Privacy Policy
Effective 25 October 2026
This policy explains what personal data Scanylo handles, why, and what your rights are. We try to collect as little as we can.
1. Who is responsible
The data controller is {owner_name}, a sole proprietorship (ENK) registered in Norway, organisation number {org_number}, {address}. Privacy questions: [email protected].
2. What we collect
| What | When | Why |
|---|---|---|
| The web address you check, and the results of the check | You run a check | To produce your report |
| Raw responses from the checked site (headers and page content we read) | You run a check | To work out the findings. They may contain personal data that is public on the site, such as a name or email on a page. We do not look for personal data |
| Consent record: time, your IP address, the address, your browser details | You tick the confirmation | To show that someone confirmed they own or may check the site |
| Your email address | You ask for a report link, wave alerts or a purchase | To send you what you asked for |
| Wave alert subscription: email, domain, confirmation time | You subscribe | To send alerts |
| Purchase data: email, amount, order and payment session identifiers, your waiver of withdrawal | You buy the fix plan | To deliver the plan, issue a receipt and meet accounting law. We never see your card number |
| Your message and report ID | You use the contact or opt-out form | To reply |
| Technical logs: IP address, request time, browser, page | You visit the site | To run the service, stop abuse and fix bugs |
| Anti-bot signals | You use the scan form | Cloudflare Turnstile checks that you are a person |
We do not use advertising cookies and we do not sell personal data.
Cookies
We ask before we use any analytics cookies. The banner at the bottom of the page offers Accept and No, thanks, and you can change your answer at any time with Cookie settings at the bottom of every page.
| Cookie or storage | Set by | When | Why | How long |
|---|---|---|---|---|
scanylo_consent |
Scanylo | When you answer the banner | Remembers your answer so we do not ask again | 180 days |
Security cookie (.AspNetCore.Antiforgery...) |
Scanylo | When you see a form | Protects forms against cross-site request forgery | Until you close the browser |
| Turnstile | Cloudflare | When you use a form | Checks that you are a person | Short-lived |
ph_* cookie and browser storage |
PostHog | Only after you click Accept | Product analytics: which pages you visit, what you click, and a recording of the page as you use it, with everything you type hidden | Up to 1 year |
If you click No, thanks, or never answer, no PostHog code runs in your browser. We still count key steps on our own server, such as "a check was started", "a report was opened" or "a fix plan was bought". Those counts use the check's ID, not a cookie, and they are sent to PostHog without anything that identifies your browser.
3. Why we may use your data (legal bases)
- Contract: to deliver the report, the fix plan and the receipt you asked for.
- Consent: for the wave alert and report emails. You confirm by email, and you can withdraw at any time with the unsubscribe link. Also for analytics cookies and page recordings in your browser, which you can withdraw with Cookie settings.
- Legitimate interest: to keep a record of consent to a check, to prevent abuse of the free check, to keep the service secure, to handle complaints from site owners, and to count the steps of a check on our server to improve the product. We believe these interests are balanced against yours, and you may object.
- Legal obligation: to keep accounting records as Norwegian law requires.
4. How long we keep it
| Data | Kept for |
|---|---|
| Raw responses from checked sites | 7 days |
| Findings and reports | 90 days |
| Secrets found in public files | Never stored in full, only redacted |
| Consent records | {consent_retention} |
| Email addresses for report links | Until the report expires (90 days), unless you also subscribe to alerts |
| Wave alert subscriptions | Until you unsubscribe |
| Purchase and accounting records | As Norwegian bookkeeping law requires (currently five years) |
| Technical logs | Short-term, for security and fixing bugs |
| Analytics events and page recordings in PostHog | Events up to 1 year; page recordings 30 days |
| Do-not-scan list entries | For as long as the opt-out is in force |
After that we delete the data or remove what identifies you.
5. Who gets your data
We share personal data only with companies that help us run Scanylo (our processors), and only for that purpose:
- Cloudflare: content delivery, DNS, security and the Turnstile anti-bot check.
- Resend: sending our emails.
- Stripe: processing payments. Stripe is also responsible for its own handling of payment data and has its own privacy policy.
- PostHog (EU cloud, Frankfurt): product analytics. In your browser only after you click Accept; the server-side step counts described under Cookies are sent for every check.
- OpenAI: writing report text. We send the list of technical findings and the detected technology, not the page content, and not your email address. AI writes text only, and it makes no decisions about you.
- Hosting and backup: our own servers and a virtual server we rent. {hosting_note} Backups go to {backup_provider}.
We may disclose data if the law requires it. We do not share your data with advertisers.
6. Data outside the EEA
Some of the companies above are based in, or process data in, countries outside the EU and EEA, such as the United States. Where that happens we rely on a recognised safeguard, such as the EU-US Data Privacy Framework or the EU Standard Contractual Clauses. Ask us at [email protected] for details.
7. Your rights
You can ask us to:
- show you the data we hold about you,
- correct it,
- delete it,
- limit how we use it,
- give you a copy in a common format, or
- stop using it where we rely on legitimate interest.
You can withdraw consent to emails at any time. To use your rights, write to [email protected]. We usually reply within one month. We may ask you to prove who you are.
If you are not happy with our answer, you can complain to the Norwegian Data Protection Authority (Datatilsynet), or to the authority in your own country.
8. If you own a site that was checked
We process data about checked sites because the person who asked confirmed that they own it or may check it. If you disagree, or want us to stop, use the opt-out form or write to [email protected]. We add your domain to the do-not-scan list and delete the raw responses we hold.
9. Security
We use encrypted connections, restrict access, keep secrets out of code, and delete data on a schedule. No system is perfectly secure. If a breach affects you, we will tell you and the authorities as the law requires.
10. Children
Scanylo is not meant for children, and we do not knowingly collect their data.
11. Changes
We may update this policy. The date at the top shows the current version. For material changes we will tell subscribers by email.