Mimicwatch

Privacy notice

Last updated: 13 October 2026

This notice explains what personal data Mimicwatch processes, why, and what rights you have. It follows the Swiss Federal Act on Data Protection (FADP) and, where it applies to people in the EU or EEA, the General Data Protection Regulation (GDPR).

1. Who is responsible

Ilan Engdahl, trading as Mimicwatch
Switzerland (postal address in the legal notice)
Email: hello@mimicwatch.com

We have not appointed an EU representative. Our processing is occasional, small in scale and includes no special categories of data (Art. 27(2) GDPR). EU residents can reach us directly at the address above.

2. Visiting this website

This site uses no cookies and no advertising or tracking scripts. It loads no fonts from other companies.

Visit counts. We look at aggregate visit numbers from Cloudflare: which pages were viewed, from which country and which site sent you. They come from Cloudflare Web Analytics, a small script from Cloudflare that sets no cookies, does not build a profile and does not follow you across sites. Legal basis: our legitimate interest in knowing whether the site works for visitors (Art. 6(1)(f) GDPR).

Quick preview on the check page. If you press "Show a quick preview", your browser asks Google Public DNS (Google LLC) whether common lookalikes of the domain you typed exist. Google receives those domain names and your IP address, under its own Public DNS privacy notice. Nothing from the preview is sent to us or stored by us. If you prefer not to use it, skip the preview and just send the request.

Our hosting provider, Cloudflare, processes technical data needed to deliver the pages and protect them from abuse, such as IP address, time of request and browser type. This is based on our legitimate interest in running a secure website (Art. 6(1)(f) GDPR). We do not keep these logs ourselves; how long Cloudflare keeps them is set out in Cloudflare's privacy policy.

3. When you email us or ask for a check

We process what you send us: your name, your email address, your company, the domain(s) you want checked, and the content of your messages. We use this to run the check, reply to you and, if you subscribe, send you alerts.

The check form. When you send the form on our check page, your browser sends us the domain, your email address and, if you fill them in, your company name and notes. The time of the request is recorded, and your IP address is used to limit how many requests one place can send, to block abuse. The request is stored with Cloudflare, our hosting provider, for up to 30 days and then deleted there automatically; we copy it to our own records to run the check. If the form can't take your request, the page offers to send the same details by email instead.

  • Legal basis: taking steps at your request before a contract, and performing the contract (Art. 6(1)(b) GDPR).
  • Retention: for free checks, up to 12 months after our last contact, then deleted. For customers, for the duration of the subscription, then as long as Swiss accounting law requires for invoices (10 years); other data is deleted within 3 months of cancellation.

4. Payments

If you subscribe, payment is handled by Stripe. We receive your name, email, billing address and payment status, but not your full card number. Legal basis: performing the contract and our legal accounting obligations (Art. 6(1)(b) and (c) GDPR).

5. Business outreach

We sometimes write to businesses at the contact address they publish on their website or in a public directory, to share a lookalike domain we found for them. We use the company name, the contact email address the business publishes, and its domain. Legal basis: our legitimate interest in offering a relevant service to businesses (Art. 6(1)(f) GDPR). Every such email says how to opt out, and we stop as soon as you ask. We do not email private individuals.

6. The public records we check

To find lookalike domains we read public sources: certificate transparency logs, public DNS, and public registration data. Registration data can sometimes include the name of the person who registered a domain. We use it only to identify the right registrar and hosting provider for an abuse report, and we do not contact that person.

7. Who we share data with

We use these service providers, who process data on our behalf:

  • Cloudflare, Inc., USA (website hosting, the check form, cookie-free visit counts, email routing and storage of incoming email)
  • Resend, Inc., USA (sending email)
  • Google LLC, USA, via Gmail (receiving and storing email)
  • Stripe Payments Europe, Ltd., Ireland (payments)

Some of these providers may process data outside Switzerland and the EU/EEA, including in the United States. Where that happens, transfers rely on an adequacy decision (such as the Swiss-US or EU-US Data Privacy Framework) or on standard contractual clauses. We do not sell personal data.

8. Your rights

You can ask us for access to your data, to correct it, to delete it, to restrict or object to its processing, and to receive it in a portable format. You can withdraw any consent at any time. Write to hello@mimicwatch.com. We reply within 30 days.

You can also complain to a supervisory authority: in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC); in the EU, the authority in your country.

9. Security

The site is served over HTTPS only. We keep customer data in as few places as possible, with access limited to the people who run the service.

10. Changes

If we change how we handle data, we update this page and the date at the top.