Privacy policy
This is a courtesy translation. The German version of this document is the legally binding one. Where the two differ, the German text prevails. You find it at the German page.
1. Controller
Studio Luy UG (haftungsbeschränkt)Norderreihe 21
22767 Hamburg
Email: info@websecureaudit.de
2. This policy covers two offerings
- websecureaudit.de – the public site with the free single scan. You need no account for it.
- app.websecureaudit.de – the customer portal with an account, repeated scans and a stored history.
If you only use the free scan, sections 4 to 6 do not concern you: without registration no account comes into being and nothing is stored permanently.
3. Data in the free scan
| Data | What for, on what basis, for how long |
|---|---|
| The domain you enter | To carry out the scan. Basis: your consent (Art. 6 (1) (a) GDPR). The domain is processed only for the duration of the scan and is not stored permanently. |
| Your email address | To send you the report. Basis: your consent (Art. 6 (1) (a) GDPR). It remains in our outbox for as long as the message is filed there. |
| IP address when submitting the form | To limit misuse (at most three scans per hour). Basis: legitimate interest (Art. 6 (1) (f) GDPR). The address is held in memory only and discarded after an hour – it is never written to a file. |
| Connection data when the page is called | Technically necessary data that our hosting provider processes when delivering the page. Basis: legitimate interest in secure operation (Art. 6 (1) (f) GDPR). |
So that a report only reaches those entitled to it, your email address must belong to the domain being scanned.
4. Data in the customer portal
Registering creates an account. The legal basis throughout is the performance of the user agreement, or steps taken at your request prior to entering into it (Art. 6 (1) (b) GDPR), unless stated otherwise below.
| Data | What for and on what basis |
|---|---|
| Email address | Your unique identifier for signing in, and the recipient of confirmation, password and report emails. |
| Username | Voluntary, only a display name used to address you. You can leave the field empty. |
| Password | We do not store your password, only a check value derived from it (PBKDF2 with a random salt). The password cannot be recomputed from it. We cannot see it either. |
| Sign-in time, registration time | Traceability of the account and your own oversight of active sessions. |
| Failed sign-in attempts | After five failed attempts the account is locked for 15 minutes. That protects your account against systematic password guessing. Basis: legitimate interest (Art. 6 (1) (f) GDPR). The counter resets on the next successful sign-in. |
| Sessions | So that you stay signed in. Only a check value of the session token is stored, not the token itself. You can see your active sessions on the account page. |
| Your domains and their verification | Domain name, verification method and time of confirmation. Verification is mandatory before a domain may be scanned repeatedly – it makes sure nobody has someone else's site monitored under their own identity. |
| Scan jobs and scan runs | Time, resulting score, number of findings and the reference to the result file. The history and the comparison of two runs are built from this. |
| Result files | The complete scan result is held as a file on the same server. It describes your website; it contains personal data only in so far as that data is publicly visible on the scanned site – a contact address in the legal notice, for instance. |
5. Stored credentials for your own system
In the portal you can store access to your content management system or shop for a verified domain, a WordPress application password for instance. Only then does the scan see what stays invisible from outside: exact extension versions, pending updates, user roles.
This is the most sensitive thing we store – and we treat it accordingly.
| Voluntary | Without stored access the scan still runs, just without this inside view. You can remove the access in the portal at any time; it is then deleted immediately and permanently. |
|---|---|
| Only for verified domains | Without confirmed domain verification the form accepts no access. Otherwise it would be a way to park someone else's credentials under any identity. |
| Stored encrypted | The secret exists in the database only as ciphertext (Fernet: AES-128 in CBC mode, secured with HMAC-SHA256). The key for it sits separately in the server environment and not in the database. Whoever captures the database still holds none of your access. |
| Never shown again | Once stored, the portal never outputs the secret again – not even to you. Whoever forgets it enters a new one. A form that displays stored credentials again would be a read-out channel for anyone who takes over a session. |
| Not in the data export | The export under Art. 20 GDPR states that access is stored and of what kind – not the secret itself. An export is a file that travels on by email; a live key has no business being there. |
| What it is used for | Solely for the scan run of your own domain. The scan reads: it changes no content, installs nothing and deletes nothing. |
| Basis | Performance of the scan order (Art. 6 (1) (b) GDPR). |
Our recommendation: store an application password, not your administrator password. An application password can be revoked on its own, opens only the programming interface and not the administration surface, and it works alongside two-factor sign-in. The administrator password remains possible because older installations can do nothing else – it is the worse route nonetheless.
