Privacy notice

1. Controller and contact

Mateusz Konieczny — Balance IT, a sole trader, ul. Święty Marcin 29 lok. 8, 61-806 Poznań, Poland. Polish tax ID (NIP): 7812090221; REGON: 541862820. Service, complaints and privacy contact: kontakt@balanceit.pl.

2. Data we process

We receive the domain you enter, your selected language and requests to the service. The scanner reads a limited public response and its HTTP headers. It stores addresses, timestamps, findings, technical evidence and a random report identifier. It does not archive the complete HTML or cookie values from the checked website.

The Pro test process also records selected URLs, a DNS verification record, verification results and times, the authorization version, approved scope, progress and results. If you contact us, we process your contact details and message.

The network layer receives your IP address. In the Cloudflare version, the application stores a daily hash of the IP and counters to limit abuse. This hash is pseudonymous, not anonymous. IP addresses are not stored in reports or orders. Do not submit URLs containing passwords, tokens, confidential information or special-category personal data.

3. Purposes and legal bases

We process data necessary to perform your requested free check, provide its result and handle your service request under Article 6(1)(b) GDPR. Business contact details, service security, abuse prevention and necessary dispute records rely on the operator’s legitimate interests under Article 6(1)(f): handling contact, protecting the service and establishing or defending claims.

Any third-party personal data in a public response is processed only as needed for the technical assessment of an authorized website, based on the legitimate interest in that assessment. We do not build profiles of those people. Handling statutory rights and legally binding requests relies on Article 6(1)(c) GDPR.

Authorization to check a domain defines the technical scope; it is not blanket consent to process data for any purpose. Providing data is voluntary, but we cannot perform a check or verification without the address and information required for that step.

4. Retention and deletion

A free report is accessible for 7 days after creation. A Pro draft expires after 30 days; saving a result, including a retest, sets expiry to 30 days after that save. The report or order shows the current expiry. A retest has a separate 14-day window from the first result. A DNS challenge is valid for 24 hours; the verification record remains part of the order until it expires.

Access is blocked after expiry. Working data is removed by scheduled cleanup, normally hourly, or on access; an outage can delay physical deletion. Limit counters expire after a minute or a day and are cleaned during requests and scheduled maintenance. Removing active records does not instantly remove every copy: Cloudflare documents a 30-day recovery window for SQLite Durable Objects. Data may therefore remain in recovery history for up to 30 days after removal from the active database.

Correspondence is retained until the matter is closed and for up to one further year. Data needed for a specific dispute or legal obligation may be held longer, until that purpose ends. Downloaded report copies remain under your control.

5. Providers and transfers

In the online version, Cloudflare, Inc. and its subprocessors provide hosting, networking and result storage. They may process data outside the EEA. Cloudflare’s data processing addendum provides transfer mechanisms including EU Standard Contractual Clauses. Contact us for details or a copy of the applicable safeguards. We do not claim that all data stays exclusively in the EU.

Email providers process correspondence. Competent authorities may receive information when legally required. DNS and website reads reach the checked domain’s infrastructure, whose operator may log that connection. Results are available to the user and anyone given the private link.

In a local preview, reports and drafts are stored as files on the computer running the application rather than in Cloudflare’s database. If a clearly labelled Stripe TEST checkout is available, opening it sends Stripe a test order identifier, scope hash, language and test amount. Do not enter real card details. An ordinary free scan does not require Stripe.

6. Private links and network data

There is no public report directory. The random link is an access key: anyone who knows it can read the result. An order link also permits further actions within its scope. Share it only with authorized people. Contact us to request deletion; we may need to verify your entitlement before acting.

The application contains no advertising, marketing analytics or its own tracking cookies. Your animation preference is stored in the tab’s sessionStorage after you use the motion control, so it survives a refresh. This preference is not sent to the server. Disabled application logging does not stop Cloudflare from processing network, security and operational data. Its policy explains that processing: https://www.cloudflare.com/privacypolicy/.

7. Your rights

Subject to the GDPR conditions, you may access, correct, erase, restrict and port your data. You may object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing.

Contact kontakt@balanceit.pl. We respond without undue delay, normally within one month, and notify you within that period of any justified extension. You may complain to the Polish supervisory authority, President of UODO: ul. Stanisława Moniuszki 1A, 00-014 Warszawa, Poland; https://uodo.gov.pl/pl/p/kontakt. The automated website assessment is not used to make decisions about you with legal or similarly significant effects.