The paperwork, in the same plain words as the product

You act as controller for the personal data present in the pages we scan and in your workspace. We act as processor and process it only to deliver the service described in the terms.

Account data

Name, work e-mail, role, organisation, hashed password, session and audit records.

Scan artefacts

Page HTML snippets, screenshots, raw scanner output and derived findings for the pages you nominate.

Billing data

Company name, address, VAT number, invoice history. Card data stays with Stripe.

Support data

Messages you send us, kept for two years and never used for marketing.

Hetzner Falkenstein as primary region with Helsinki as standby, both inside the EU. Object storage and transactional mail are EU-based. No US region is selectable, and no data is transferred outside the EEA.

Hetzner Online GmbH

Compute and database hosting · Germany and Finland

Cloudflare (EU storage)

Object storage for reports, screenshots and packs · EU region

Stripe Payments Europe

Billing, invoices and VAT handling · Ireland

Postmark (EU)

Transactional mail · EU region

Encryption in transit and at rest, per-organisation query scoping enforced in the API layer, append-only audit log, least-privilege access for staff with impersonation requiring a support ticket, and an annual external penetration test whose summary is available on request.

We notify you without undue delay and within 48 hours of becoming aware of a personal data breach affecting your workspace, with the facts known at that point and the measures taken.

On termination, personal data is deleted within 30 days except sealed evidence packs, which you may keep for their 24-month retention window or have deleted immediately on request.