Who we are
This notice is from Rosebud Cloud Solutions Ltd, a company registered in England and Wales, number 14500087. OuterMark is our product. Our registered office is Galloways Accounting, The Mill Building, 31-35 Chatsworth Road, Worthing, England, BN11 1LY. We are the controller of the personal information this notice describes: we decide what is collected, and why. To ask us about it, email hello@rosebudcloudsolutions.co.uk.
What we collect, and why
When you run the free check
The free check sends the domain you type to our scanner, which reads what is already public about it and keeps the result, with a link to its report. The scanner also records your address on the network, known as your IP address, to limit how many checks one visitor can run.
When you run the free check, this website keeps the domain you checked in your browser's session storage for the rest of your visit. A button you choose next can then carry it to the portal, to start a plan or get the Full Report, or into the contact form. It is never sent anywhere unless you follow a link that carries it. Your browser clears it when you close the tab.
When you ask for your free report
After a check you can leave your email address. Unless you tick "Just email me the report instead", we use it to set up your free dashboard in the portal, where you can see your findings. If you tick it, we email you your free report. We keep your address with the check, and whether you ticked the box. We do not add it to a mailing list.
When you send us a message
The contact form sends us your name, your work email address and your message, with your organisation, a topic and your domain if you give them. Web3Forms delivers it to our inbox. We use what you send to reply to you, and for nothing else.
When you use the portal
The portal keeps what your account needs to work, such as the email addresses of the people who sign in, your domains, and the scans and reports about them. A plan is paid by Direct Debit, which GoCardless collects for us. The Full Report is paid once, by GoCardless Instant Bank Pay, a payment you approve in your bank's app. If your bank cannot make one, the same single payment is collected by Direct Debit.
What this website does not collect
This website sets no cookies. It runs no advertising, analytics or tracking scripts, and loads no code from other companies. The cookies page says more.
Our lawful basis for each
The law lets us use personal information only on one of the grounds it lists, called a lawful basis. These are ours.
| What you do | Our lawful basis |
|---|---|
| Run the free check | Legitimate interests: running the check you asked for, and limiting how many checks one visitor runs, so the free check stays open to everyone. |
| Ask for your free report | Legitimate interests: giving you the results you asked for, in your free dashboard or by email, as you chose. |
| Send us a message | Legitimate interests: replying to the message you sent us. |
| Use the portal | Contract: providing the service you signed up for, and taking payment for it. |
Who else handles it
These companies handle some of it for us.
| Who | For what |
|---|---|
| Microsoft Azure | Hosting, backups, sending email |
| Microsoft | Sign-in, when you sign in with a Microsoft work account |
| Cloudflare | Sits in front of the portal and the scanner; hosts our DNS; receives the DMARC and TLS reports mailed to us (Email Routing) |
| GoCardless | Direct Debit payments, and the one-off Instant Bank Pay payment for the Full Report |
| Web3Forms | Delivers this website's contact form to our inbox |
How long we keep it
| What | Kept for |
|---|---|
| A free check run without leaving an email address, and its report link | 90 days |
| The record of your address on the network, used to limit how many checks one visitor runs | 24 hours |
| The findings of a customer's posture scans | 90 days |
| Sign-up attempts, failure reports, the original files of DMARC and TLS reports | 90 days |
| DMARC report summaries, sender evidence, posture scans, TLS reports, the audit log | 24 months |
| A deleted account's personal data | Removed at once, and gone from backups within about 7 days |
Where it is processed
OuterMark runs on Microsoft Azure in the UK South region. Backups stay in Azure. Cloudflare sits in front of it.
Your rights, and how to use them
You can ask to see the personal information we hold about you, and to have it corrected or deleted. You can ask us to restrict how we use it while a question about it is settled. You can ask for the information you gave us to use the portal in a form a computer can read, for yourself or to pass to another company. Where we rely on our legitimate interests, you can object to our using it. To do any of these, email hello@rosebudcloudsolutions.co.uk. We will reply within one month. The account holder can also delete the account from the portal.
If you are unhappy with how we have used your information, you can complain to the Information Commissioner's Office (ICO), the UK's regulator for data protection, at ico.org.uk.
Changes to this notice
If we change this notice, we will change the date at the top of this page.