Privacy

Matti
Rovaniemi
info@saavutracker.app

Controller and contact

The service provider named above is responsible for processing personal data in scan requests. Send privacy requests to the contact email.

What we collect and why

Quick scan: we process only the website address you enter; no email address is asked for. The summary is kept for 14 days and then deleted automatically. To prevent the same site from being scanned repeatedly, a keyed hash of the domain name is kept for one day.

Full scan (Finnish page): we collect the website address and your email address, plus the time and status of the request. We use them to assess the request, deliver the scan and contact you about it. We do not add contact details to marketing lists. To enforce the pilot limits (the same email at most 2 times, the same site once), a keyed hash of the email address and of the domain name is stored; these are deleted 90 days after last use.

Processing is based on steps taken at your request before entering into a contract (GDPR Art. 6(1)(b)) when you act in your own name, and on legitimate interest when you contact us on behalf of an organisation and to protect the service against misuse (Art. 6(1)(f)). We do not make automated decisions with legal effects or carry out profiling.

Retention

Request data is deleted automatically 90 days after submission. A finished full report is kept behind its report link so that the link keeps working; the report concerns the website and does not contain your email address. You can ask us to delete it. Other services' retention: Cloudflare Workers technical execution and error logs are kept for 7 days. Resend email and log data is kept for 30 days, and Resend backups for 7 days. These periods apply to those services' log and email data, not to scan reports or other data stored by the application.

Spam protection turns the IP address into a keyed identifier; the raw IP address is not stored with the request. The per-identifier counter is kept for at most one day and the anonymous total counter for one day. Cloudflare's own network and security logs are separate.

Processors and transfers

The service runs on Cloudflare. Processors used: Cloudflare, Inc.: operating the service, running scans, storing data and technical protection, including Turnstile bot protection. Resend (Plus Five Five, Inc.): sending email verification messages and report links. The providers also use the sub-processors described in their data processing agreements.

Transfers outside the EU/EEA and safeguards: Data is also processed outside the EU and EEA. Cloudflare uses an international infrastructure. Resend stores email content and delivery data in the United States even when the EU sending region is selected. Transfers are covered by the providers' data processing agreements and, accordingly, the EU Standard Contractual Clauses or the EU–US Data Privacy Framework where applicable.

Your rights

You can request access to your data, rectification, erasure or restriction of processing as provided by law, and object to processing based on legitimate interest. We usually reply within a month. You can lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi).