type of browser, operating system and device. Visits are told apart only by a hash of the request that changes every day, so you can’t be recognised across days or across websites, and the data is only shown to us in aggregate. Before anything is sent, we remove query parameters from the address and replace any domain you checked with a placeholder. We also count three actions: starting a domain check, sending the setup questionnaire and finishing the security self-check. We record only where the check was started, which package was recommended, or the self-check score band (0–39, 40–69 or 70–100), never the domain or your answers.

Legal basis: Art. 6 (1) (f) GDPR, our legitimate interest in understanding how the site is used so we can improve it.

You can exclude this browser from Web Analytics with the buttons below, or by opening any page with ?analytics=off at the end of the address; ?analytics=on removes the choice again. We also send nothing if your browser has Global Privacy Control switched on. Your choice is kept only in this browser’s local storage, is never sent to us or to Vercel, and is reset if you clear site data or use another browser or device. Storing it is necessary for the function you asked for (§ 25 (2) no. 2 TDDDG).

5. Setup questionnaire

If you fill in the questionnaire at /start, we receive your company and contact details and your answers about your domain, team, devices, website and timeline. If you list colleagues, we also receive their names and roles. We use this only to prepare a quote and, if you accept it, to carry out the work. Legal basis: Art. 6 (1) (b) GDPR (pre-contractual measures). Please only list colleagues who know you are sharing their details with us, and never include passwords.

While you fill it in, your answers are saved only in your own browser (local storage) so a reload doesn’t lose them. They are removed automatically once they reach us; if you send them through your own email program instead, they stay in your browser until you clear its site data. When you send the questionnaire, the answers are emailed to us through our Microsoft 365 account (Microsoft Ireland Operations Ltd., data stored within the EU) and are not stored on the website server. If automatic sending isn’t available, your own email program opens instead and nothing reaches us until you send that email.

6. Contacting us

If you email us (for example at start@tenantzero.eu or ask@tenantzero.eu) or call us, we process the details you send in order to answer and, where relevant, to prepare a quote. If you use “Get a fixed quote” on a check result, the checked domain and its score are carried over into the setup questionnaire (section 5); nothing reaches us until you send it. Legal basis: Art. 6 (1) (b) GDPR (pre-contractual measures) and Art. 6 (1) (f) GDPR (answering enquiries).

7. How long we keep data

• Server logs are kept by Vercel for a short period for security and troubleshooting, in line with Vercel’s log retention (days, at most 30 days).
• Visitor statistics are held by Vercel only in aggregated form and remain available to us for Vercel’s reporting window (up to 12 months). They contain no profiles of individual visitors.
• Domain checks are not stored by us at all (section 3).
• Questionnaire answers and emails are kept as long as needed to prepare a quote and answer your questions. If no engagement follows, we delete them within six months of our last contact. If you engage us, we keep what is needed to deliver and document the work, and business letters and invoices for the periods required by commercial and tax law (§ 257 HGB, § 147 AO: generally six or eight years).
• In your browser, a questionnaire draft and your analytics choice stay until you clear this site’s data. We can’t see or delete them.

8. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). To exercise them, write to privacy@tenantzero.eu. We answer within one month.

9. Supervisory authority

You have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2-4, 40213 Düsseldorf, Germany.

10. Data protection officer

We have not appointed a data protection officer. The thresholds in § 38 BDSG, in particular at least twenty people permanently engaged in automated processing of personal data, are not met. For any privacy question, write to privacy@tenantzero.eu.