If the scan sees personal data from your installation through this access, the user accounts of your own editorial team for instance, then you are the controller for it and we are your processor. For that case the data processing agreement under Art. 28 GDPR applies, which you conclude when storing access.
6. How long we store
| Data | Retention |
|---|---|
| Account | Until you delete it. We do not delete it of our own accord while you are using it. |
| Scan runs and reports | 24 months from the time of the run. After that a daily job deletes the result file and the history entry. This happens automatically, without you having to do anything. |
| Stored access | Until you remove it, remove the domain or delete the account – whichever comes first. |
| Session | 30 days, or until you sign out. |
| Confirmation link for registration | 24 hours, invalid thereafter. It works exactly once. |
| Password reset link | 60 minutes, invalid thereafter. It works exactly once. |
| Lockout after failed attempts | 15 minutes. |
| IP address for the misuse limit | One hour, in memory only. |
If you delete your account, the scan runs remain as anonymous rows: they then belong to no person, and neither account nor email address is attached to them any more. If you also want the reports themselves removed, delete the respective domain in the portal beforehand – the associated reports go with it.
7. Access, export and deletion – directly in the portal
You do not have to write to us for this. On the account page you will find:
- Data export – all data stored for your account as a JSON file, in a common, machine-readable format (Art. 15 and Art. 20 GDPR). Without the password check value and without stored secrets: both are means of access and not information about your person.
- Delete account – deletes account, sessions, domains and stored access immediately and irreversibly (Art. 17 GDPR). There is no follow-up email; the confirmation in the form is the last chance to turn back.
- View sessions – which sign-ins are currently active.
8. Audience measurement with Matomo
We measure which pages are called – without cookies, without a consent banner and without your address ever arriving anywhere in full. For this we use Matomo, open-source software that we operate ourselves. It is not Google Analytics and not a service of an outside company.
| No cookies | Matomo runs here in cookie-free mode
(disableCookies). Nothing is stored on your
device and nothing is read from it. That is why § 25 TDDDG
does not apply, and why there is no consent banner. |
|---|---|
| Address shortened before it leaves us | Your IP address is shortened on our web server – for IPv4 to
the first two blocks (203.0.113.42 becomes
203.0.0.0), for IPv6 to the first 48 bits. Only
this shortened form reaches the analysis. The full address is
stored nowhere. This is not a setting that could change by
accident but is fixed in the software. |
| On our own domain | The counter is delivered by websecureaudit.de
itself and the measurements go to
websecureaudit.de. Your browser builds no
connection to an outside domain. The server running the
analysis is our own and also stands in Germany. |
| Do Not Track is respected | If you have activated “Do Not Track” in your browser, nothing is measured. You need do nothing further. |
| What is collected | Page called, referrer, time, shortened IP address, browser type, operating system and screen size. No names, no addresses, no form entries. |
| Basis and duration | Legitimate interest in designing the website to suit demand (Art. 6 (1) (f) GDPR). The measurement data is deleted after 12 months. |
| Objection | Activate “Do Not Track”, or write us an informal email to info@websecureaudit.de (Art. 21 GDPR). |
Why we disclose this although it would go unnoticed: among other things we check other people's websites for whether they declare their measurement tools correctly. What we ask for there applies here first.
8a. Cookies
websecureaudit.de sets no cookies and stores nothing on your device – the audience measurement included, see above. No advertising tools are embedded, and no content is loaded from outside servers: no external fonts, no CDN scripts, no embedded maps or videos.
app.websecureaudit.de sets exactly one cookie as
soon as you sign in: wsa_sitzung. It holds your session
token, is valid for 30 days, cannot be read by scripts in the
browser (HttpOnly), is transmitted only over HTTPS (Secure) and is
not sent to outside sites (SameSite=Lax). It is deleted when you
sign out.
There is therefore no consent banner on either site, and for two separate reasons. The audience measurement stores nothing on your device and reads nothing from it – but § 25 TDDDG presupposes exactly that and therefore does not apply here. And the sign-in cookie in the portal is exempt from consent under § 25 (2) no. 2 TDDDG because it is strictly necessary for providing the service you expressly requested – without it there is no sign-in. We store nothing else on your device.
