1. Data controller
Necrotix Lab, operator of Necrotix Lab at https://necrotixlab.com, is responsible for the processing described in this policy.
Location: Bulgaria. Privacy contact: nikolastoyanov96@gmail.com.
2. Data the site may process
- Contact enquiries: name, email address, reason, subject and message content.
- Requested technical services: when you explicitly create a Web Health service request, the site stores your name, email, optional company/project, target website or domain, selected audit findings, the limited audit snapshot attached to the request, automated estimate, optional budget/access/CMS context, notes and subsequent service status or quote information. Ordinary Web Health scans are not stored by this workflow.
- Blog comments: public display name, comment text and an optional private email address.
- Engagement: pseudonymous visitor identifiers used to remember Blog and Gallery likes, plus aggregate view counts.
- Traffic analytics: country code, coarse city where available, broad device class, hourly visit/page-view aggregates, live traffic-session state and retained public-page activity. Page-activity rows can contain the public pathname, hashed traffic-session reference, country, city, device class and recent IP/network context such as IP version, ASN, ISP, organisation and network domain. Query strings and URL fragments are removed before page activity is stored. IP/network context is short-lived and is not kept for the full page-history retention period.
- Technical and security data: IP address and request metadata used temporarily for rate limiting, abuse prevention and service security.
- AI assistant: the messages you choose to send, the conversation context required to answer them and short-lived technical data used for rate limiting.
- Preferences and browser storage: language, theme, first-visit/loading state, session view markers, chat history and short-lived first-party session identifiers.
- Administrative accounts: account identity and authentication information for authorised site administrators and editors.
3. Purposes and legal bases
Responding to enquiries
Contact-form information is used only to receive, assess and respond to the message. Depending on the enquiry, the legal basis is taking steps at your request before entering into an agreement (Article 6(1)(b) GDPR) or the legitimate interest in handling correspondence and enquiries (Article 6(1)(f)).
Technical service requests and estimates
When you choose Request a professional fix, the selected findings and contact details are stored so the requested work can be reviewed, scoped, quoted and, if accepted, delivered. The automated price range is only preliminary decision support and is reviewed before any final quote. The legal basis is taking steps at your request before entering into a service agreement and, after acceptance, performance of that agreement (Article 6(1)(b) GDPR). Related administrative records may also be processed where necessary for legitimate operational or legal-claims interests (Article 6(1)(f)).
Comments and community interaction
Comment data is processed to publish and moderate discussion around publications. The legal basis is the legitimate interest in operating an interactive publication and preventing misuse (Article 6(1)(f)). The optional email address is not displayed publicly.
Likes and aggregate views
Pseudonymous identifiers and session markers are used to provide requested Like functionality, avoid duplicate interactions and maintain aggregate engagement counts. These identifiers are not intended to identify you by name.
Operational error reporting
The site records limited technical failures to diagnose broken pages, image loading and unsuccessful requests. Records contain the error category, a redacted route family, HTTP status when available, error code, timestamp and repeat count. Browser reports are unverified and are ignored when Do Not Track is enabled. Form values, cookies, query strings, raw IP addresses and full error messages are not stored in this log. Records remain available to authorised administrators for seven days and can be cleared manually. A/B testing has been retired and no new experiment events are collected.
Short-retention traffic analytics
NecrotixLab measures visits, current public pages, traffic trends, countries, coarse cities and broad device classes to understand which content and navigation visitors find useful and to identify operational or security patterns. Hosting/CDN country and city headers are preferred. When a public client IP can be read from trusted forwarding headers, the server may send it to ipwho.is to resolve country, coarse city and network-provider context such as ASN, ISP, organisation and network domain. Latitude, longitude and other precise coordinates are not stored. Recent IP/network context is available to authorised administrators for up to about 24 hours and is then cleared while non-IP page activity may remain for up to about 30 days. Authorised administrators can export the same access-controlled, retention-bounded activity fields for analysis; the export does not extend server retention. The public page-view tracker ignores tracking when the browser sends the Do Not Track signal. The legal basis relied on for this limited measurement is the legitimate interest in maintaining, securing and improving the site with bounded retention and data minimisation (Article 6(1)(f)).
AI assistant
Messages are processed to provide the assistant response you requested. The current implementation may route them to the AI provider configured by the site administrator, which can include OpenAI, Groq, Google Gemini or a compatible custom provider. Do not submit passwords, financial information, health information or other sensitive personal data to the assistant.
Security and abuse prevention
Short-lived IP-based rate limits and technical checks protect forms and APIs from automated abuse. The legal basis is the legitimate interest in securing the website and its users (Article 6(1)(f)).
4. Recipients and service providers
Personal data is not sold. It may be processed by service providers only where necessary to operate the site, including hosting/infrastructure providers, the configured email provider for contact and service-request notifications, and the configured AI provider when you use the assistant.
