Privacy Policy

This document is published in several languages. In the event of any discrepancy between the language versions, the Polish version is binding.

Version 2.3 · Last updated: 29 October 2026

This policy describes which personal data formexposed processes, for what purpose, on what legal basis, to whom it is sent and when it is deleted. We write only what the Service actually does; the retention periods we state are the same ones by which our deletion runs work, and where there is not yet a fixed period, we say so. Functions that have been built but are not switched on are named as such. Because the Service affects several groups of people, each section begins by saying whom it is intended for:

You visit formexposed.com or form.exposed: sections 3, 4 and 5.
You have had a domain checked on the home page: section 6.
Your website has been checked by our crawler: section 7 – it is also our information under Art. 14 GDPR.
You have an account or have been invited to a team: sections 8 to 18.
You visit the website of one of our customers (with a badge, plugin or delivery check): section 20.
You want to exercise a right or make a complaint: sections 26 to 28.

1. Controller and contact

The controller for the processing of personal data on formexposed.com and form.exposed and in the formexposed service, insofar as we are not acting on behalf of a customer (section 2), is:

LW IT Solutions Company Lukas Wójcik
Owner: Lukas Wójcik
al. Tadeusza Kościuszki 80/82, lok. 301
90-437 Łódź
Poland
NIP (Polish tax identification number) 7252266190 · VAT ID PL7252266190
E-mail: contact@lukaswojcik.com

Other ways to reach us are the support window (the question mark in the navigation) and the contact page. Please report security vulnerabilities via our vulnerability reporting page.

Data protection officer: We have not designated one. We are a sole proprietorship; our core activity is checking websites and forms, not large-scale monitoring of individuals or processing special categories of data (Art. 37(1) GDPR). The reasons are set out in the Records of Processing Activities. Please send questions about data protection to the e-mail address above; it reaches the owner directly.

2. What this is about and in what role we act

formexposed checks the contact forms of websites: whether they are protected against spam and abuse, whether enquiries arrive, which third-party services can read along while a form is being filled in, and whether any of this changes. In doing so, we process personal data in three roles. The distinction is not a formality: it determines whom you should contact with a request.

As controller for the data of visitors to our own websites, of our customers and their team members, for billing and support, and for checking websites that do not belong to a customer account (free check, study, prospect check) or whose domain the customer has not yet verified. That is what this policy is about.
As processor for third-party data that our customers have processed via the Service: copies of form e-mails in the delivery check (section 15), subscribers to a client portal (section 14), alert recipients who are not themselves customers (section 10), test accounts for the check behind a login (section 9) and persons who can be seen on a website whose domain a customer has verified (section 7). In those cases the customer is the controller; the Data Processing Agreement, which every customer concludes on registration, applies.
Not at all for what our WordPress plugin and our TYPO3 extension store on a customer’s website and what does not leave that website (section 13). The operator of that website is the controller; we have no access to it.

Where this policy says “customer”, it means the holder of an account with formexposed. Accounts are available only to businesses; anyone can use the free check without an account. The Service is not directed at children.

3. Servers, logs and backups

For everyone who visits our websites or uses the Service.

We operate formexposed on our own servers in Poland: a web server with the database and a scan server on which the crawler and a language model run. Both are in the same internal network. There is no external hosting or cloud provider. Only the owner has access to the servers.

3.1 Web server log

For every request, the web server stores the IP address, date and time, the address requested, the status code, the amount of data transferred, the previously visited page (referrer) and the browser identifier (user agent). This also applies to requests for the badge from customers’ pages (section 12). The logs are rotated daily and deleted after 14 days.

3.2 Page view log

In addition, the application records every page view, but not background requests, interfaces or the badge: IP address, the country derived from it, the address requested and the referrer (we mask access tokens in them, such as those of report or portal links, before storing), the browser identifier and the information derived from it on device type, operating system and browser, the language and – if you are signed in – your account number. We determine the country using a database on our own server; the IP address does not leave the server for this purpose. If our support views your account (section 8.5), these page views are not attributed to your account. We delete the entries after 60 days.

3.3 Error log and error alert

We record technical errors with the time, level, source, message, technical context and, where applicable, your account number, and delete them after 90 days. If a new type of error occurs, the Service sends the owner an e-mail with the raw text of the message (up to 400 characters, not sanitised) and a short notification via Telegram; if errors accumulate, only the notification; in addition, there is a daily overview of the error types by e-mail. The Telegram message is a fixed sentence without the content of the error, without an address and without information about individuals. For each type of error, we keep one example of the message, currently without a fixed retention period; we will set a deletion period and state it here. Error messages are not supposed to contain personal data; we cannot rule it out, for example if a message reproduces an address that was entered.

3.4 Backups

The database is backed up every night after the deletion run has finished; a backup therefore contains nothing that should already have been deleted under these retention periods. Backups are currently kept at the same location as the database and are not separately encrypted; an encrypted copy at a second location is planned. They expire after 14 days. What we delete in the live system remains in the backups until then. Nothing is selectively removed from a backup; it serves only for restoration after a loss.

Purpose and legal basis: operation and security of the Service, defence against attacks and abuse, troubleshooting, restoration and usage figures. For the latter, we record only daily totals (such as registrations per day), nothing about individuals; we do not use any analytics or tracking service. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure and stable operation.

4. Cookies and storage in the browser

For visitors to our websites and users of the Service.

Name	Type	Purpose	Duration
`bpid`	cookie	Session: keeps you signed in, protects forms against forged requests (CSRF) and counts the limits per session for the free check	until you close the browser
`bp_remember`	cookie	only if you choose “Stay signed in” when signing in: keeps you signed in	30 days
`bp_theme`	local storage	whether you have chosen the light or the dark theme; for signed-in users the choice is also stored in the account	until you delete your browser data

This storage is strictly necessary for the Service that you have expressly requested to function; no consent is required for it (Art. 5(3) of Directive 2002/58/EC as implemented nationally, in Germany § 25(2) no. 2 of the Telecommunications Digital Services Data Protection Act (TDDDG), in Poland Art. 399 of the Electronic Communications Law, Prawo komunikacji elektronicznej). The legal basis for the associated processing is Art. 6(1)(b) GDPR if you are signed in, otherwise Art. 6(1)(f) GDPR; our legitimate interest in that case is protecting our forms against forged requests, enforcing the limits of the free check and showing the display you have chosen.

We do not set cookies for advertising or audience measurement. A referral code from the partner programme (section 18) travels in the address up to registration, not in a cookie. Google reCAPTCHA may use its own cookies when a form is submitted (section 5).

5. Google reCAPTCHA and our own form protection

For everyone who submits one of our forms.