The PayPal donation button is an ordinary link. Only when you click it do you reach PayPal; PayPal's privacy notices apply there.
8b. If you buy additional scans
If you buy additional scans, payment is handled through PayPal. The following data is processed:
| Transmitted to PayPal | Amount, currency and the scanned domain as the payment reference. You enter your payment details exclusively at PayPal – account or card details never reach us. |
|---|---|
| Stored with us | PayPal's order number, the domain, the amount, the payment status and the time. With this we can show what the scans were unlocked for. |
| Basis | Performance of the purchase contract (Art. 6 (1) (b) GDPR) and retention duties under commercial and tax law (Art. 6 (1) (c) GDPR). |
| Retention | Payment records 10 years under § 147 AO and § 257 HGB. This period takes precedence over deletion on request – we may not shorten it. |
| Third country | PayPal is a provider seated outside the EEA (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg, with group ties to the USA). The transfer relies on Art. 49 (1) (b) GDPR: it is necessary for the performance of the contract you conclude with us. PayPal's privacy notices apply in addition. |
If you only use the free scan, none of these records comes into being.
9. Purposes of processing at a glance
- Carrying out the requested scan of a domain
- Delivering the report to the email address given
- Running an account with history and repeated scans
- Proving that a domain is attributable to you
- Handling enquiries through the system audit form
- Limiting misuse and operating securely
- Cookie-free audience measurement for designing the website
- Handling the purchase of additional scans
No processing beyond this takes place. There is no automated decision-making and no profiling. We do not use your address for advertising and do not pass it on.
10. Data protection officer
No data protection officer has been appointed: the conditions of Art. 37 GDPR and § 38 BDSG are not met. For all data protection questions you reach the controller directly at info@websecureaudit.de.
11. Recipients
Website, portal, database and mailbox are operated at Mittwald CM Service GmbH & Co. KG, Königsberger Straße 4–6, 32339 Espelkamp. The company acts as a processor under Art. 28 GDPR; a corresponding agreement is in place. The servers stand in Germany.
Your data is not passed on to any further third parties. We do not sell data.
12. Transfers to third countries
For the free scan, the portal and the audience measurement, no transfer of personal data to a third country outside the EU or the EEA takes place. Website, portal, scan, analysis and mailbox run entirely in Germany.
For completeness we name three points of contact with providers outside the EEA:
- When buying additional scans, payment data is transmitted to PayPal – see section 8b. This concerns only those who actually buy.
- The donation button links to PayPal. It is an ordinary link: as long as you do not click it, no data is transmitted to PayPal.
- To measure load time, the scan may call Google's PageSpeed Insights interface. What is transmitted is solely the address of the publicly reachable page being scanned – no data about you, no email address, no visitor's IP address. If the interface is not set up, the call does not happen, and the report says so.
13. What happens during the scan
The scan calls the domain given the way a visitor or a search engine would: read-only, without intervening in the system. No vulnerabilities are exploited. If you have stored access under section 5, the scan additionally signs in to your own system – likewise read-only.
For the free single scan the report is sent and then discarded. In the portal it is retained as described in section 6.
14. Data security
- All connections run exclusively over HTTPS.
- Passwords exist only as a PBKDF2 check value with a random salt.
- Session and one-time tokens are held in the database only as a check value.
- Stored access is encrypted; the key sits separately from the database.
- Forms are protected against cross-site request forgery (CSRF tokens).
- The scan refuses targets on the internal network, so that it cannot be misused as a tool against third-party systems.
15. Your rights
- Access to the data processed about you (Art. 15 GDPR)
- Rectification (Art. 16) and erasure (Art. 17)
- Restriction of processing (Art. 18)
- Data portability (Art. 20)
- Objection to processing based on legitimate interests (Art. 21)
- Withdrawal of consent given, with effect for the future (Art. 7 (3)) – an informal email is enough
For access, export and deletion the quickest route is the account page in the portal (section 7). For everything else an email to info@websecureaudit.de is enough.
Right to lodge a complaint with a supervisory authority; the one responsible for us is: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Straße 22, 20459 Hamburg.
16. Status
This policy is as of 22. August 2026. If something about the processing changes, we change it with it.