Privacy

Summary: the free scan needs no account and asks for no personal data. There is exactly one place where you can give us your email, and it is a box you tick yourself. We use no tracking or advertising cookies. We do count visits, anonymously and without cookies, and exactly what that stores is set out below.

What we store

• Scans. When you scan an address we store the result so we can give you a link to share. It contains the scanned URL and fragments of that page’s public HTML. It is kept for 90 days and then deleted automatically.
• Rate limiting. To prevent abuse we count how many scans come from one IP address within a time window. We do not store the address: we store a cryptographic digest of it, which counts just as well and cannot be turned back into an IP. That counter expires by itself and is not combined with any other data.
• Your email, if you give it. At the end of every report you can ask us to send it to you in writing. If you tick the box we store your address, the exact sentence you agreed to, the date, the shop you scanned and the same cryptographic digest of the IP — that last one as evidence the permission existed, because the law requires us to be able to prove it. We use it only to write to you about that. We do not sell it, share it, or feed it to any advertising tool. We remove you the moment you ask, from the link in any email or by replying.
• Visit measurement. We count visits with GoatCounter, which sets no cookies, creates no visitor identifier, and shares nothing with advertisers. It records the page viewed, the country and the referring link. We also count two aggregate facts — that a scan finished, and its grade — because without them we cannot tell whether the product is useful to anyone. None of those figures say who you are or which site you scanned.
• The statement generator. It runs entirely in your browser. What you type there is not sent to any server, including ours.

Scanning third-party sites

A scan downloads a public page the way a browser or a search engine would, identifying itself as AccyBot. It does not access private areas, log in, or submit forms. Only scan sites you own or are authorised to test.

Where it is processed

The application runs on Vercel and data is stored in a Supabase PostgreSQL database hosted in Ireland (EU). Both act as data processors.

Your rights

You can request access, rectification, erasure, restriction, portability and objection by writing to info@autoritasai.com. If you want a report deleted before the 90 days are up, send us its link and we will remove it.