We protect the forms for the free check, the header tool, the exclusion of a domain (opt-out), sign-in, registration, requesting and setting a new password, and support and contact against automated attacks with Google reCAPTCHA v3. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

We load Google’s script only when you submit one of these forms, not as soon as a page is opened. It then reads information about the browser, the device and the use of the page and transmits it, together with your IP address and any Google cookies, to Google, which assesses whether a human is submitting the form. We receive only this assessment as a score, together with the action it applies to. If it is below our threshold, belongs to a different form or Google does not respond within three seconds, we refuse the submission; we do not store the score. You can try again or write to us by e-mail. Google may transfer data to Google LLC in the USA (section 22) and decides itself how long it keeps it; more in Google’s privacy policy.

In addition, these forms – except the one for setting a new password – contain our own protection without third parties: a trap field invisible to humans and a signed timestamp by which forms submitted too quickly are recognised.

We also protect the forms for the free check, registration, sign-in and requesting a new password with our own form protection formconfirmed, which likewise involves no third parties. When the page opens, a small script from our server fetches a signed task; as soon as you use the form, your browser solves it in the background (a proof of work). The result is sent to us with the form as a single-use check token, and we verify it when you submit. In doing so we process your IP address, the address of the page with the form, the times involved and whether a field invisible to humans was filled in. For this purpose we store the IP address only in shortened form (for IPv4 without the last byte, for IPv6 only the first 48 bits) and as a hash with a key that changes daily, in order to recognise repeated requests; this value is deleted after one hour, the used check token after eleven minutes at most. The form protection does not assess the content of these forms. It sets no cookies, stores nothing in your browser and creates no fingerprint of your device. If a valid check token is missing, we refuse the submission; if our service was not reachable for the task, we allow it.

Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is protecting these forms against abuse by programs, above all against mass guessing of passwords, automatically created accounts and the use of the free check as a tool against third-party websites. Because Google’s script is loaded only when you submit the form and serves only that submission, we consider reading the information from your device to be strictly necessary in order to provide the service you expressly request by submitting the form (§ 25(2) no. 2 TDDDG, Art. 399 Prawo komunikacji elektronicznej). The same applies to our own form protection: in the browser it processes only what is needed to submit the form you are using. It is intended to replace reCAPTCHA in the long term. Requirement: without reCAPTCHA and our own form protection the form cannot be submitted; e-mail remains available for enquiries.

6. Free checks without an account

For everyone who checks a domain on the home page or uses the header tool.

6.1 The free check

On the home page you can have a domain checked without an account. For this we process:

the domain entered and the result of the check (report; what the crawler collects in doing so is set out in section 7);
your IP address, its country, a hash of your session (not the session itself), the time and whether the request was accepted, in order to enforce the limits (only a few checks per day per address and session; a domain that has already been checked in the last few days gets the same report instead of a new check) and to detect abuse. We delete these entries after 7 days;
in the case of suspicious behaviour, such as many different domains from one address, a flag containing the IP address or the hash of the session. It is kept until we have reviewed the case and for 90 days thereafter. The owner receives a Telegram notification about it without the domain and without the IP address.

Anyone to whom you give its random link can access the report; search engines are not supposed to index it. We delete it after 30 days together with the check data and screenshots. The free report shows an excerpt; the same things are checked as in the account, but without test submissions.

6.2 The header tool

The security header tool retrieves the home page of a domain twice (via https and via http) and evaluates the response. We store the domain, the result and the grade for 90 days; the same log as for the check applies to the limits (7 days). An excluded domain (section 19) is not checked here either.

Legal basis: Art. 6(1)(b) GDPR for the check you request, and Art. 6(1)(f) GDPR for the limits and the prevention of abuse; our legitimate interest is that the Service is not misused as a tool against other people’s websites. Requirement: no check without a domain; without an IP address the server cannot respond to you.

6.3 Feedback on a report

For everyone who uses “Is something wrong in this report?” below a report, with or without an account.

Below every finished report you can tell us that a form is missing, was classified incorrectly or that a single check has the wrong result. For this we process:

what you enter: the category you choose, if you wish the check concerned, the address of a page and a text of up to 1,000 characters;
the report the feedback refers to (identifier of the link, check and domain), the language of the page and the time;
if you are signed in, the identifier of your account; we then see the account’s e-mail address next to the feedback;
a one-way checksum of your IP address (formed with a secret key), so that only a few reports arrive from one address (5 per hour, 20 per day). We do not store the IP address itself with the feedback; we clear the checksum after 2 days.

We do not ask for an e-mail address, and we do not reply to feedback. If you would like a reply, please write to support (section 17). Please do not enter personal data in the text. We read the feedback, classify it and, where useful, take the check data of the report (form fields, reasons and findings, without screenshots) as a test case for our detection; such a test case describes the checked website, not you. Feedback does not change the report.

Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is to find and fix errors in our detection, and the limit protects against abuse. Requirement: feedback is voluntary. Retention: 24 months; immediately with your account.

7. Checking websites with our crawler – information under Art. 14 GDPR

For operators of checked websites and for persons whose details appear on a checked website. You did not give us this data yourselves; that is why we inform you here.

7.1 What the crawler does

Our crawler FormExposedBot retrieves no more than eight public pages of a website per check, one after the other, just as a visitor with a browser does. In addition, there may be up to three pages that it reloads in order to click “Reject” in the cookie banner, up to three pages in a phone view, for verified domains the test submissions (section 7.3) and up to five pages behind a login (section 9.4). Before the check, it reads the robots.txt: if a Disallow for FormExposedBot or for all programs excludes the home page, it does not check. It does not currently observe blocked subpaths individually. It identifies itself as FormExposedBot in its browser identifier. It examines the forms and stores:

the addresses and titles of the pages checked, the structure of the forms (field names, field types, labels, required and visibility attributes, no values; it reads the beginnings of pre-filled hidden fields and of data attributes only during the check and does not store them) and the protective measures found;
technical characteristics of the pages: CAPTCHA and spam protection services used, embedded scripts of third-party providers (address and checksum), the hosts from which the page loads content, the names of cookies set, security headers, indications of form accessibility, the behaviour of a cookie banner on rejection and whether advertising pixels or session recording are attached to forms;
a screenshot of the visible area of the first page and one of each form found, and after a test submission also one of the response page. These screenshots are not redacted; they show what can be seen on the page.

If a form contains a recipient address, we store only its domain, never the address. We do not store any other content of the pages. Personal data may nevertheless be affected if it is visible on a page or in a screenshot, such as the name and photo of a contact person next to the form. Categories: names, roles, contact details and images that the operator has published itself. We do not look for special categories of data and do not analyse them.

We classify forms using fixed rules (such as “contact” or “newsletter”). Only if the rules produce no result does a language model running on our own scan server help; forms classified in this way are never submitted and do not count towards the score or the verdict. No data is sent to third parties in the process, and the model is not trained with it. More on this at EU AI Act: How formexposed Uses AI.

7.2 Who triggers a check

someone who enters a domain on the home page (section 6);
our WordPress plugin or our TYPO3 extension for its own website, even without an account (section 13);
a customer for a domain in its account (section 9);
an agency for a prospect’s website, without test submission (section 14);
we ourselves for a study on the protection of contact forms, from which we publish only aggregated figures without the names of websites.

