Privacy

Pokestock, trading as TitanScan Pro, is the data controller. The full address and registration details are at the bottom of this page. For anything about your data, write to support@titanscanpro.com.

• The website address you submitted, and everything the scan read from that public website — headers, certificate details, DNS records, and content from its pages.
• A one-way hash of your IP address, used only to enforce the daily scan limit and to stop abuse. We do not store the address itself, and the hash cannot be turned back into it.
• Ordinary server logs kept briefly for security and debugging.

The lawful basis is our legitimate interest in providing the service you asked for and keeping it from being abused.

Note that a scan result describes a website, and a website is usually not personal data. If the site you scan happens to expose personal data publicly, the report may quote it — because that is the finding.

• Your email address, so we can send you the report link. This is the delivery of the thing you bought.
• Your country, and your company name and VAT number if you give one, because tax law requires us to determine and record where a sale happened.
• The amount, the currency, the tax, the time, and Stripe's identifiers for the payment.
• The moment you ticked the immediate-delivery box, which is our record that you consented.

Card and bank details never reach us. Stripe collects and processes them; we receive only the outcome of the payment. The lawful basis is performance of our contract with you, and — for the tax and invoicing parts — our legal obligation.

• Your email address, to send you the monthly results and the link to your monitor.
• The website being monitored, and the results of the scan we run on it every month.
• Stripe's identifiers for you as a customer and for the subscription, its status and renewal date, so we know whether to keep scanning.
• The moment you ticked the immediate-start box, which is our record that you consented.

The lawful basis is performance of our contract with you and, for invoices, our legal obligation.

The email address and website you enter, the kind of cancellation, any reason you give and the time it arrived. We use them to find and end your subscription and to confirm it to you, and we keep the confirmation as proof of the cancellation. The lawful basis is performance of the contract and our legal obligation to accept and confirm cancellations.

Cookies of our own, each strictly necessary for something you asked for, which is why you are not asked to consent to them:

• After you buy a report: the access token for that report, so the page knows you paid.
• After you open your monitor link: the access token for your Site Monitor.
• Only when you pick a language with the language switch: your choice (tsp-locale), kept for a year so you are not sent to another language again.

Google Analytics, only if you click “Accept” in the cookie bar. It tells us how many people visit and which pages they use. It sets Google Analytics cookies (_ga and _ga_*), with IP anonymisation on and advertising features off. If you click “Decline”, nothing from Google is loaded at all. We set no advertising cookies. The lawful basis is your consent, which you can withdraw at any time by clearing this site's data in your browser; the cookie bar will then ask again.

Your browser may also store your light or dark theme preference. That never leaves your device and we cannot read it.

Only the suppliers that make the product run. Netlify, Neon and our email providers process data on our behalf under a data processing agreement. Stripe and Google are responsible for some processing themselves (Stripe, for example, for the payment and fraud prevention), under their own privacy terms:

• Stripe — payment processing, tax calculation and invoicing.
• Netlify — hosting and content delivery.
• Neon — the database, hosted in the EU.
• Google — website analytics (Google Analytics 4), only after you accept it in the cookie bar.
• Our transactional email provider — solely to deliver your report link and your Site Monitor emails.
• Our email host — for the support mailbox, when you write to us.

Where a supplier processes data outside the EEA, that transfer is covered by the European Commission's standard contractual clauses.

• Anonymous scans and their results: deleted after 30 days unless the report was purchased.
• Purchased reports: kept while the report remains available to you, so your link keeps working.
• Site Monitor: your email address and the monthly scans are kept while the subscription runs and afterwards, so the reports you paid for stay reachable at your link. Ask us and we delete them, apart from what tax law requires us to keep.
• Cancellation confirmations: kept for as long as questions about the subscription could still arise, normally up to five years.
• Payment and invoice records: seven years, because Dutch tax law requires it. This is the one thing we cannot delete on request.
• Rate-limit hashes and server logs: 30 days.

You can ask for a copy of your data, ask us to correct or delete it, object to processing, or ask for it in a portable form. Email us and we will answer within one month. Because there are no accounts, please write from the address you used to buy, or include the report link, so we can find the right records.

If you think we have handled your data badly, tell us first — but you also have the right to complain to a supervisory authority. In the Netherlands that is the Autoriteit Persoonsgegevens.

Everything runs over HTTPS. The report token is stored and compared in a way that resists timing attacks, and it is held in an httpOnly cookie your browser will not expose to scripts. We would be embarrassed to sell a security product otherwise — see how the scanner works for the rest.