Privacy notice

1. Who is responsible

The controller is NEXTGENWEBS, S.L. (trading as Naranjatec), VAT/CIF B97380067, Pol. Ind. Fuente del Jarro, Plaza Gerardo Salvador, Nº1, Oficinas 17-19, 46988 Paterna (Valencia), Spain. The company is entered in the Registro Mercantil de Valencia, Tomo 7615, Libro 4915, Folio 171, Sección 8ª, Hoja V-92754.

You can reach us, and send us privacy rights requests, at info@naranjatec.com or on +34 961 345 419. We have not appointed a data protection officer.

2. What data we process

We process the following data:

• Account data: your email address and your name.
• Preferences: your language and your theme (light, dark or system).
• Sign-in data: your sign-in method (email and password, Google or Microsoft) and your two-factor authentication (2FA) factors. We never see the password you enter at Google or Microsoft. If you sign in with Google or Microsoft, we receive only your name, your email address and your provider ID.
• Activity log: who changed what and when. The log records the account, the organization, the zone, the action and the values before and after. It does not store IP addresses.
• DNS zone data: the zones and records that you or your agency manage in dnspanel for your organization.

3. Why we process it, and the legal basis

We use your data only for these purposes:

• To provide the service and let you sign in and manage DNS zones. Legal basis: performance of the contract (Article 6(1)(b) GDPR).
• To keep the service secure and to keep an activity log of DNS changes. Legal basis: our legitimate interest in security and accountability (Article 6(1)(f) GDPR).
• To send transactional emails, such as invitations and sign-in links. Legal basis: performance of the contract.
• To meet legal duties, such as tax and accounting rules. Legal basis: legal obligation (Article 6(1)(c) GDPR).

4. Who receives your data

We use these service providers (processors) to run dnspanel:

• Supabase: database and sign-in. Location: EU, Frankfurt (Germany).
• Vercel: hosting. Location: EU, Frankfurt (region fra1).
• Resend: transactional email. Location: EU, Ireland.
• ClouDNS: the DNS provider that hosts and serves your zones. dnspanel sends your DNS zone data to ClouDNS, which processes it as DNS provider.
• Google and Microsoft: only if you choose to sign in with them. They then process your sign-in under their own privacy notices.

5. How long we keep it

We keep your account data and the activity log while your account is active. We delete them after your account is closed.

We keep some data longer only where legal limitation periods require it.

6. Your rights

Under the GDPR you have the right to:

• access your data;
• have incorrect data corrected;
• have your data erased;
• restrict how we process it;
• receive your data in a portable format;
• object to processing based on our legitimate interest.

7. Complaints

To use a right, write to info@naranjatec.com or call +34 961 345 419. You can also complain to a supervisory authority. In Spain this is the Agencia Española de Protección de Datos (AEPD), www.aepd.es.

8. Cookies

dnspanel uses only strictly necessary cookies. We do not use advertising or analytics cookies, so we show no cookie banner.

• Session cookies from our sign-in provider (Supabase): keep you signed in.
• locale: remembers your language. It lasts one year.
• sidebar_state: remembers whether the side menu is open. It lasts seven days.
• Your theme choice is saved in your browser storage (localStorage), not in a cookie.

9. How we protect your data

We use these measures:

• Two-factor authentication (2FA) for accounts.
• Encryption in transit (HTTPS).
• Row-level security (RLS) in the database, so each user sees only the organizations they belong to.
• Stored provider credentials are encrypted.

10. Changes to this notice

We may update this notice. The date at the top shows the latest version.