7.3 What the crawler does not do

It checks other people’s websites only passively: it does not submit any form, does not try out login details and does not attack anything. It sends test submissions only to contact forms of domains for which a customer has proved in its account that it is entitled to control them – as owner or on the owner’s behalf, via DNS record, meta tag, file or plugin: clearly labelled test messages without personal data, no more than five per check; without such proof, only in internal checks of our own test and demo domains. The search for exposed files, the reading of versions and the check behind a login are likewise available only for verified domains (section 9).

7.4 Retention period

Checks without an account 30 days; checks of a prospect’s website 90 days; checks for a study until its results are published; checks of a domain in a customer account no more than 13 months – the most recent one is kept as long as the domain is in the account – and never longer than the domain is in the account.

7.5 Legal basis and source

The legal basis is Art. 6(1)(f) GDPR. The legitimate interest lies in showing website operators and their service providers weaknesses in their forms before these are used for spam or abuse, in the interest of the person requesting a check in that result and, in the case of the study, in making a statement about the state of form protection. The data comes from publicly accessible sources, namely the checked website itself. Recipients are the person who started the check and anyone to whom that person gives the link to the report, and in the case of a prospect check the agency; from a study we publish only aggregated figures. If a customer checks a domain in its account that it has verified, we act on its behalf (section 2); as long as verification is lacking, we are controller ourselves. We publish this information here and on the FormExposedBot page instead of writing to every visible person individually; that would be impossible or disproportionate, particularly as we know about these persons only what is on the page (Art. 14(5)(b) GDPR).

Objection and exclusion: As the operator of a website, you can exclude further checks of your domain via your robots.txt or via our opt-out page (section 19). Persons who can be seen on a checked page can object to the processing under section 27 and request the deletion of a report or screenshot.

8. Your customer account

For customers and invited team members.

8.1 Registration and account

For an account we process your e-mail address and your password (only as a hash; we do not know the password itself), as well as your first name and – insofar as you provide them – last name and company, plus language, theme, currency, plan, the times of registration and last sign-in and the IP address of the last sign-in. You confirm your e-mail address via a link that is valid for 72 hours; we delete accounts that are never confirmed after 30 days. If you change your e-mail address, the new one applies only after confirmation via a link sent to it.

Legal basis: Art. 6(1)(b) GDPR (contract); for the IP address of the last sign-in, Art. 6(1)(f) GDPR (protection of your account, section 8.2). Requirement: e-mail address, first name and password are necessary for a contract to be concluded; you provide your billing address and VAT identification number only for paid plans, to Stripe (section 18).

8.2 Sign-in and security

sign-in attempts with e-mail address, IP address and result: 7 days, against password guessing; in addition, counters for sign-in attempts per account (for an unknown address, per address entered), per account and IP address and per IP address, for two-factor attempts and password confirmations per account, for password reset e-mails per e-mail address, for registrations per IP address and for attempts at the password of a client portal per portal and IP address, which we store only under a pseudonymous key (HMAC), without the e-mail or IP address in clear text, and which expire with their time window (currently 15 minutes, one hour for password resets and registrations);
signed-in devices with IP address, browser, operating system and device type, so that you can see them in the settings and sign them out: up to 90 days after last use;
if two-factor sign-in is switched on, the secret for it (encrypted) and your recovery codes (only as a hash);
links for resetting the password are valid for one hour;
an activity log of important actions, such as “domain created”, “alert set up” or “settings changed”, with time, acting account, IP address and country: 365 days.

Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is protecting your account and the Service and the traceability of changes in a workspace on which several people work.

8.3 Record of the conclusion of the contract

On registration, we record which version of the Terms of Service and of the Data Processing Agreement you agreed to and which version of this Privacy Policy you took note of – in each case with the full text, its hash, the time, IP address and browser identifier. This serves as proof of the conclusion of the contract (Art. 6(1)(b) and (f) GDPR). We keep this record for as long as the account exists. After the account has been deleted, we delete it as soon as the consent is four years old, because questions about the conclusion of the contract tend to arise precisely after termination.

8.4 Workspaces, team and invitations

An account works in one or more workspaces. If you invite someone, we send that person an e-mail with the name of the workspace (by default your company name or first name) and a link to accept; for the invitation we also store the intended role and who sent the invitation. The members of a workspace see who belongs to it and in which role. If you are an invited person, we obtained your e-mail address from the member who invited you (Art. 14(2)(f) GDPR). We delete invitations that are not accepted when they expire after 14 days, and accepted ones 30 days after acceptance. A monitored form can be assigned a responsible person from the team and a deadline for the fix; for this we store only the assignment to the account and the deadline. Legal basis: Art. 6(1)(b) GDPR in relation to the customer; in relation to the invited person Art. 6(1)(f) GDPR (the customer wants to work with that person).

8.5 Help from our support

To help you with a problem, our support can view your account as you see it. Every such access is recorded in the activity log and appears in your data export. Legal basis: Art. 6(1)(b) GDPR if you have asked for help, otherwise Art. 6(1)(f) GDPR (troubleshooting).

8.6 Export and deletion

Under Settings you can download the data stored for your account as a JSON file – without password hashes and secrets and without the data of other members. This file does not contain check results, findings and incidents (only the escalation delivery attempts per alert destination); they are available as reports in the account and as a file on request. There you can also delete your account yourself; no e-mail is needed. A running paid subscription ends immediately, as a rule without a refund (exceptions are set out in the Terms of Service); anyone who wants to use the paid period first cancels in the Billing area with effect from the end of the period. If the contract for your account ends in another way, for example through termination by us, you can export your data until the end of the contract, and we delete the account no later than 30 days after the end of the contract. Together with the account, we immediately delete your workspaces with the data attached to them, including domains, check results and screenshots, alerts, incidents, evidence logs, branding, client portals including subscribers, the list of your prospect checks (their reports remain accessible until their 90 days expire), API keys, rollout codes and test logins. If someone else still works in one of your workspaces, that workspace passes to another member – administrators first, and among them the longest-standing one – instead of being deleted. The following remain until their own retention period expires: the activity log and the page view log with the number of your former account, sent e-mails (30 days, section 11), the record of the conclusion of the contract (8.3), support requests (section 17), invoice data for as long as tax law requires, commission data and redeemed activation codes, for which there is currently no retention period (section 18), and the backups (3.4).

9. Domains, checks and monitoring

For customers. Insofar as personal data of third parties is affected, we act on behalf of the customer.

9.1 Domains and verification

For each domain in your account, we store the name, the proof of your authorisation (DNS record, meta tag, file or plugin), the check results and your settings, such as frequency, maintenance window, notes, client label and the estimated value of an enquiry. The frequency depends on your plan and goes up to daily checks.

