Dibri Privacy Policy

Version: 2026-10-13
Last updated: October 13, 2026

This Privacy Policy explains how personal data is processed when you use Dibri.

Dibri is operated from the Republic of Moldova and processes personal data in accordance with applicable data-protection law, including Law No. 195/2024 on Personal Data Protection of the Republic of Moldova, and, where applicable, the EU General Data Protection Regulation (GDPR).

1. Data controller

The controller responsible for Dibri is:

Briceag Dmitri
Natural person
Tighina, Republic of Moldova
Email: contact@dibri.md

For certain personal data that an Organization enters into Dibri about its clients, employees, or other persons, Dibri may act as a processor/service provider on behalf of that Organization.

2. Data we process

Depending on how you use Dibri, we may process the following categories of data.

2.1 Account data

• name;
• email address;
• password hash and authentication information;
• email-verification status;
• language and interface preferences;
• account status;
• Organization membership and role information.

We do not store your password in plain text.

2.2 Organization data

• Organization name;
• membership and roles;
• invitations;
• sites and monitoring settings belonging to the Organization;
• notification destinations and other Organization configuration.

Authorized members of the same Organization may have access to this data according to their permissions.

2.3 Monitoring configuration and results

This may include:

• website addresses and URLs;
• check type and settings;
• text patterns or strings configured for text-present/text-absent checks;
• HTTP status and response metadata;
• SSL/TLS certificate information;
• publicly available domain information;
• robots.txt and sitemap.xml results;
• DNS and resolved IP information;
• redirects and final URLs;
• response time and latency;
• monitoring location;
• check timestamps;
• incident and recovery history;
• error codes and diagnostic messages.

Do not include passwords, authentication tokens, API keys, or other secrets in monitored URLs or text checks.

2.4 Notification data

If you enable notifications, we may process:

• email addresses;
• Telegram identifiers or chat information;
• notification preferences;
• notification delivery status and technical delivery logs.

If you enter another person's contact information, you are responsible for having an appropriate legal basis to do so.

2.5 Technical, security, and audit data

We may process:

• IP address;
• browser and device information;
• User-Agent;
• session identifiers;
• login time and authentication events;
• application and server logs;
• error logs;
• security events;
• acceptance of Terms and acknowledgement of this Privacy Policy, including document version and timestamp.

Technical information may be used to protect accounts, investigate abuse, prove acceptance of applicable terms, and maintain the Service.

2.6 Support and communications

If you contact us, we may process:

• your email address;
• message contents;
• attachments you send;
• support history and our responses.

2.7 Payment information

If paid plans are introduced, Dibri may receive limited payment-related information from the applicable payment provider, such as:

• subscription or plan;
• order or transaction identifier;
• payment status;
• billing country;
• renewal/cancellation status.

Full payment-card details are expected to be processed by the applicable payment provider or merchant of record and should not be stored by Dibri unless explicitly stated otherwise.

3. Why we process personal data and our legal bases

We process personal data only where a lawful basis applies.

Providing the Service and performing our agreement

We process account, Organization, monitoring, and notification data as necessary to:

• create and authenticate your account;
• perform checks you configure;
• store monitoring history;
• detect incidents and recoveries;
• send enabled operational notifications;
• provide Organization features;
• provide support related to the Service.

Legitimate interests

Where permitted by law, we may process technical and security data for legitimate interests including:

• protecting accounts and infrastructure;
• preventing abuse, fraud, and attacks;
• troubleshooting errors;
• improving reliability and performance;
• maintaining an audit trail;
• understanding how core Service features function.

We balance these interests against the rights and interests of affected persons.

Legal obligations

We may process and retain information where necessary to comply with applicable law, lawful requests, tax/accounting requirements where relevant, or to establish, exercise, or defend legal claims.

Consent

We rely on consent only where consent is an appropriate legal basis.

Google Analytics 4 and Yandex Metrica are used only after separate optional analytics consent. Any future marketing communications will require their own appropriate opt-in/opt-out mechanism.

