Privacy notice

Who is responsible

webzod is run by webzod, Saulės g. 3, Kaunas, Lithuania. Questions about your data: privacy@webzod.com.

What we collect

• When you scan: the domain you enter, the scan results, and your client address, which we use to rate-limit scans and keep abuse in check. The client address is your IPv4 address, or for IPv6 the /64 prefix (the first 64 bits) of your address.
• When you sign in: your email address, your GitHub username and numeric ID if you use GitHub, your plan, and when you last signed in. Each sign-in link we email you is recorded with your email address and your client address.
• When you use the dashboard: the domains you add, their verification token, their schedule and alert settings, and the scans that belong to your account.
• If you subscribe to Pro, when it is available: your Paddle customer ID and subscription ID, the subscription status, your plan and the date it renews or ends. Your card or other payment details go to Paddle only; we never see or store them. If you ask to be told when Pro launches, we keep that you asked, with the time, and we use your email address for the one message we send when it does.
• When you create a share link for a report: the link itself (an unguessable address) and which scan it opens.
• When something goes wrong in your browser on webzod: the error message, a code location and the page path (not form contents or cookies) are sent to our own API and kept in our error log for 30 days.
• The email we send you and whether it was delivered: sign-in links; alerts about your saved domains; one message when Pro launches, only if you joined the list (that is your consent, and you can leave the list at any time on the pricing page or your dashboard); and one message when a Pro plan ends, saying which schedules were paused.

What leaves our servers when a domain is scanned

A scan is passive. These are the places your input goes, and what each receives:

• The domain name is looked up at public DNS resolvers and the domain’s own nameservers, in its RDAP registry record and in the crt.sh certificate transparency log.
• The scanned homepage URL is sent to Google, to PageSpeed Insights (which then loads the page from Google’s servers) and to Google Web Risk. A site that blocks WebzodScanner in its robots.txt is not scanned at all, so nothing about it is sent to Google.
• Vulnerability data from OSV, CISA KEV and retire.js is downloaded and matched on our servers. Those services receive nothing about the site you scan.
• The AI summary sends only structured data about the scan to Anthropic: the grade and score, finding types, titles, severities and counts, and the names of detected technologies. It never includes page content or the host name.
• Tailored fixes, a Pro feature switched on only when available, send to Anthropic’s Claude the finding, the fix from our library and the evidence of that one check, taken from a domain you have verified. Secrets found in the evidence are masked first. Page content is never included.
• The site itself receives the requests listed on the scanner page, with the User-Agent WebzodScanner.

Who processes data for us

• Hetzner hosts the API and the database.
• Cloudflare provides DNS, the content network, the Pages hosting for this website and, where shown, the Turnstile human check.
• Postmark delivers our email.
• Paddle, when Pro is available, is our reseller and merchant of record: it takes the payment, handles VAT and sends the invoice, and processes your payment details under its own privacy policy. We receive the subscription status and the IDs listed above.
• Sentry receives error reports from the website and the API. We configure them to leave out request bodies, cookies and query strings, and to mask email addresses in error messages. Sentry may see the IP address of the browser that sends a web error report.
• Google and Anthropic receive the data described above (Anthropic only for the AI summary and, on Pro, tailored fixes).

Transfers outside the EEA

Google, Anthropic, Postmark, Sentry and Cloudflare are companies based in the United States, so data sent to them is transferred outside the European Economic Area, and Paddle may process payment data outside it too. Where that applies we rely on the safeguards those providers offer for such transfers, such as the EU–US Data Privacy Framework or standard contractual clauses.

Share links

You can create a share link for one of your reports. The link is unguessable, is not listed anywhere and tells search engines not to index it, but anyone who has the link can open that report. You can revoke the link at any time, and all your links stop working when you delete your account.

Cookies and tracking

We set one cookie that matters: a session cookie, once you sign in. It keeps you signed in, is not readable by scripts, is sent only to the webzod API and is removed when you sign out. During GitHub sign-in a second short-lived cookie holds a one-time check value for ten minutes.

Your theme choice is kept in your browser’s local storage. We use no analytics, advertising or tracking cookies. When the human check is shown, Cloudflare runs it in your browser under Cloudflare’s own privacy policy. When you open the Pro checkout, your browser loads Paddle’s checkout script from Paddle’s servers, and Paddle may set its own cookies there under its own policy; nothing from Paddle loads before that.

How long we keep it

• Scans started without an account, with the client address stored alongside them: 30 days, then deleted.
• Request records used for rate limiting: 48 hours.
• Internal error records (technical error messages; email addresses masked, query strings, cookies and credentials removed before storage): 30 days.
• Sign-in links, with the email address and client address recorded for each: valid for 15 minutes and single use, and the record is deleted one day after the link expires. Sessions last 30 days and renew while you use the site.
• Scans we run on a schedule for your saved domains, also after you remove the domain: 400 days during the free launch and on Pro. Once Pro is available, the free plan keeps them 180 days; when a Pro plan ends, the scheduled scans older than that are removed 30 days later. The latest scan of each domain stays while the domain is saved.
• Subscription records (Paddle IDs, status and dates): until you delete your account. Paddle keeps its own payment and invoice records for as long as tax and accounting law require.
• Scans you start yourself while signed in, and your account data and domains: until you delete your account.
• Backups of the database: 30 days. Data you delete can remain in a backup until it expires.

Your rights

You can ask for a copy of the data we hold about you, ask us to correct it, or object to how we use it. You can delete your account yourself on the dashboard (a Pro subscription that is still renewing has to be cancelled first), which removes your account, domains and schedules and signs you out everywhere. Deleting your account deletes your scans too: manual and scheduled scans, with their results, console logs and share links (share links stop working). A scan that is still running at that moment finishes as an anonymous scan and is removed by the 30-day retention. If you are in the European Economic Area or the United Kingdom you can also complain to your data protection authority.

We use your data to provide the service you asked for and, as our legitimate interest, to keep it secure and prevent abuse.

Contact

Privacy requests and questions: privacy@webzod.com. Reports of scanner misuse: abuse@webzod.com. See also the terms and what the scanner requests.