9.2 Monitoring of publicly available information

Between checks, we query publicly available information about your domain:

DNS records (SPF, DMARC, MX), the TLS certificate and the security headers;
the expiry date of the domain via the RDAP service of the responsible registry; only the domain name is transmitted;
the availability of your form pages (form pulse, every 10, 15 or 30 minutes depending on the plan);
the public status pages of the CAPTCHA and mail services your website uses; we transmit nothing about you in doing so;
known security vulnerabilities in form, CAPTCHA and mail plugins and – weekly for verified domains – in the CMS, plugins and theme, whose versions we read from outside from your home page. The comparison is made against the open WPVulnerability database; only the identifier of a plugin or theme (without version) and the WordPress version are transmitted, not your domain;
daily, whether the addresses of your web server, the address of the server from which your last form e-mail came (from the delivery check) or your domain and the sender domain of that e-mail are listed on DNS blocklists for spam (SpamCop, PSBL, Mailspike, SURBL); only domains and IP addresses of servers are queried, no data of visitors;
if set up, whether Google Web Risk lists your home page as a malware or phishing page; only the address of the home page is transmitted;
weekly for verified domains, whether files are exposed that should never be public (such as a backup of the configuration or a database dump). In doing so, we read at most the first 8 KB of a file in order to recognise it, and store only the path, type and severity of the finding, never the content.

9.3 Form journeys and browser checks

For monitored forms, we store form addresses, selectors, preceding clicks and synthetic check steps, the choice of check browser, and responsibility and due date. Browser checks fill in a form at most up to the point before submission; they do not submit anything and do not trigger any order or payment. Results comprise status, technical error categories, sanitised error messages and timings and may include a small image of the form in which the input fields are masked. This masking exists only in the browser checks; the screenshots of the full check by the crawler are not redacted (section 7.1). Measurements from our check browsers are not measurements of your visitors.

A second, independent probe that confirms results is provided for but not currently set up. It would receive only the domain, the sanitised configuration and the job identifier, never login details, screenshots or visitor data; we will name its operator in advance in the list of Sub-processors.

9.4 Check behind a login

In paid plans, owners and administrators of a workspace can store a test account for their own website for a verified domain so that the crawler can read forms behind the login. The following applies:

The username and password are encrypted on the web server with a key that only the scan server can open; the web server, database and backups contain them only in encrypted form. They are never displayed, logged or output via the interface; the user interface shows only the first character and the length of the username. The encrypted copy attached to a check job is cleared after the run, at the latest after one hour.
The test account is used only by the full check by the crawler, not by the browser checks (9.3).
Behind the login, the crawler reads no more than five specified pages. It does not submit anything, does not take screenshots there (account data may be shown there) and does not follow links for signing out, deleting or cancelling.
If you delete the login, we overwrite the encrypted value and remove it; it also disappears together with the domain.

Use only a test account created specifically for this purpose and containing no real customer data. We process what the crawler sees behind the login on your behalf.

9.5 Further functions

Script inventory: If you switch it on, we keep a list of the scripts on your form pages with address and checksum, report new or changed ones and, when one is approved, store who approved it, when and with what justification. Accessibility: From the last check, the Service can generate a draft of accessibility information for your forms; company details you enter for this remain in your browser. Benchmarks: For an industry comparison, we evaluate the results of all customers only in aggregated form; individual websites do not appear in it.

Legal basis for section 9: Art. 6(1)(b) GDPR; for personal data of third parties that becomes visible during a check, your instructions under the Data Processing Agreement. Retention period: domain, verification, settings, form journeys and test login until you delete them, the domain or your account; script inventory and its changes until you delete the domain or your account (there is no separate retention period for them); check results, results of the browser checks and timings no more than 13 months (the most recent check is kept as long as the domain is in the account).

10. Notifications

For customers and the recipients they enter.

We send alerts and reports to the destinations you set up: e-mail addresses, your own webhook addresses, Slack, Discord, Microsoft Teams, Google Chat or Telegram. Chat channels and webhooks are available in the Pro and Business plans. A message contains the domain, the event, a short description and a link into your account, for check alerts the report link, through which results and screenshots can be accessed without signing in (Telegram receives only the link to the domain page in your account, which requires signing in); no content from form e-mails. We store:

the destinations (e-mail address, webhook or chat address; for webhooks, a secret for signing) until you delete them or the domain;
a dispatch log with time, event and result: 90 days;
collected notifications for daily and weekly reports: up to 30 days after dispatch;
incidents with an acknowledgement link: while unresolved, then 180 days after resolution. Whoever acknowledges an incident is recorded with the name entered or their e-mail address. Unacknowledged incidents can be escalated to further destinations; for this we store, per destination, the number and times of delivery attempts (at most five), whether delivery succeeded and any error, for as long as the incident exists. An incident is closed only once the problem has been resolved; acknowledging it alone does not end it.

Telegram: For Telegram we operate our own bot. You link it via a link with a one-time code that is valid for 30 minutes; when you press “Start” in the bot, our server retrieves this message from Telegram and stores the identifier of your chat (chat ID) as an alert destination. Telegram also supplies your Telegram name in the process; we do not store it. We delete the code itself after one day at the earliest, as soon as another code is created. The chat ID is kept until you delete the alert or the domain.

Chat services process the messages under their own terms and your contract with them; some are based outside the EU (section 22). For recipients who are not themselves customers, we act on your behalf; please inform them.

Legal basis: Art. 6(1)(b) GDPR; for recipients who are not customers, your instructions. Requirement: no alert without a destination; the checks run nonetheless.

11. E-mails from us

For customers and everyone we write to.

We send e-mails to confirm your address, to reset your password, for invitations, alerts and reports, as acknowledgements of support requests and with notices about your account and your billing. Sending and receiving our e-mails is handled by Namecheap, Inc. (Private Email), Phoenix, Arizona, USA. Our domain and its DNS records are managed by Namecheap, Inc., Phoenix, Arizona, USA; until the mailbox at Namecheap, Inc. (Private Email), Phoenix, Arizona, USA is set up, Namecheap also forwards general e-mails to addresses at our domain. The control copies of the delivery check do not pass through it. We keep sent e-mails, including recipient, subject and content, for 30 days so that we can resolve delivery problems; not longer, because they also contain valid confirmation and reset links.

Three e-mails are sent without your express request:

Monthly report: at the beginning of the month, an overview of the checks and notifications for your domains. You can unsubscribe from it in the settings.
Set-up reminder: a single e-mail between two and fourteen days after registration if your account is confirmed but does not yet have a verified domain – “Add website” or “Verify domain”, without any offer, price or upgrade. It is not sent again.
End of the trial: three days before a trial ends, a notice of what happens afterwards.

Legal basis: Art. 6(1)(b) GDPR for e-mails that form part of the contract, including the monthly report and the trial notice; for the set-up reminder Art. 6(1)(f) GDPR, because an account without a domain cannot use the Service and many customers simply forget to set it up. We do not send advertising.

12. Badge and evidence log

For customers who use the badge or the evidence log, and for visitors to websites with a badge.

