Privacy statement

The controller responsible for processing your data is:

Normwacht

You enter a web address. We keep that address and the report for seven days, so you can pass it on; after that we delete both automatically.

To prevent abuse, we count how many scans are requested from your internet connection. For that we use your IP address, only in the server’s working memory and for at most an hour. We do not store it.

Legal basis: our legitimate interest in delivering the scan you ask for and protecting the service against abuse (Article 6(1)(f) GDPR).

With an account we keep your email address, the scans you request, and whether you agreed to receive messages about the product, with the moment you did. You sign in with a link sent by email; we do not hold a password.

Legal basis: our contract with you (Article 6(1)(b) GDPR). For messages about the product: your consent (point (a)), which you can withdraw at any time.

Your scans are kept for as long as your account exists. If we close your account at your request, we delete your scans as well.

If you follow a site with a subscription, we rescan it regularly and measure it lightly every day: what loads before consent, the cookie window and chat windows. Those measurements are about your public site, not about people. We keep them for 90 days; the scans for as long as your account exists.

If the daily measurement sees something new, we email you at the address of your account. If you stop following the site, those emails stop too.

Legal basis: our contract with you (Article 6(1)(b) GDPR).

If you leave your email address for a subscription that cannot be taken out yet, we keep that address together with the chosen plan, the site you just scanned and your language. We only use it to let you know the subscription is available.

Legal basis: your consent (Article 6(1)(a) GDPR). Reply once and we delete it.

We may email a business once about what a scan of its own public website showed. For that we only use a general address the business publishes on that site itself, such as info@, and never the address of a person.

Anyone who does not want to hear from us again is put on our opt-out list permanently, for the whole domain. We keep that domain precisely so we can honour the opt-out.

Legal basis: our legitimate interest (Article 6(1)(f) GDPR), within the limits of Article 11.7(2) of the Dutch Telecommunications Act.

We do not sell data and share it with no one, except the parties that run the service for us. They process the data only on our instructions.

Vercel Inc. hosts the website and the scan. The scan runs in a data centre in Dublin (Ireland), but Vercel is based in the United States; the transfer there is covered by the European Commission’s standard contractual clauses (Decision 2021/914).

Supabase stores the database and handles signing in and the sign-in email. The data is stored in Ireland, within the EU.

To know whether this site is found and used, we count visits with Vercel’s Web Analytics. It sets no cookie and stores nothing in your browser. A visit is recognised by a code calculated from the request (a hash) that expires after 24 hours; we only see totals, never a person.

Sent with each visit: the page, the site you came from, your country and region, the type of device, the operating system and the browser. We do not send the address of a report or dossier, only that it was one.

Legal basis: our legitimate interest in knowing whether the site is used (Article 6(1)(f) GDPR). Vercel does this on our behalf, as described above.

We do not set tracking or analytics cookies. Only someone who signs in receives a cookie that remembers the session. It is needed to stay signed in and therefore does not require consent (Article 11.7a(3) of the Dutch Telecommunications Act).

You may access your data, have it corrected or deleted, object to its use, and withdraw any consent you gave. Email us; we reply within one month.

If you disagree with how we handle your data, you can lodge a complaint with the Dutch data protection authority (Autoriteit Persoonsgegevens) or with the supervisory authority in your own country.

All connections to the site are encrypted. The database can only be reached from our own server, not from the browser, and the key for it never appears in the code your browser receives.