Privacy notice

The controller of the data below is The service operator.

Controller

What is stored

• Account: your e-mail address, whether it is confirmed, and a one-way hash of your password.
• Account security: the key of your authenticator app and one-way hashes of your recovery codes when two-factor sign-in is on, and one-way hashes of your API keys.
• Session: a cookie that keeps you signed in. It is strictly necessary and not used for tracking. A second cookie remembers the colour theme you chose.
• Domains and reports: the domains you register, their verification state, and the reports of your scans.
• Monitoring alerts: new vulnerabilities and releases affecting software seen on your domains, until you scan again or dismiss them.
• Notification settings: which e-mails you want to receive.
• Free tools: the domains entered are not stored. Results are kept in memory for 15 minutes to answer repeated lookups.
• Network address: counted in memory for at most one hour to limit sign-in attempts and other abuse. It is not written to the database.
• Credits: a record of every credit granted, spent and refunded.

Why, and on what legal basis

• Providing the service you signed up for (performance of a contract, GDPR Article 6(1)(b)): your account, domains, reports, alerts, credits and the e-mails the service sends you.
• Keeping the service and its users safe (legitimate interest, GDPR Article 6(1)(f)): rate limits on network addresses, two-factor sign-in and the record of which addresses a scan reached.
• Accounting (legal obligation, GDPR Article 6(1)(c)): invoices for purchased credits.

Who sees it

Only you see your domains and reports. The operator can see account e-mail addresses, credit balances and reports in order to run the service. Nothing is sold or shared for advertising.

A scan sends the name of the scanned domain, and the software versions found on it, to public data sources such as certificate logs, blocklists and vulnerability databases. No account data is sent to them.

How long

Account data is kept until you delete your account. Deleting it on the account page removes the account and everything stored with it at once. Invoices for purchased credits are kept outside the service for as long as accounting law requires.

Your rights

You can ask for access to your data, its correction or deletion, the restriction of its processing, and you can object to processing based on legitimate interest. You can download your data on the account page and delete your account there. For any other request write to the operator.

You can lodge a complaint with the data protection supervisory authority of your country, or go to court.