Badge: If you embed our badge on your website, the browser of every visitor to that page loads the badge image from our server. In the process, we receive the usual connection data – IP address, time, browser identifier and the page on which the badge appears – which end up only in the web server log (14 days, section 3.1), not in the page view log. The badge sets no cookies, starts no session and contains no script. The public confirmation page shows the domain, level and date of the last check, no individual findings; anyone who opens it is a visitor to our website (sections 3 and 4). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is delivering the badge that the customer embeds. The customer mentions this in its own privacy policy (text blocks).

Evidence log: In paid plans you can generate a log of the checks for each domain and each month. Under its verification number, a public page confirms the domain, period and key figures, without details. So that it can later be determined whether a log has been altered, we have it signed by a timestamping authority. We transmit to it only a hash of the log, from which no content can be recovered; at present these are Certum (Asseco Data Systems S.A., Poland) and, as a fallback, DigiCert, Inc. (USA). Logs are kept until you delete the domain. The legal basis is Art. 6(1)(b) GDPR.

13. WordPress plugin and TYPO3 extension

For customers who use the plugin or extension, and for visitors to their websites.

13.1 What stays on the customer’s website

Our plugin for WordPress and our extension for TYPO3 run on the customer’s server. What the WordPress plugin stores there stays on that website; we have no access to it, and its operator is the controller:

Quarantine: submissions that the protection layer holds as spam, including field contents and reply address, for up to 14 days, so that a message held wrongly can be delivered with one click;
Safety net: copies of form e-mails that could not be sent (recipient, subject, text and header lines such as the reply address; attachments by name only), for up to 30 days, so that they can be sent again;
Computational puzzle: the visitor’s browser solves a small task set by the website itself; no cookie, no third-party service;
Retention period: on request, the plugin deletes stored enquiries of certain form plugins after 90, 180 or 365 days;
Form counts (off by default): views, starts, validation errors and submission attempts per form, and, if separately switched on, error categories per field position – without entries, field names, cookies or persistent visitor identifiers, for no more than 14 days on the website. An identifier derived from the IP address for limiting requests expires after one minute and is not sent to us;
Visitor help (can be switched on separately): after a sending error, a notice leads back to the form, which is still open, and, if desired, names an e-mail address; it does not read any entries, does not store drafts and does not resend anything on its own;
new spam rules can count locally for seven days without holding anything.

The WordPress plugin itself adds suitable paragraphs to the WordPress privacy policy guide; further texts are available at Privacy Policy Text for Your Website. The TYPO3 extension stores no form content; it adds a meta tag to every page for verifying the domain, and it counts.

13.2 Recorder

With the recorder, a signed-in WordPress administrator records the route to a form on their own website. It keeps technical selectors and navigation steps in their browser’s session storage for no more than 15 minutes and transfers the selected configuration to the connected account. It does not read any entries. The recorder is never loaded for visitors.

13.3 What is sent to us

The plugin and extension transmit to us – depending on the function and, except for a check of one’s own website without an account, only while the website is connected to an account:

the host name, a public key and a secret with which the website identifies itself, the versions of the plugin and CMS, and the language;
daily figures: submissions blocked per reason, submissions accepted, e-mails sent and failed with the type of error, figures on reCAPTCHA responses and on automatically deleted enquiries; if counts are switched on, their daily figures;
characteristics of the form settings as figures, such as how many forms use the visitor’s address as the sender, and the versions of certain form, CAPTCHA and mail plugins from a fixed list;
updates, activations and deactivations of plugins, themes and CMS with names and versions, maintenance mode and the failure of a form e-mail (only the type of error);
the configuration of a form journey selected by the recorder;
for swarm protection (switched on by default), the domains of links in blocked messages. The reports from many websites produce a list of spam domains that all connected plugins retrieve. We do not transmit IP addresses or networks of senders for this.

The plugin and extension do not transmit any form content other than these link domains, nor e-mail addresses, names or IP addresses of visitors. We delete the daily figures and change reports after 13 months, the swarm protection signals after 30 days; information from a website that does not belong to any domain in an account after 90 days without contact.

Legal basis: Art. 6(1)(b) GDPR; for swarm protection Art. 6(1)(f) GDPR (joint defence against spam across many websites). This information is personal data only in exceptional cases, for example if a host name contains a person’s name.

14. Functions for agencies

For agencies and for the people who come into contact with their portals and reports.

Client portal: An agency can give its clients access to a portal with the results for their domains. Anyone who subscribes to the monthly report there provides their e-mail address and confirms it via a link (double opt-in). We store the address, the language, the time and IP address of the subscription, the time of confirmation and the month last sent. We delete unconfirmed subscriptions after 30 days. Unsubscribing is possible at any time via the link in every e-mail; after that, we keep the record of the subscription for a further three years, but no longer than until the agency’s workspace is deleted; if the agency only revokes the portal, the subscribers remain stored. The portal and reports appear under the agency’s name; the agency is the controller, and we act on its behalf. The agency’s legal basis is the subscriber’s consent.
Own branding: the company name, website, contact details, colours and logo that an agency stores appear on its reports and in the portal until it changes or deletes them.
Own domain: In the Business plan, an agency can show the portal and reports under its own subdomain. For this, we check its DNS records daily. The function is not currently enabled.
Prospect check: An agency can have a prospect’s website checked without a test submission (section 7). It passes on the link to the brief findings itself; we do not write to anyone. We delete the check after 90 days. The agency alone is responsible for contacting the prospect.
API keys and rollout codes: We store them only as a hash with a short prefix, together with their label, the time of last use (API keys) or the number of redemptions (rollout codes) and the number of calls per minute (for at least one day; deleted on later calls).

Legal basis: Art. 6(1)(b) GDPR in relation to the agency; for subscribers and prospects, see above.

15. Delivery check

For customers who switch it on, and for visitors to their websites. For the visitor data, we are the customer’s processor.

The optional delivery check answers the question of whether the e-mail from a contact form is really sent. For this, the customer enters one of our control addresses as a blind copy (BCC) in the mail settings of its form. As a result, we receive not only our own test submission but a copy of every form e-mail – including genuine enquiries from its visitors with their names, addresses and messages.

What we do with them, and only that: an automatic retrieval reads the headers and at most the first 8 KB of the text, assigns the e-mail via the control address to a domain and, where applicable, to a test submission, and checks the authenticity features SPF, DKIM and DMARC. After successful processing, the e-mail is deleted. If retrieval or deletion fails, an e-mail may remain in the mailbox until the next successful run; the mailbox is hosted by our mail service provider (Namecheap, Inc. (Private Email), Phoenix, Arizona, USA). The copies are evaluated only automatically.

