Privacy Policy

01 Data Controller

02 Data processed and purpose

ORTSLAB processes only the minimum data necessary for the service to function:

• Message analysis: the text you enter in the scanner is processed in volatile memory and deleted at the end of the session. Message content is never stored.
• Aggregated statistics: the verdict, threat type, partial anonymised IP origin country and analysis mode (EML/SMS) are recorded. Never the message content or any personally identifiable data.
• Referral system: if you access via a municipal referral link, the referral slug and an anonymised IP (last three octets replaced) are recorded to count visits and analyses per municipality.
• Contact form: if you send an enquiry, the data provided (name, email, message) is used solely to respond to your request.

03 Legal basis for processing

• Legitimate interest (Art. 6.1.f GDPR): aggregated and anonymised statistics to improve the service.
• Performance of a service (Art. 6.1.b GDPR): processing the message to carry out the requested forensic analysis.
• Consent (Art. 6.1.a GDPR): contact form.

04 Cookies

ORTSLAB uses only technically necessary cookies:

• ortslab_ref: identifies the municipal referral that originated the visit. Duration: 30 days.
• ortslab-theme: stores the light/dark theme preference (localStorage, not a cookie). No expiry.
• ortslab_cookies_ok: records that you have acknowledged the cookie notice. Duration: 1 year.

No tracking cookies, third-party analytics or advertising are used.

05 Recipients and international transfers

ORTSLAB does not share personal data with third parties, except as required by law.

The service may query external APIs (VirusTotal, RDAP) for URL and domain analysis. These queries contain only the domain or URL being analysed, never the user's personal data.

No international transfers of personal data are made.

06 Retention period

• Analysed message content: not stored. Deleted at the end of the analysis.
• Aggregated statistics: retained indefinitely in anonymised form.
• Referral data: 30 days from the last recorded visit.
• Contact data: for as long as needed to handle the enquiry, and no longer than 1 year.

07 Your rights

You may exercise the following rights by contacting oscar@orts.cat:

• Access: find out what data we hold about you.
• Rectification: correct inaccurate data.
• Erasure: request deletion of your data.
• Restriction: restrict processing in certain circumstances.
• Objection: object to processing based on legitimate interest.
• Portability: receive your data in a structured format.

You also have the right to lodge a complaint with the Spanish Data Protection Authority (AEPD).