Privacy Policy

01 Data Controller

02 What data we process and why

ORTSLAB analyses suspicious messages, offers investigation tools and generates reports. To do that, we process the following data:

• The message you analyse: the text, email or file you submit is processed on our server to analyse it. The original text of the message is not stored.
• The analysis result (90 days): the result is stored so that you can retrieve it or generate your report: verdict, score and indicators, plus the technical data the analysis detects in the message, such as the subject, the sender's name and address, the recipient's address (if it appears in the message), the origin IP address, links, phone numbers, attachment hashes and words or expressions quoted as evidence. This data may include personal data of yours or of third parties that appears in the message. Each analysis has a reference (ORTS-YYYYMMDD-XXXXXX) and a secret key that only the person who ran it receives; in our database we only store a hash of that key.
• Your account (if you identify yourself): your email address, to send you the access link and recognise you. The link can be used only once and expires after 15 minutes; for the link and for your session we only store a hash, together with a hash of your IP address. We also store your membership status (start and end dates).
• History and My Cases (members only): if you are a member, your analyses and Technical Reports are kept with no expiry date so that you can consult them in your History, and the cases you create in My Cases are saved to your account together with the results of the tools you run in them (for example, data on domains, IP addresses or phone numbers you investigate, file metadata or text extracted from images). If you import what you had previously saved in your browser, it is also moved to your account. Limit per account: 250 MB of cases and 2,000 imported history entries.
• Technical Report: if you generate one, we store your email address, the PDF (containing the analysis data and the technical checks), its SHA-256 fingerprint, the date, the amount and the version of the terms accepted, and a hash of your IP address to limit abuse. We email you a signed link to download it.
• Free-use control: we count each person's analyses and reports to apply usage limits, using your account or, if you don't identify yourself, an anonymous identifier stored in a cookie (or, without a cookie, a hash of your IP address). Each decision (use allowed, limit reached, membership started or ended) is logged with the anonymised IP address (without its last block) so that incidents can be resolved.
• Our own anti-fraud database: to detect campaigns and improve the service, we record technical data from messages rated suspicious or dangerous (sender domain, origin IP address of the message, phone numbers, country, reason for detection and message fingerprint), without your identity. If you arrive from a municipal referral link, the municipality is also recorded.
• Referral links: if you arrive from a partner's link (for example, a town council), we record the visit (referral, date, anonymised IP address without its last block and browser data) and whether you then run an analysis. The referral is also added to the usage statistics.
• Usage statistics: analysis result, type (email, SMS or image), reason for detection, domain and country of origin of the message, its anonymised origin IP address (without its last block) and your browser data (user-agent).
• Request limiting: to prevent abuse, we store your full IP address for 10 minutes at most when you analyse, and tool usage counters (per account or per IP hash) that are deleted after 2 days.
• Files you upload to the tools: they are processed on our server and are not stored; audio files for transcription are deleted within one hour at most. Only the result is kept, and only if you save it in a case in My Cases. Audio transcription is done on our own server, without sending the audio to third parties.
• Contact form: the data you provide (name, email, phone, message) is sent by email to the controller so that we can reply; it is not stored in the website's database.
• Payments (when enabled): payment is handled by Stripe; ORTSLAB never sees or stores your card details. We store Stripe's customer and subscription identifiers and the payment notifications it sends us (the details of those notifications are deleted after 90 days).

03 Legal basis for processing

• Performance of the service you request (Art. 6.1.b GDPR): analysing the message, keeping the result so you can retrieve it, managing your account and membership, saving your History and My Cases, generating the Technical Report and sending you the access and download links.
• Legitimate interest (Art. 6.1.f GDPR): statistics to improve the service, abuse prevention (usage limits and decision logging), system security and maintaining our own database to detect fraud.
• Consent (Art. 6.1.a GDPR): contact form. You can withdraw it at any time.
• Legal obligation (Art. 6.1.c GDPR): keeping the record of transactions where tax or accounting rules require it.