In our database we store only the time, the domain assignment and, where applicable, the identifier of the test submission, for 180 days, and the technical authenticity result (SPF, DKIM, DMARC) of the most recently received e-mail until the next e-mail replaces it or the domain is deleted. This authenticity result includes the IP address of the sending server and the sender’s e-mail domain; this domain is named in an alert to the customer only if it does not belong to the website. If a form enters the visitor’s address as the sender, this is the domain of the visitor’s e-mail provider. We do not store the content of the e-mails or full sender addresses. If no copy arrives within a few hours after a test submission, we report this to the customer.

Receipt proves only that the assigned copy has arrived in our control mailbox – not receipt by the actual recipient and not an entry in a CRM. Forms through which special categories of personal data pass (such as health information) should not be connected to the delivery check. The customer informs its visitors about this data flow; a text for this is available at Privacy Policy Text for Your Website. Without a control mailbox set up, the check is not available.

Legal basis: for the customer, typically Art. 6(1)(f) GDPR (reliable receipt of enquiries); we process on its instructions (Art. 28 GDPR).

16. Language model on our own server and “Fix it for me”

For customers and users of the free check.

A language model runs on our own scan server, not at an AI provider. It helps to classify forms (section 7), summarises scan findings as a prioritised action plan for paid accounts and, with “Fix it for me”, inserts protection into form code that you paste in. The code pasted in is processed only for this request, is not stored and is not used for training; in the activity log we record only that the function was used, with the programming language, the length of the code and the result (also for the daily quota). Please do not paste in login details or personal data. “Fix it for me” works without access to your website; you insert the code yourself. More at EU AI Act: How formexposed Uses AI. Legal basis: Art. 6(1)(b) GDPR.

Action plans in paid reports. For eligible checks of domains in paid accounts, the same local model also writes a short prioritised action plan from the hostname, overall result and score, CMS, relevant form type and page address, any identified plugin and selected failed or unclear findings. It does not receive screenshots or submitted form values for this purpose. The plan is labelled as an AI summary; the individual findings remain authoritative. It does not change the website or the scan result. The request is temporarily stored in our internal job queue. After the result is collected, the queue entry is deleted; scheduled cleanup also deletes queue entries more than one hour old. The generated text, language, status and timestamp are stored with the scan result and follow its retention period, including retention of the last completed check for each domain and deletion when the domain is deleted.

Roles for the action plan. The same distinction as for the underlying check applies. Where we check a Customer’s verified domain under its instructions, the action-plan stage forms part of that processing on its behalf; where an agency acts for its own client, the existing controller, processor and sub-processor chain applies. For passive checks on unverified domains for which we are ourselves the controller, that role continues to apply. Eligibility for a paid report does not itself prove control of the domain or change the data-protection role. The reference to Art. 6(1)(b) above concerns provision of the requested function to the account holder; it is not a blanket legal basis for incidental personal data of other people. For passive checks where we are the controller, the basis, legitimate-interest assessment and objection options described in section 7 apply, including Art. 6(1)(f). Where we act on the Customer’s instructions, the Customer or other controller must establish its own applicable legal basis. Hostnames, page addresses and finding notes may incidentally contain personal data; the local generation does not make them anonymous.

17. Support, contact and reports of security vulnerabilities

For everyone who writes to us.

If you write to us via the support window or the contact page, we process your e-mail address, your message, the topic chosen, the page from which you are writing, the language, your IP address, its country, the browser identifier and – if you are signed in – your account number, in order to answer your request and to prevent abuse of the form. You receive an acknowledgement by e-mail at the address you provided; if you are signed in, it reproduces the beginning of your message (up to 2,000 characters), otherwise it does not contain your text. Like every e-mail sent, it is kept for 30 days (section 11). A Telegram signal that contains no content and no information about you notifies us of new requests. If you send us an e-mail, we process your address and your message. We handle reports of security vulnerabilities in the same way. We delete requests 24 months after receipt, even if you delete your account earlier; they document what was asked and what was answered.

Legal basis: Art. 6(1)(b) GDPR if the request concerns a contract with us, otherwise Art. 6(1)(f) GDPR (answering, prevention of abuse, evidence). Requirement: without an e-mail address we cannot reply.

18. Payments, trial and partner programme

For customers with a paid plan and for partners.

We bill paid plans via Stripe. The provider is Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. You enter your payment details directly with Stripe; we do not see them. Stripe receives your e-mail address and your name, during checkout your billing address and, where applicable, your VAT identification number, and issues the invoices. We hold only the customer and subscription identifiers at Stripe, the plan, status, the end of the billing period and the identifiers and types of the events that Stripe reports to us.

You can start a trial without a card; without a means of payment it ends automatically. If a host or partner has given you an activation code, we store which account redeemed it and when, and until when the plan applies.

Stripe also processes data as a controller in its own right, for example to prevent fraud and to comply with legal obligations, and may transfer it to Stripe, Inc. in the USA (section 22). More on this in Stripe’s privacy policy.

Partner programme: The programme has been built but is not currently enabled. If it is enabled, the following applies: every account has a referral code. Anyone who registers via a referral link is assigned to the partner for a limited number of months; we store the assignment and its time and, for each paid invoice, the net amount and the commission. The partner sees only figures – how many accounts have signed up, how many are paying and the total of its commissions – no names and no addresses. The Partner terms apply. We currently keep partners’ data, the assignments and the commissions without a fixed retention period, as well as the information on redeemed activation codes; we will set a deletion period and state it here.

Legal basis: Art. 6(1)(b) GDPR; for the retention of invoice data and, where required for tax purposes, commission data Art. 6(1)(c) GDPR; for the assignment to a partner Art. 6(1)(f) GDPR (settlement of the commission). We keep invoice data for as long as tax law requires; under Polish law (Art. 86 in conjunction with Art. 70 of the Polish Tax Ordinance, Ordynacja podatkowa), as a rule until five years have passed from the end of the calendar year in which the tax became due. Requirement: no paid plan without payment details; the free plan remains available.

19. Excluding a domain (opt-out)

For operators of websites who do not want to be checked by us.

Via the opt-out page you can exclude a domain from further checks. The exclusion applies to the domain and its www variant, not to other subdomains, and also as against paying customers who have verified the domain; ongoing monitoring ends with the next scheduled check. Only we can lift it, on request and on proof that you control the domain. We store the domain, the reason given voluntarily, your IP address, its country and the browser identifier. We delete the IP address, country and browser identifier after 12 months; the exclusion itself remains permanently, because otherwise the domain would be checked again. We need this information in order to implement your wish permanently and to recognise whether someone is excluding other people’s domains abusively. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is implementing your wish permanently and recognising abuse of the form. If you intend the exclusion as an objection under Art. 21 GDPR, we implement it in this way.

20. For visitors to our customers’ websites

For people who visit a website, or submit a form on it, whose operator uses formexposed.