You may withdraw consent for consent-based processing at any time. Withdrawal does not affect processing that was lawful before withdrawal.

Operational account, security, verification, and monitoring notifications are not treated as marketing consent.

4. Data generated when Dibri checks a website

Dibri sends automated requests to websites that users configure.

The operator of a monitored website may receive request information such as:

• the IP address of a Dibri monitoring location;
• request timestamp;
• requested URL;
• HTTP headers;
• User-Agent;
• network and protocol information.

Dibri may obtain publicly available technical information from the monitored website, DNS, certificate infrastructure, and domain-information services.

5. Multi-location monitoring and international processing

Some monitoring checks may run from infrastructure located in different countries or regions.

A remote monitoring location normally receives only the technical information needed to perform the configured check, such as the target URL and check parameters, and returns technical results.

Because Dibri uses hosting, cloud, email, messaging, or other providers, some data may be processed outside the Republic of Moldova.

Where applicable law requires safeguards for an international transfer, we will use an appropriate legal mechanism or choose providers that provide suitable safeguards.

6. Service providers and recipients

We do not sell personal data.

We may disclose or make data available to service providers only as necessary to operate Dibri, including providers of:

• hosting and cloud infrastructure;
• remote monitoring infrastructure;
• databases, queues, backups, and storage;
• email delivery;
• Telegram or other messaging integrations selected by the user;
• payment processing, if paid functionality is enabled;
• error monitoring and security tooling;
• technical support infrastructure.

We may also disclose information:

• when required by applicable law or a valid legal request;
• where reasonably necessary to protect users, Dibri, or third parties;
• in connection with the establishment, exercise, or defense of legal claims.

We aim to give service providers access only to the data necessary for their role.

7. Organization administrators and other users

If your account belongs to an Organization, authorized Organization members may access Organization-related information according to their permissions.

Dibri is not responsible for independent processing performed by an Organization outside the Service.

If an Organization created or controls your account or contact information, you may also need to contact that Organization regarding its own processing activities.

8. Data retention

We keep personal data only for as long as reasonably necessary for the purposes described in this Policy.

Retention depends on the type of data and may include:

• account data while the account is active;
• monitoring configuration and history while required to provide the Service and the selected history period;
• operational and security logs for a limited period appropriate to security and troubleshooting needs;
• support correspondence while needed to resolve the request and maintain reasonable support history;
• billing or transaction records for any period required by applicable law;
• legal records where necessary for a dispute or legal obligation.

After an account or Organization is deleted, data will be removed or anonymized from active systems within a reasonable period, except where continued retention is required or justified by law, security, fraud prevention, backups, or legal claims.

Backup copies may remain until overwritten as part of normal backup rotation.

We do not keep personal data merely because storage is available.

9. Account deletion and Organization data

You may request account deletion through available account controls or by emailing contact@dibri.md.

Deleting a user account does not necessarily delete Organization data if other authorized Organization members remain.

Where a user is the sole responsible member of an Organization, Dibri may require an additional confirmation before deleting Organization resources and monitoring history.

10. Your rights

Subject to applicable law and any lawful exceptions, you may have rights including:

• to be informed about processing;
• to access your personal data;
• to correct inaccurate or incomplete data;
• to request deletion;
• to request restriction of processing;
• to object to certain processing;
• to receive certain data in a portable format;
• to withdraw consent where processing is based on consent;
• to complain to a competent data-protection authority.

To exercise a privacy right, contact contact@dibri.md.

We may ask for information reasonably necessary to verify your identity and protect your account before acting on a request.

If you are in Moldova, you may also contact the National Center for Personal Data Protection of the Republic of Moldova (NCPDP/CNPDCP).

11. Cookies, sessions, and local storage

Dibri may use cookies, browser storage, or similar technologies that are strictly necessary for:

• authentication;
• session management;
• CSRF/security protection;
• language or interface preferences;
• other core functionality explicitly requested by the user.