When you submit a WHOIS/IP Lookup, the queried public IP (or the first address resolved for a domain) is sent to ipwho.is for estimated network location and provider information. Coordinates are returned for the map and are not persisted. The map loads tiles from OpenStreetMap, which receives your browser IP and tile requests. After a successful lookup, IPv4/IPv6 connectivity tests contact ipify directly from your browser. Device type, operating system and browser estimates are calculated locally and are not sent by the tool. Domain lookups automatically fetch public homepage HTML and headers from our server and request up to five standard paths without submitting credentials. URL Scam Check runs locally; its optional external Google Safe Browsing link sends the hostname only when you click it.
Hosting or proxy infrastructure may provide country-level and coarse city request headers used by the first-party traffic analytics layer. The server may send a public client IP address to ipwho.is to resolve a country code, coarse city, ASN, ISP, organisation and network domain. NecrotixLab does not store latitude, longitude or other precise coordinates returned by a geolocation provider. Raw IP and associated network context remain only for the 24-hour IP-retention window and are not retained for the full page-activity or country/device aggregate retention period.
Gallery pages may contain media hosted by services such as YouTube, Vimeo, TikTok, Instagram, Facebook, X/Twitter, Pinterest or Dailymotion. External media is treated separately because loading it can disclose technical information such as your IP address and browser details to that provider. See the Cookie Policy.
5. International transfers
Some infrastructure, email, AI, IP-location lookup or embedded-media providers may process data outside the European Economic Area. Where GDPR requires a transfer mechanism, the relevant provider/controller arrangement should use an applicable safeguard such as an adequacy decision or standard contractual clauses. Provider-specific terms and privacy notices also apply to their independent processing.
6. Retention
- Contact-form submissions are sent by email and are not stored in the website database by the contact API. Correspondence is retained only for as long as reasonably necessary for the enquiry, ongoing relationship, security or legal claims.
- Web Health scans are not stored unless you explicitly create a service request. Service-request records are retained while the request is being reviewed or fulfilled and afterwards only as reasonably necessary for customer support, contractual/accounting administration, security or legal claims. Data that is no longer necessary should be deleted or minimised.
- Contact-form IP rate-limit entries are held in server memory for about 10 minutes.
- AI rate-limit entries are short-lived, about one minute. The site does not persist submitted assistant messages in its database in the current implementation; the browser keeps the visible chat history for the current session.
- A/B variant assignment and the random experiment-session identifier are first-party session cookies. Deduplicated experiment-session rows are intended to be retained for up to about 31 days and contain only experiment ID, hashed session reference, variant, event and timestamp. Aggregate experiment counters may be retained for longitudinal comparison and do not contain the session hash or a named visitor identifier.
- Live traffic-session records, including current public path, coarse city and raw client IP where available, are intended to be removed after about 24 hours of inactivity. A new analytics visit is counted after about 30 minutes of inactivity.
- Retained page-activity rows can remain for up to about 30 days and contain the public pathname, hashed traffic-session reference, country, coarse city and broad device class. Raw IP, ASN, ISP, organisation and network-domain values in those rows are cleared after about 24 hours, so older page history remains available without the IP/network context. Country/device aggregates are also removed after about 30 days. Automated cleanup is claimed at most once every six hours and runs on the next page-view request.
- Comments remain until removed by moderation, deletion of the related publication or a valid erasure request, subject to applicable legal exceptions.
- Like identifiers remain until the Like is removed or the related content is deleted. The corresponding first-party Like cookie currently has a maximum lifetime of two years.
- Preference and session storage periods are described in the Cookie Policy.
7. Your GDPR rights
Subject to the conditions in the GDPR, you may request access to your personal data, correction, erasure, restriction of processing, data portability where applicable, and you may object to processing based on legitimate interests. Where processing is based on consent, you may withdraw that consent without affecting processing that was lawful before withdrawal.
Requests can be submitted through nikolastoyanov96@gmail.com. Enough information may be requested to verify that the data relates to you before a request is fulfilled.
8. Complaints
You may lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP / КЗЛД) or another competent supervisory authority. CPDP contact information and complaint procedures are available at cpdp.bg.
9. Automated decisions and profiling
NecrotixLab does not use the website data described here to make decisions about visitors that produce legal or similarly significant effects. Web Health price ranges are automated preliminary estimates only and do not accept or reject a customer, create a binding price or replace manual review. A/B variants are randomly assigned for interface comparison, and experiment statistics are used only as aggregate product-improvement decision support. Traffic analytics is used for site measurement, content/navigation analysis and short-lived operational monitoring, not automated eligibility or legal-effect profiling. The AI assistant generates conversational responses but is not used for automated eligibility, employment, credit or similar decisions.
10. Security and changes
Reasonable technical and organisational safeguards are used to reduce unauthorised access, misuse and data loss. No internet service can guarantee absolute security.
This notice may be updated when site functionality, providers or legal requirements change. The current revision date is shown at the top of the page.