The operator of that website is the controller for it, not us. The operator decides which functions to use and must inform you about them in its own privacy policy. The following may reach us:

Badge: your browser’s connection data when loading the image, 14 days in the web server log, without a cookie; here we are the controller for delivering the image (section 12).
Delivery check: a copy of your form e-mail, which is evaluated automatically and deleted; we are the processor (section 15).
WordPress plugin and TYPO3 extension: daily figures with no reference to you and, for swarm protection, the domains of links from blocked messages; quarantine and safety net remain on the website (section 13).
Client portal: your e-mail address if you subscribe to a report there; we are the agency’s processor (section 14).
Form protection (formconfirmed): if the operator uses it, your browser fetches a task from our server when the page opens and solves it in the background; on submission the operator’s server has us verify the result. We process your IP address (stored only shortened and as a hash, for one hour at most; like every request, 14 days in the web server log), the address of the page, the time taken to fill in the form, whether an invisible field was filled in and – only if the operator switches on the content check – the text of your message, which a language model on our own server assesses in memory and does not store. No cookies, no browser storage, no fingerprint. We are the operator’s processor (Data Processing Agreement, Annex 1 no. 10).

It is best to exercise your rights with the operator of the website; the operator knows the context and can instruct us. If you contact us, we forward your request to the operator or deal with it ourselves insofar as we are the controller. What we can and cannot find in doing so is set out in Access, Erasure and Your Other Rights.

21. Recipients

We pass on personal data only where this policy says so. We do not sell, rent or exchange data. Categories of recipients:

Recipient (registered office)	Category	For what
Namecheap, Inc. (Private Email), Phoenix, Arizona, USA	processor; place of processing still to be verified	sending and receiving our e-mails; control mailbox of the delivery check
Namecheap, Inc. (USA)	processor	domain, DNS; until the mailbox is set up, forwarding of general e-mails to our domain (not of the control copies of the delivery check)
Stripe Payments Europe, Ltd. (Ireland), Stripe, Inc. (USA)	largely a controller in its own right; we are still examining the exact allocation of roles	payments and invoices
Google Ireland Ltd., Google LLC (USA)	controller in its own right	reCAPTCHA
Telegram (outside the EEA)	destination chosen by the customer; we send the message via our bot. For us also a notification channel	alerts, if you choose Telegram; operational signals without personal data
Slack, Discord, Microsoft (Teams), Google (Chat), your webhooks (partly USA)	destinations chosen by the customer	alerts
The public	–	report links, confirmation pages, results of the study (aggregated only)
Members of your workspace	users of the same account	collaboration, according to role
Authorities, courts, CERT Polska, advisers	controllers in their own right	only where there is a legal obligation, for the establishment, exercise or defence of legal claims, and in the event of misuse of our Service or attacks on third parties (Art. 6(1)(c) or (f) GDPR)

The following receive no personal data: RDAP services of the registries, found via the IANA directory, and, for the domain age in the free check, the rdap.org relay service (domain names only), WPVulnerability at wpvulnerability.net (only the identifier of a plugin without version, the identifier of a theme or the WordPress version), the status pages of CAPTCHA and mail services (nothing other than the request itself), the timestamping authorities Certum and DigiCert (hashes only), the DNS blocklists SpamCop, PSBL, Mailspike and SURBL (only domains and IP addresses of servers), Google Web Risk, if set up (only the address of the home page), and the other connected plugins in swarm protection (spam domains only). The complete, maintained list of our processors with their registered office and transfer basis is available at Sub-processors; we announce changes to customers 30 days in advance.

22. Transfers to third countries

If a recipient is based outside the European Economic Area, we transfer data only if the conditions of Art. 44 et seq. GDPR are met:

USA: on the basis of the European Commission’s adequacy decision on the EU-U.S. Data Privacy Framework (Implementing Decision (EU) 2023/1795, Art. 45 GDPR), insofar as the recipient is certified under it. Whether Google, Stripe and Namecheap are certified for the services concerned is something we are still verifying for this version, and we therefore do not claim it; where there is no certification, on the basis of the European Commission’s standard contractual clauses (Implementing Decision (EU) 2021/914, Art. 46(2)(c) GDPR).
Our mail service provider: where Namecheap, Inc. (Private Email), Phoenix, Arizona, USA processes the data and on what basis it may be transferred to a third country is something we are still verifying. The current status is given on the Sub-processors page.
Chat services and webhooks that you choose yourself: Slack, Discord, Microsoft Teams, Google Chat and webhooks receive your alerts via an address that you generate in your account with that service; the contractual relationship with the provider and any basis required for the transfer to a third country are your responsibility.
Telegram: destination chosen by the customer; we send the message via our bot. Telegram is based outside the EEA in a country without an adequacy decision, and we do not have standard contractual clauses with Telegram. We are currently having it examined on which basis under Art. 44 et seq. GDPR this transfer rests – Art. 49(1)(b) GDPR comes into consideration, because you choose the channel yourself. Choose Telegram only if that is sufficient for you; e-mail always remains available as an alternative.

You can obtain a copy of the safeguards on which we base a transfer free of charge on request at the address in section 1. The adequacy decision and the standard contractual clauses can also be found in the Official Journal of the EU (eur-lex.europa.eu), and the list of companies certified under the Data Privacy Framework at dataprivacyframework.gov. Our own servers are located in Poland; data that none of the recipients named receives does not leave the EU.

23. Retention periods at a glance

The retention periods are enforced by a nightly run, and for the web server log by its daily rotation. Where it says “with the domain”, the data disappears immediately when you delete the domain or your account. It then remains in the backups for up to 14 days (section 3.4).

Data	Deleted
Web server log (including requests for the badge)	after 14 days
Page view log	after 60 days
Error log	after 90 days
Activity log	after 365 days
Sign-in attempts; limits of the free check and of the header tool	after 7 days
Flags for suspicious behaviour (free check)	90 days after the case has been resolved
Signed-in devices	90 days after last use
“Stay signed in”; accounts never confirmed; accepted invitations (unaccepted ones on their expiry)	after 30 days
Report without an account, including screenshots	after 30 days
PDF version of a report in the cache	after 7 days
Results of the header tool; check of a prospect’s website	after 90 days
Checks for a study	when its results are published
Check results, browser checks and timings for a domain in the account	after 13 months (the most recent check as long as the domain is in the account)
Domain, settings, form journeys, evidence logs, alert destinations, authenticity result of the last form e-mail	with the domain
Script inventory and its changes	with the domain (there is no separate retention period)
Test login for the check behind a login	when you delete it, with the domain; the copy attached to the check job after the run, at the latest after one hour
Daily figures and change reports from the plugin and extension, form counts	after 13 months
Information from a website with the plugin that does not belong to any account	90 days after the last contact
Swarm protection signals; collected notifications for daily and weekly reports (from dispatch)	after 30 days
Counting of API calls; one-time codes for Telegram	after one day at the earliest, on the next call or code of this kind
Alert dispatch log	after 90 days
Delivery check assignments; incidents with acknowledgement and escalation delivery attempts (unresolved ones are kept)	after 180 days, incidents from their resolution
Copies of form e-mails in the control mailbox	after processing; in the event of errors, with the next successful run
Sent e-mails	after 30 days
Support requests	after 24 months
Feedback on a report	after 24 months, immediately with the account; the checksum of the IP address after 2 days
IP address, country and browser identifier relating to an opt-out	after 12 months (the domain remains excluded)
Unconfirmed subscriptions to the monthly report in the client portal	after 30 days
Record of a cancelled subscription	three years after unsubscription
Account and personal details	when you delete them
Record of the conclusion of the contract	as long as the account exists; after its deletion, as soon as the consent is four years old
Invoice data	on expiry of the tax retention period
Partner programme assignments and commissions; redeemed activation codes	currently no fixed period
Example of an error type	currently without a fixed retention period
Database backups	after 14 days
Form protection: shortened, hashed IP address for recognising repeated requests; used check tokens; check results without IP address and without text (action, score, reasons, domain); daily figures without personal reference	after one hour; after eleven minutes at most; after 30 days; after 400 days

