Privacy policy
How we handle your data
Last updated: 29 September 2026
Brand Due Diligence is run by MRXP Sàrl-S, 303 Rue de Neudorf, L-2221 Luxembourg, Luxembourg (RCS B311418), the controller of your personal data. Questions or requests: matteo@ressadigitalconsulting.com.
The short version: we collect as little as we can, we never sell it, we keep it in the EU wherever possible, and we don't use analytics cookies unless you allow them.
What we process and why
| Data | Why | Legal basis |
|---|---|---|
| The names you check, and the results | To run the checks and show your report. Names are sent to the domain registries and DNS services we query (for example Verisign, Public Interest Registry, Identity Digital, Google Registry and Cloudflare DNS), because that is how the lookup works. | Providing the service you asked for (Art. 6(1)(b) GDPR) |
| A salted hash of your IP address | To limit free checks per visitor and prevent abuse. We never store your raw IP address with a report. | Legitimate interest in security (Art. 6(1)(f)) |
| Your email, if you join the waitlist | To email you once when Full Due Diligence opens. Product news only if you ticked the separate box. | Your request (Art. 6(1)(b)); consent for news (Art. 6(1)(a)) |
| Your email and a session cookie, if you sign in | To let you access your reports. The session lasts 7 days. | Providing the service (Art. 6(1)(b)) |
| Anonymous clicks and the campaign tag in the link you followed | To learn which channels bring people and whether they want the full report. No cookies and no identifiers. | Legitimate interest (Art. 6(1)(f)) |
| Aggregated page views (Vercel Web Analytics) | Cookieless visitor counts. No individual profiles. | Legitimate interest (Art. 6(1)(f)) |
| Product analytics (PostHog) | Only if you click "Allow analytics": which steps of the site people use. No session recording. Change your choice any time with "Privacy choices" in the footer. | Consent (Art. 6(1)(a)) |
| Technical request logs | Kept briefly by our hosting provider for security and troubleshooting. | Legitimate interest (Art. 6(1)(f)) |
How long we keep it
- Reports and their evidence: deleted automatically 12 months after they're created, or sooner if you ask. Some sources' raw records are kept for less time, or not at all, because their terms require it.
- Waitlist emails: until the launch email is sent, then deleted unless you agreed to product news. Unsubscribe at any time.
- Rate-limit counters: expire within 24 hours.
- Accounts: until you ask us to delete them.
Who processes data for us
| Provider | What for | Where |
|---|---|---|
| Vercel | Hosts the website and runs the application | Functions in Frankfurt (EU); Vercel Inc. is a US company |
| Neon | Database (reports, waitlist, accounts) | Frankfurt, EU |
| Cloudflare R2 | Stores raw evidence files | EU jurisdiction |
| Redis Cloud | Short-lived counters for rate limiting | Frankfurt, EU |
| Resend | Sends sign-in and waitlist emails | Ireland, EU |
| PostHog | Product analytics, only after you allow it | EU |
| Inngest | Runs the check workflows. Receives internal IDs and status codes only: never the names you check, your email or your IP address | United States |
Where a provider is based outside the EU, transfers rely on the safeguards that provider offers, such as the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.
Cookies and local storage
- A session cookie, only if you sign in.
- Your privacy choice and colour theme, stored in your browser.
- PostHog cookies or local storage, only after you allow analytics.
Your rights
You can ask to access, correct, delete, restrict or export your data, object to processing based on legitimate interest, and withdraw consent at any time. Email matteo@ressadigitalconsulting.com; we reply within one month. You can also complain to the Luxembourg data protection authority, the CNPD (cnpd.public.lu).
What we don't do
- We don't sell or rent your data.
- We don't make automated decisions about you with legal effects.
- Our results are preliminary screening, not legal advice (see the legal notice).
Changes
If we change this policy, we update this page and the date at the top.