What we collect, and why
Short version: your email address, the addresses you scan, the scan evidence, and a hashed version of your IP for rate limiting. No analytics, no advertising, no third-party scripts on this site.
Who we are
ComplianceScanner is operated by [legal name], [address], [company registration number]. Contact for anything privacy-related: privacy@compliancescanner.io. We are the controller for the data described here.
What we process
| Data | Why | Legal basis (GDPR) | Kept for |
|---|---|---|---|
| Email address | Sign-in links, scan reports you asked for, service notices | Contract, Art. 6(1)(b) | Until you delete your account |
Session cookie cs_session | Keeping you signed in. It’s the only cookie we set | Strictly necessary; contract | 30 days, or until you sign out |
| Keyed hash of your IP address (the IP itself is not stored) | Limiting free scans to one per day and preventing abuse | Legitimate interest, Art. 6(1)(f) | Daily counters, deleted after [30] days |
| URLs you scan and scan evidence (request logs, cookie names, screenshots of public pages) | Producing the records you asked for | Contract, Art. 6(1)(b); for free scans, legitimate interest | Free scans: evidence files 30 days, receipt kept for verification. Account scans: until you delete them or your account |
| Billing details | Payment, invoices, tax | Handled by LemonSqueezy as merchant of record; see their notice | As required by tax law |
Scan evidence describes public web pages. Cookie values are redacted before storage. Screenshots show what the public page displayed to an anonymous visitor.
Who else handles it
- [Hosting provider, e.g. Hetzner Online GmbH, Germany]: servers and storage, in the EU.
- [Email provider]: delivering sign-in links and reports.
- Lemon Squeezy LLC: checkout and billing, as merchant of record.
- [Cloudflare, Inc.: network protection.]
We don’t sell data or share it for advertising. [Describe any transfer outside the EEA and its safeguard, if applicable.]
Your rights
You can ask for access, correction, deletion, restriction, portability, or object to processing based on legitimate interest. Email privacy@compliancescanner.io from your account address; we answer within one month. You can also complain to a data protection authority, for example [the authority where the operator is established].
Changes
We’ll email account holders before material changes take effect.