24. Obligation to provide data

You are under no statutory obligation to provide us with data. For an account, we need your e-mail address, your first name and a password; without them, no contract can be concluded. For paid plans we need the billing details, for the delivery check a control mailbox, for alerts a destination. All other information is voluntary. The connection data in the logs arises technically with every request; without it, the server cannot respond. What is missing if you do not provide something is stated in the section on the processing concerned.

25. Automated decisions and profiling

We do not make decisions that produce legal effects concerning you or similarly significantly affect you based solely on automated processing (Art. 22 GDPR). We do not create profiles of individuals. Our ratings – risk level, header grade, “protected” in the badge – concern websites and forms, not people.

However, protective mechanisms run automatically that can reject individual requests without a human looking at them: the reCAPTCHA assessment and our own form protection (section 5), the limits and flags for the free check (section 6) and the block after too many sign-in attempts (section 8.2). They only prevent the individual submission; a rejected attempt can be repeated later, and e-mail remains available for any request. If you think a rejection is wrong, write to us; a human will look at the case. We also automatically delete accounts that have not been confirmed 30 days after registration.

26. Your rights

Under the GDPR you have the following rights. For each one, we state the quickest way to exercise it. Unless otherwise stated, an e-mail to contact@lukaswojcik.com is sufficient. We respond without undue delay and in any event within one month of receipt; for complex or numerous requests the period may be extended by two months, in which case we will inform you of this, with reasons, within the first month (Art. 12(3) GDPR). Exercising your rights is free of charge; only for manifestly unfounded or excessive requests may we charge a reasonable fee or refuse to act on the request, and we will give reasons for doing so (Art. 12(5) GDPR). So as not to disclose anyone else’s data, we may ask you to make the request from the e-mail address of your account; we ask for further proof only if we have reasonable doubts about your identity, and only as much as necessary (Art. 12(6) GDPR).

Access (Art. 15 GDPR): With an account, download the data export under Settings; it contains the account, workspace and domain data, your sign-ins, activities, support requests, sent e-mails and consents. You can see check results as reports in the account. You can obtain full access, including to data that the export does not contain (for example entries in the error log or in the web server log), together with the information under Art. 15(1) GDPR, on request by e-mail. Without an account – for example concerning an opt-out, a support request or a report – by e-mail stating the domain or address concerned and the approximate time.
Rectification (Art. 16): You can change your name, company, language and e-mail address yourself under Settings, and your billing address and VAT identification number in the Stripe customer portal under Billing; everything else by e-mail.
Erasure (Art. 17): You can delete your account, domains, alert destinations and test logins yourself, and revoke API keys yourself (they are deleted with the account); you can unsubscribe from a client portal’s monthly report via the link in every e-mail. You can request the deletion of a report, a screenshot or other data by e-mail. What we have to keep for legal reasons is set out in section 8.6.
Restriction of processing (Art. 18): by e-mail, for example if you contest the accuracy of data and we are checking it.
Data portability (Art. 20): The data export is a machine-readable JSON file that you can give to another provider yourself. More on switching providers at EU Data Act: Switching and Data Export.
Objection (Art. 21): see the following section.
Withdrawal of consent (Art. 7(3)): We do not base our own processing on consent. You can withdraw your consent to a client portal’s monthly report via the link in every e-mail; the withdrawal takes effect for the future.

For data that we process on behalf of a customer (section 2), the customer is your point of contact. If you write to us anyway, we forward your request to the customer and assist it in responding. Detailed guidance with all routes and limitations is available at Access, Erasure and Your Other Rights.

27. Right to object under Art. 21 GDPR

Insofar as we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

This applies in particular to the checking of websites by our crawler (section 7), the logs (section 3), reCAPTCHA (section 5), the limits for the free check (section 6), the set-up reminder (section 11), the badge (section 12) and swarm protection (section 13).

The objection is not subject to any particular form; an e-mail to contact@lukaswojcik.com is sufficient. As the operator of a website, you can also exclude further checks yourself at any time via the robots.txt or the opt-out page. We do not send advertising by e-mail, against which an objection without giving reasons would be possible.

28. Complaint to a supervisory authority

You may lodge a complaint with a data protection supervisory authority if you consider that we are processing your data unlawfully (Art. 77 GDPR). The authority competent for us is:

Prezes Urzędu Ochrony Danych Osobowych (President of the Personal Data Protection Office, UODO)
ul. Stanisława Moniuszki 1A
00-014 Warszawa
Poland
uodo.gov.pl

You may also contact the authority of the Member State in which you live or work or in which the alleged infringement took place – in Germany, for example, the data protection authority of your federal state. That authority will forward the complaint to the competent authority where necessary. We are happy to resolve a concern directly with you beforehand; this is not a requirement.

29. Security

All connections to our Service are encrypted with TLS; connections within our internal network are not encrypted throughout. We store passwords, API keys and recovery codes only as hashes, and two-factor sign-in secrets and test logins only in encrypted form. Customers’ data is separated by workspace; the rights of a role are enforced by the server, not just by the user interface. Only the owner has access to the servers; the crawler works in isolation and cannot access addresses in the internal network. The full description is available at Technical and Organisational Measures. If we become aware of a personal data breach, we notify the supervisory authority and, where necessary, you in accordance with Art. 33 and 34 GDPR; we inform customers on whose behalf we act without undue delay, if possible within 48 hours.

30. Further documents

This policy is the summary for data subjects. Details can be found in the Records of Processing Activities, in the list of Sub-processors, in the Technical and Organisational Measures, in the Data Processing Agreement, in the Data Protection Impact Assessment, and under Access, Erasure and Your Other Rights, EU AI Act: How formexposed Uses AI and Privacy Policy Text for Your Website.

31. Changes

We update this policy when the Service or the legal situation changes, and do so before any new processing begins. The version published here applies; earlier versions and what has changed can be found under Changes to the Contract Documents. The version you saw when you registered is shown in your data export. If anything material changes in the processing of your data as a customer, we will also inform you by e-mail.

This policy is available in all official languages of the European Union. In the event of discrepancies, the Polish version prevails.

How can we help?