Privacy Policy

BrandsDefender is operated by Manatee Media LTD, registered at 160 Robinson Road, #14-04, Singapore Business Federation Center, Singapore 068914 (202133354G). For the purposes of the EU and UK General Data Protection Regulation (GDPR), we are the controller of the personal data described in this policy.

Account data

When you create an account we collect your email address and password (stored only as a secure hash). If you add billing details we also store your name, company name, address, country, phone number and VAT number.

Domain data

The domains you add, the results of our daily checks against security vendors and email spam blacklists, the delisting cases you open, the evidence you provide for those cases, and our correspondence with you about them.

Free checker reports

Our free blacklist checkers can be used without an email. When you enter your email address to see a full report, we create a BrandsDefender account for that address (or use your existing one) so the report can be stored and opened again. For this we keep your email address, the domain you checked and the check result. You can also unlock a report by signing in with Google, in which case Google shares your name and email address with us.

Payment data

Payments are handled by Stripe. We never see or store your full card number. We receive and keep payment status, amounts, invoice details and a Stripe customer reference.

Contact requests

When you use our contact form we collect your name, email address, the domain you mention and your message.

Usage data

With Google Analytics we collect information about how visitors use the website, such as pages viewed, approximate location, device and browser type. See Cookies and analytics.

Referral data

If you arrive through an affiliate or friend referral link, we store the referral code in your browser for up to 60 days so the referral can be credited when you sign up.

Domain names and their reputation are public information. To check a domain, we send the domain name to public reputation sources and security vendor services (for example VirusTotal) and query email spam blacklists. We do not scan the private content of your website, mailboxes or servers.

When you open a delisting case, we submit your domain and the evidence needed to the security vendor or blacklist operator involved. Those organisations process that information under their own privacy policies.

A domain name can be personal data when it identifies an individual, for example a personal name domain. We treat all domain data with the same care as other personal data.

• To provide the service (monitoring, alerts, delisting cases, your client portal): performance of our contract with you.
• To take payments and keep accounting records: performance of contract and legal obligation.
• To answer contact requests: our legitimate interest in responding to enquiries, or steps you asked us to take before entering a contract.
• To send service emails such as alerts, case updates and invoices: performance of contract.
• To deliver a free checker report you asked for, including the access code and report email: steps you asked us to take. We send follow-up tips about your result only if you tick the box to receive them, and every tip includes a link to unsubscribe.
• To understand and improve the website with analytics and error reports: your consent, which you give or refuse in the cookie banner and can withdraw at any time.
• To prevent fraud and abuse and protect our systems: legitimate interest.

Card and other payment details are entered directly into Stripe's secure checkout and are processed by Stripe, Inc. and its affiliates. Stripe may use this data to process the payment, prevent fraud and meet its legal obligations. Stripe's handling of your data is described in the Stripe Privacy Policy.

When you first visit the website we ask for your cookie choice. Until you choose, and if you choose Reject all, we use Google Consent Mode v2 with every storage type set to denied: Google Analytics and Google advertising cookies are not set, and Google only receives cookieless signals that cannot be used to recognise you.

If you choose Accept all, we allow two kinds of storage and turn on error reporting:

• Analytics storage: Google Analytics 4 sets first-party cookies (such as _ga and _ga_*) that can last up to two years, so we can measure which pages are visited and how people find us. Google Analytics 4 does not log or store full IP addresses.
• Advertising storage: Google may set cookies to measure whether our ads led to a visit. We do not allow ad personalisation or sharing of user data for advertising.
• Error reporting: when a page breaks, Sentry receives a technical report with the error, the page address without any search or link parameters, your browser and device type, and the steps in the app just before the error. It sets no cookies and we do not send your name, email address or IP address with these reports. This also runs inside the client portal so we can fix problems there.

We remember your choice in your browser and keep a record of it (the choice, the date, the version of this notice and a random identifier for your browser, plus your account if you are signed in) so we can show what you agreed to. You can change your choice at any time with Cookie settings in the footer of every page. Rejecting after accepting removes the Google Analytics cookies we can reach from this website and stops error reporting.

Google Analytics never loads on private pages, such as the client portal, the admin area, sign-in links, information requests and email verification, whatever you chose.

We also use your browser's local storage, which works like a cookie, for things the site needs to function. These do not need your consent:

• keeping you signed in to the client portal;
• remembering your cookie choice;
• remembering a referral code for up to 60 days.

You can also block or delete cookies and local storage in your browser settings, and you can opt out of Google Analytics on all websites with the Google Analytics opt-out browser add-on. Blocking local storage will sign you out of the portal and the banner will ask for your choice again.

We share personal data only with service providers that help us run BrandsDefender, under contracts that limit their use of it:

• Supabase: database, authentication and server functions.
• Stripe: payments and invoicing.
• Resend: delivery of service emails.
• Google: website analytics and ad measurement, only if you accept cookies.
• Sentry: error reports that help us fix problems on the website, only if you accept cookies.
• VirusTotal and other reputation services: domain checks (domain names only).
• Security vendors and blacklist operators: only when you open a case for that vendor or list.
• Netlify: hosting of the public website.

We may also disclose data when required by law or to protect our rights. We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

Our company is based in Singapore and our providers may process data in other countries, including the United States. When personal data from the EU, EEA or UK is transferred to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (and the UK addendum) or another lawful transfer mechanism.

• Account and domain data: for as long as your account is active, and deleted within 30 days after you close your account.
• Case records and evidence: for the life of your account, so we can handle re-flags and questions about past cases.
• Invoices and payment records: for as long as tax and accounting law requires (in Singapore, currently five years).
• Contact requests that do not lead to an account: 12 months.
• Free checker reports: the full check result is deleted from our servers after 24 hours unless you save it to your account. Report access codes are deleted after one day. The record of your email, the domain and the result is deleted after 12 months. The account created for your report stays until you ask us to close it, and reports you saved to it are kept for the life of the account.
• Analytics data: kept in Google Analytics for no longer than 14 months, the longest period Google Analytics allows.

EU, EEA and UK

You have the right to access, correct, delete or export your personal data, to restrict or object to processing, and to withdraw consent at any time. You can also complain to your local data protection authority.

United States

Depending on your state (for example California, Colorado, Connecticut, Virginia), you may have the right to know what personal information we hold, to access, correct or delete it, and to opt out of its sale or sharing. We do not sell or share personal information. We will not discriminate against you for exercising these rights.

Singapore

Under the Personal Data Protection Act you may request access to and correction of your personal data.

We respond to verified requests within one month (GDPR) or 45 days (US state laws). We may ask you to confirm your identity before acting on a request.

Data is encrypted in transit, access to client data is limited to staff who need it to handle your cases, and database access rules ensure each client can see only their own account. No system is perfectly secure, but we will notify you and the relevant authorities of a personal data breach where the law requires it.

BrandsDefender is a business service and is not intended for anyone under 16. We do not knowingly collect personal data from children.

We may update this policy when our service or the law changes. We will post the new version on this page and change the date at the top. For significant changes we will also notify account holders by email.

To exercise your rights or ask a question about your data, email contact@brandsdefender.com with the subject line “Data request”, or write to Manatee Media LTD, 160 Robinson Road, #14-04, Singapore Business Federation Center, Singapore 068914. You can also use our contact page.