Privacy Policy
Last updated: 3 October 2026
Who the controller is
The controller of the data described in this policy is Magma-T, Unipessoal Lda, trading as DeltaCoders, with Portuguese tax number 509780342. For any question about personal data, including exercising the rights set out below, write to the contact address in this site's footer.
What we collect on this site
When you complete the proposal request form we collect the company name, your name, your email address, whatever message you write and the language of the page you sent it from. The form is processed by the Buteo application at app.buteo.pt, under the same controller and on the same hosting in the European Union as the rest of the product, and these details are used only to answer your proposal request. With your permission we also collect site usage data through Google Analytics, described in the Cookie Policy. If you refuse that permission, no analytics tag is loaded and no usage data is collected. The same applies, with your permission given on each address, to the application, without account identifiers, as described in the same policy.
What the product processes
Buteo audits what a domain publishes on the internet. The data a scan collects is DNS records, server responses, certificates, headers and addressing information, which is technical information about infrastructure rather than about people. Some of those records can nevertheless contain personal data, typically an email address in a contact record or a person's name in a certificate. We process that data solely to produce the audit the customer asked for, on a domain whose ownership they have proven.
What an account involves
An account in the product involves processing an email address, a name, a password stored as a cryptographic hash, a preferred language, and a record of sessions and of actions relevant for audit purposes. If you subscribe to a paid plan, payment details are handled directly by the payment provider and do not pass through our systems. To invoice, we also process the billing details you give (legal name, tax number, address, billing email addresses and purchase order reference) and, for businesses in another Member State, the result of checking the VAT number in the European Commission's VIES system. Invoices are issued through InvoiceXpress.
The basis for processing
The contact form rests on pre-contractual steps taken at your request. Delivery of the audit service rests on performance of the contract. Site analytics rests on your consent, which you can withdraw at any time through the cookie preferences link in the footer. Retention of audit and billing records rests on legal obligation and on the legitimate interest in detecting and responding to abuse of the service.
How long we keep it
Proposal requests are kept for the duration of the commercial relationship and, where no contract follows, for up to three years after the last contact. Scan history is kept for the period the customer's plan provides, which ranges from thirty days to two years. Account audit records are kept for one year. Billing documents are kept for the period Portuguese tax law requires.
Who we share it with
We use subprocessors for hosting, DNS, payments, email delivery and site analytics. Data is processed within the European Union wherever the provider allows it. Stripe, Google and Amazon Web Services may transfer it to the United States under the EU-US Data Privacy Framework and the standard contractual clauses approved by the European Commission, and SMTP2GO processes it in New Zealand, which is covered by a Commission adequacy decision. The full list, with each one's purpose, is published below. We do not sell personal data and do not release it for advertising purposes. To audit what surrounds a domain, the Enterprise checks send the providers listed below only what each one needs: Whoxy receives the registrant name or email published for the domain, ViewDNS the domain's own nameservers, GitHub the domain and its project's keywords, and Atlassian (Bitbucket) candidate workspace names. Each of these checks is on by default, and an owner or administrator of the organization can switch it off in the product's settings, after which nothing is sent to that provider.
Processors
Hosting: Hetzner Online. DNS: Amazon Web Services (Route 53). Email delivery: SMTP2GO. Payments: Stripe. Invoicing: InvoiceXpress. Site analytics, only with your consent: Google. Ownership and perimeter checks: Whoxy (reverse WHOIS), ViewDNS (reverse DNS), GitHub (public code search) and Atlassian (Bitbucket workspace lookup). VAT numbers of other Member States are checked in the European Commission's VIES system.
Your rights
You may request access to your data, its rectification, its erasure, restriction of processing and portability, and you may object to processing that rests on legitimate interest. Where processing rests on consent you may withdraw it at any time, without affecting the lawfulness of processing carried out before. We answer any such request within one month. If you believe your rights have not been respected you may complain to the Comissão Nacional de Protecção de Dados.
Security
Each organisation's data is isolated at the database level rather than by an application filter. Passwords are stored as cryptographic hashes. Configuration secrets are encrypted at rest. Administrative access is logged. Communication with the site and the application is over TLS only.
Magma-T, Unipessoal Lda · VAT 509780342 ·support@buteo.pt
Rua Major João Luís de Moura, Piso 1, Esc. AE · 1685-253 Famões · Portugal