04 Cookies and storage in your browser

ORTSLAB only uses technical cookies that are necessary for the service to work:

• ol_sess: keeps your session if you identify yourself with your email. Duration: 30 days.
• ol_anon: an anonymous, random identifier used to count free use without you having to identify yourself. Duration: 400 days.
• ol_ah: a security cookie that only exists while you complete access with the link from the email. Duration: 30 minutes.
• ortslab_ref: identifies the referral link you arrived from, so that your analyses can be associated with it. Duration: 30 days.

In addition, your browser stores locally (localStorage, not cookies) your light/dark theme preference, that you have seen the cookie notice, your access level and the email you identify yourself with, and a usage counter. If you used earlier versions of the website, it may also keep cases and history saved in the browser at that time, until you import them into your account. That information stays on your device. No tracking cookies, third-party analytics or advertising are used.

05 Recipients and external services

We do not share personal data with third parties, except where required by law. To provide the service we use providers acting on our behalf:

• Web hosting: our hosting provider, which holds the database and the reports, and from which the access and report emails are sent.
• Technical checks (Technical Report and tools): we query external services such as RDAP/WHOIS, crt.sh, ip-api.com, Shodan, AbuseIPDB, Spamhaus, Brave Search and ScreenshotOne. They receive the domain, URL, IP address, phone number or file hash being checked, not your identity.
• Images and QR codes: if you upload an image to the tools, or if an email you analyse has images attached, the image is sent to OCR.space (text extraction) or to api.qrserver.com (QR code reading) to process it.
• Fonts: the pages load their fonts from Google Fonts, so your browser connects to Google's servers, which receive your IP address.
• Payments: Stripe, when payments are enabled.

Some of these providers are established outside the European Economic Area (for example, Google, for Google Fonts, and Shodan, in the United States). For this reason, avoid uploading images containing personal data you don't want to share.

06 Retention period

• Original text of the message: not stored.
• Analysis result: 90 days from the analysis. If you generate a Technical Report, the related analysis is kept at least as long as the PDF exists. If you are a member, your analyses don't expire: they are kept until you ask for them to be deleted.
• My Cases and imported History: for as long as you keep your account or until you ask for them to be deleted. If your membership ends, they remain available to consult, without being able to add anything new.
• Account (email and membership status): for as long as you keep your account or until you ask for it to be deleted.
• Access links: deleted one day after they expire. Sessions: deleted when they expire (30 days) or when you log out.
• Technical Report PDF: 90 days from generation; after that the file is deleted. Members' reports don't expire: they are kept until you ask for them to be deleted.
• Report record (date, reference, file fingerprint, amount, email and IP hash) and usage log (access decisions with anonymised IP): kept for as long as needed to handle claims and legal obligations, even if the PDF is no longer available.
• Anti-fraud database: for as long as the data remains useful for detecting fraud.
• Usage statistics and referral visits: kept to improve the service and to follow up each partnership, without identifying you.
• IP address for request limiting: 10 minutes at most. Tool counters: 2 days.
• Stripe payment notifications: the details are deleted after 90 days; a minimal record of the transaction is kept.

07 Security

Report PDFs are stored outside the public area of the server and can only be downloaded with a signed link. The secret key of each analysis, access links and sessions are never stored in clear: only their hash. Session cookies cannot be read by JavaScript and are only sent over an encrypted connection. Access to the database is restricted.

08 Your rights

You can exercise the following rights by writing to oscar@orts.cat. To locate your data, give the email you identify yourself with or the reference (ORTS-…) of the analysis or report:

• Access: find out what data of yours we process.
• Rectification: correct inaccurate data.
• Erasure: request the deletion of your data, including your account, your cases and your history.
• Restriction: restrict processing in certain circumstances.
• Objection: object to processing based on legitimate interest.
• Portability: receive your data in a structured format.

You can also lodge a complaint with the Spanish Data Protection Agency (AEPD).