Scanner Privacy Policy

Who is responsible for your data (controller)

The Scanner is provided by Aviad Revach, sole proprietor trading as CookieTelemetry, Nahariya, Israel ("we", "us"). Email: [email protected].

We have not appointed a Data Protection Officer.

What we collect and why

The domain you submit and your verification choice, to run the scan you asked for (GDPR art. 6(1)(b)). If you choose email verification, an email address at that domain, to send the confirmation link (art. 6(1)(b)). Your IP address, the time of the request and the Cloudflare Turnstile check, to stop abuse and enforce limits (art. 6(1)(f)). Our legitimate interests are keeping the Scanner secure, preventing it from being used to harass or overload websites, and giving reliable results only to people who control the domain.

Do you have to give us this data?

No law requires you to. Using the Scanner is voluntary, but without the domain, the verification step and the security check we cannot run a scan or show you a result.

Marketing

The Scanner form does not sign you up for any marketing email.

About scanned websites

When someone who has verified control of a domain asks for a scan, we load that site's public homepage twice. For each third-party request observed before any banner interaction we keep the host, a short path prefix, a category, the filter rule it matched and the list version. We do not keep page content, screenshots, recordings or cookie values; temporary browser files are deleted when each scan finishes. Results can relate to a website run by an individual. We show them only to the person who verified control of the domain, delete them after 7 days, and never publish them. Legal basis: our legitimate interest in providing the scan the site's owner asked for (GDPR art. 6(1)(f)).

Retention

Scan results: 7 days. Email addresses given for email verification: 30 days. Verification codes: 24 hours. Rate-limit counters linked to your IP address: 24 hours. Temporary browser files from a scan: deleted when the scan finishes. Do-not-scan list entries: until the site owner asks us to remove them (we keep only the domain). Server logs: 30 days. Cloudflare processes your IP address for the Turnstile check under its own terms: https://www.cloudflare.com/turnstile-privacy-policy/.

Who receives data, and why

Hetzner Online GmbH (hosting, Germany). Cloudflare (network delivery, security and the Turnstile check; United States — the EU-U.S. Data Privacy Framework, backed by the EU Standard Contractual Clauses). Resend, Inc. (sending verification emails; United States — the EU-U.S. Data Privacy Framework and the EU Standard Contractual Clauses under Resend's Data Processing Addendum). We are based in Israel, which the European Commission recognises as giving adequate protection to personal data (Decision 2011/61/EU). We never tell anyone else who asked for a scan, unless the law requires it. If you choose email verification, the confirmation email goes to the address you enter at that domain.

Automated decisions

We make no decisions about you based solely on automated processing that have legal or similarly significant effects. Rate limits and the bot check can automatically refuse a request; email us if you think that was a mistake.

Your rights

You can ask to see (inspect) the data we hold about you, to correct it, to delete it, to restrict its use, or to receive data you gave us in a portable format. Email [email protected]. You can complain to the data-protection authority in your EU country, or to Israel's Privacy Protection Authority.

Your right to object

Where we rely on legitimate interests, you can object at any time on grounds relating to your particular situation, and we will stop unless we have compelling grounds to continue.

Contact

Questions about this Privacy Policy: [email protected]. See also our Scanner Terms of Service.