This page is published in French and in English; both versions have the same value.
This page names the controller of the personal data processed through isMalicious and the providers that process it on our behalf, with their country and their role. It is the list our data processing agreement refers to.
01Controller
The controller is Jean-Vincent QUILICHINI, an entrepreneur individuel (EI, a sole trader) under French law trading as isMalicious, 15 Jardins de SOLIVI, 20117 Eccica-Suarella, France. Contact: contact@ismalicious.com. When a customer uses the Services to process personal data for its own purposes, that customer is the controller of that data and isMalicious acts as its processor.
02Subprocessors
These providers process personal data on our behalf, under contract, only for the purpose shown.
Hetzner Online GmbH
Germany
- Purpose
- Hosting of the website, the API, the databases and their backups · Processing in the European Union
- Personal data
- All data processed by the Services
Stripe Payments Europe, Ltd.
Ireland
- Purpose
- Payments, subscriptions and invoices
- Personal data
- Billing name, email and address, VAT number, payment details entered on Stripe’s page
Resend, Inc.
United States
- Purpose
- Delivery of account, alert and product emails · Processing in the United States
- Personal data
- Email address, name, message content
Functional Software, Inc. (Sentry)
United States
- Purpose
- Error and performance monitoring, with a replay of a sample of sessions · Processing in the United States
- Personal data
- IP address, browser, pages and interactions, account identifier and email address
Cloudflare, Inc.
United States
- Purpose
- Bot protection (Turnstile) on the sign-up and contact forms
- Personal data
- IP address, browser signals
Google LLC
United States
- Purpose
- Audience and ad-conversion measurement (Google Analytics 4, Google Ads), subject to your cookie choice
- Personal data
- Cookie identifiers, pages visited, IP address; a hashed email address if you consent to conversion measurement
Crisp IM SAS
France
- Purpose
- Support chat
- Personal data
- Messages you send, IP address, browser
OpenAI, L.L.C.
United States
- Purpose
- AI-assisted features, when you ask for one (summaries, case notes, analysis) · Processing in the United States
- Personal data
- The content submitted to those features
Sublime Security, Inc. (EmailRep)
United States
- Purpose
- Reputation of an email address you check (email checks) · Processing in the United States
- Personal data
- The email address being checked
Superlative Enterprises Pty Ltd (Have I Been Pwned)
Australia
- Purpose
- Data breaches in which an email address you check appears (email checks, when enabled)
- Personal data
- The email address being checked
Twilio Inc.
United States
- Purpose
- Carrier and line type of a phone number you check (phone checks, when enabled) · Processing in the United States
- Personal data
- The phone number being checked
IPQualityScore LLC
United States
- Purpose
- Fraud risk of a phone number you check (phone checks, when enabled) · Processing in the United States
- Personal data
- The phone number being checked
03Sign-in providers
If you choose to sign in with one of these providers, it sends us your profile (name, email address, account identifier) and remains the controller of the account you hold with it: Google, GitHub, and Facebook (Meta). LinkedIn is not a sign-in option: it is used to confirm the identity of some free sign-ups.
04Sources queried during a lookup
To answer a lookup, the Services query public intelligence and network services with the indicator being checked: certificate transparency logs, WHOIS and RDAP registries, DNS resolvers, IP geolocation and reputation services. They receive the indicator, never your account details, and act under their own terms. An email address or a phone number is personal data: the email and phone checks send it only to the providers listed for those checks in section 2, as our subprocessors.
05Changes
We update this page before a new subprocessor starts processing personal data. Customers who have accepted our data processing agreement are told by email at least thirty days in advance and may object, as that agreement provides.