When configured, Dibri uses Google Analytics 4 (Google) to measure public page visits and successful registration, login, first email verification, site creation, subscription checkout and confirmed paid subscription invoices. Google may process browser/device information, cookie identifiers, public page addresses, referrers, language and these events, including currency, amount, plan code and an opaque transaction identifier, outside Moldova, including in the United States. See Google's Privacy Policy. We do not send names, email addresses, account identifiers, monitored URLs, API keys or verification tokens. Query strings and fragments are removed from public page addresses; private paths and page titles are replaced with a generic application context. Advertising storage, advertising personalization and Google signals are disabled.

The public website also uses Yandex Metrica (Yandex) with the same optional consent. Yandex may receive IP address, browser/device information, public page address, referrer and visit events, and may process these data outside Moldova, including in Russia. Addresses are supplied without query strings or fragments, and non-public referrer paths are removed. Session replay (Webvisor), click maps and automatic link tracking are disabled. Metrica is not loaded in the client application; neither analytics provider is loaded in the internal admin.

No analytics tag or analytics request is loaded or sent before acceptance. You can accept or reject using equally accessible buttons and later change or withdraw the choice through “Analytics settings” in the public footer and client application. The choice is separate for each hostname and is stored with its version and decision time in browser storage and the necessary server session for up to 180 days. This update requires a new analytics choice because Google is a new recipient; existing Terms acceptance remains valid. Withdrawal stops further collection, discards pending account events and removes accessible first-party Google and Yandex cookies. Third-party cookies and previously transmitted data are governed by the providers' controls and retention settings; browser settings can remove third-party cookies.

Dibri stores only the minimal account event queue and consent snapshot needed for deduplication and delivery. Unsent events expire after seven days; event parameters are cleared after seven days. Opaque deduplication markers are retained until account deletion to prevent repeated one-time events and payment webhooks from being counted again. A consented checkout snapshot may authorize recording a paid invoice for up to 180 days, but delivery still requires the current browser's consent. Browser delivery may be prevented by blockers or disconnection.

Refusing optional technologies must not prevent use of core functionality that does not depend on them.

12. Marketing communications

Dibri may send operational messages necessary for the Service, such as:

• email verification;
• security notifications;
• monitoring alerts;
• incident and recovery notifications;
• important account or Service notices.

These are different from marketing messages.

If marketing email or similar direct marketing is introduced, the relevant opt-in/opt-out mechanism will be provided separately as required by law.

13. Security

We use reasonable technical and organizational measures intended to protect personal data, including measures appropriate to the nature of a website-monitoring service.

These may include:

• encrypted transport (HTTPS);
• password hashing;
• access controls;
• separation of user/Organization permissions;
• secret management;
• logging and security monitoring;
• restrictions intended to prevent abuse of monitoring infrastructure;
• backups and recovery procedures.

No internet service can guarantee absolute security.

If you discover a security issue, please contact contact@dibri.md.

14. Personal data breaches

Where a personal data breach occurs, we will assess the risk and take the steps required by applicable law, which may include notifying the competent authority and, where required, affected persons.

15. Children

Dibri is intended for professional and business-related website monitoring and is not directed to children.

Accounts should not be created by persons under 18 in their own name.

We do not knowingly seek to collect children's personal data.

16. Automated decisions

Dibri automatically evaluates website checks and may classify technical states such as UP, DOWN, RECOVERED, DEGRADED, or similar statuses.

These technical classifications relate to monitored websites and are not intended to make decisions about individuals that produce legal or similarly significant effects.

17. Changes to this Policy

We may update this Privacy Policy when Dibri functionality, data practices, providers, or legal requirements change.

The current version and update date will be published on the Dibri website.

Material privacy changes will be communicated where required. A Privacy Policy update is not treated as a request for blanket consent to all processing.

18. Contact

For privacy requests, questions, or complaints:

Briceag Dmitri
Tighina, Republic of Moldova
contact@dibri.md