1. Who is responsible for your data
1.1 The controller of personal data processed through Secure Vibes is [COMPANY LEGAL NAME], registered under number [COMPANY REGISTRATION NUMBER], with its registered office at [REGISTERED ADDRESS] ("we", "us").
1.2 Privacy contact (data protection officer or privacy lead, where applicable): [DPO / PRIVACY CONTACT]. General contact: [email protected] [CONTACT EMAIL].
1.3 This policy is written to meet the EU and UK General Data Protection Regulation ("GDPR") and the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("PDPL"), and other laws that may apply depending on where you are. Where we are required to appoint a representative in the EU or UK, their details are: [EU / UK REPRESENTATIVE, IF REQUIRED].
1.4 This policy should be read with our Terms of Service and Acceptable Use Policy.
2. What we collect and why
2.1 The table below lists each category of data, why we use it and our legal basis. "Contract" means the processing is needed to provide the Service you asked for. "Legitimate interests" means it is needed for our or a third party's legitimate interests, which we have balanced against your rights. "Legal obligation" means a law requires it. "Consent" means you agreed to it and can withdraw that agreement.
| Data | What we use it for | Legal basis |
|---|---|---|
| Account data: email address, account status, email-verification status, account identifier | Creating your account, signing you in, sending sign-in links and service messages, enforcing per-account limits and bans. | Contract; legitimate interests (security and abuse prevention). |
| If you sign in with Google: your Google account identifier, email address and whether Google has verified it, your name and profile picture address. We ask Google only for these (the "openid email profile" scopes) and do not keep Google's access tokens. | Creating your account and signing you in. Your name and picture are shown only to you and to our admins. | Contract; legitimate interests (security and abuse prevention). |
| Sign-in data: one-time sign-in tokens and session tokens (stored only as hashes), session creation time, hashed IP address and user agent, and a history of successful sign-ins (time, method, hashed IP address and user agent) | Keeping you signed in securely, detecting suspicious sign-ins, rate-limiting sign-in requests. | Contract; legitimate interests (security). |
| Terms acceptance records: version accepted, time, hashed IP address | Proving which version of our Terms, Acceptable Use Policy and Privacy Policy you accepted and when. | Legitimate interests (establishing, exercising and defending legal claims); contract. |
| Consent records (one per scan): account identifier, email address, target host, scan tier, consent basis (owner or authorized), hash and version of the exact authorization statement, Terms version, hashed IP address, user agent, timestamp | Recording who authorized each scan, preventing and investigating unauthorized scanning, responding to abuse reports and lawful requests. | Legitimate interests (security, abuse prevention, protecting scanned-site owners, and establishing, exercising and defending legal claims); legal obligation where a law requires us to keep or disclose it. |
| Scan data: target host, tier, status, timestamps, the report (findings and redacted evidence), fix prompts, generated video, domain-verification records (host, token, method, time) | Running scans, showing you results, generating fix prompts and videos, verifying domain ownership for full scans. | Contract. |
| Payment records: our payment reference and the payment provider's checkout identifier, amount, currency, payment status, email address, time, the scan it was used for | Processing payments for full scans, handling refunds and disputes, accounting and tax. | Contract; legal obligation (tax and accounting law). |
Technical and abuse-prevention data: IP address (held briefly in memory for rate limits, otherwise stored only as a one-way hash), user agent, an anonymous browser identifier (sv_owner cookie), short-lived server error logs |
Rate limiting, preventing abuse and fraud, keeping the Service secure and fixing errors. | Legitimate interests (security, abuse prevention, service reliability). |
| Website statistics: which pages are viewed and which main buttons are clicked, with the referring site, browser type, device type and country. No cookies, no IP address stored, no account data (Section 2.6) | Understanding which pages help people and where they get stuck, so we can improve the site. | Legitimate interests (improving the Service). |
| Communications: messages you send us and our replies | Answering questions, handling privacy requests, complaints and abuse reports. | Legitimate interests (support and dispute handling); legal obligation (for privacy requests). |
2.2 Where data comes from. We collect this data from you directly (for example your email address), from your use of the Service (for example consent records) from Google if you sign in with it (see the table above), and from our payment provider (payment confirmation).
2.3 What happens if you don't provide it. We need your email address and your acceptance of the Terms to provide the Service. Without them, you cannot sign in or scan.
2.4 What we don't do. We do not sell personal data, share it for cross-context behavioural advertising, or use it to build marketing profiles. We do not send marketing email unless you have separately agreed to it. We may create aggregated, de-identified statistics about scans (for example, how often a type of issue appears) that do not identify you or any website.
2.5 "Get in touch" messages. If you use the Get in touch form, we keep your name, email, the links you give us (website, GitHub) and your message, to reply, set up a call and prepare a quote (legitimate interests, and steps before a contract you asked for). We email it to our team through our email provider. We keep it for up to 24 months after our last contact unless it becomes part of a contract. Do not send passwords or secret keys through the form.
2.6 Website statistics. We count visits and clicks with Umami, an open-source statistics tool that we run on our own server, so this data is not shared with anyone. In plain words: it sets no cookies and stores nothing on your device, it does not store your IP address (it is used only for a moment to work out your country and to tell visits apart with a code that changes every month and can't be traced back to you), it does not see the part of web addresses after "?" or "#" (so no scan IDs or site names), and it never receives your email or account. We count clicks only on a few main buttons (for example "sign in", "start a scan" and "Get in touch"). If your browser sends a "Do Not Track" signal, we don't count you at all. We use the totals only to improve the site.
3. Data about scanned websites and their owners
3.1 When a user scans a website, we process technical data about that website. If you own or run a scanned website, this section applies to you.
3.2 What we process. Only technical data that is publicly reachable or that the website itself serves to visitors: HTTP responses and headers, TLS certificates, DNS and email records, domain registration data, public JavaScript files, publicly reachable files and paths, certificate-transparency subdomain listings and threat-intelligence blocklist status. Full scans, which require proof of domain control, also make the read-only checks described in our Terms.
3.3 How we limit it.
- Any secret or key we detect is stored only in redacted form (for example, the first and last few characters).
- We never store the contents of database rows. For database exposure checks we record only table or collection names and row counts.
- Short samples of responses may be processed transiently to classify a finding (for example, whether an exposed API route returns personal data). If a website is leaking personal data of its own users, such samples could include it; we use them only for that classification and do not store them in reports.
- Reports are visible only to the account that requested the scan, except for a handoff certificate the site owner chooses to publish (3.5).
3.4 Legal basis. Legitimate interests: the interest of the requesting user (who must own the site or be authorized by its owner) and of the site owner in finding and fixing security weaknesses, and our interest in preventing abuse. Website owners who did not authorize a scan can report it and ask us to block their domain (see how to report abuse).
3.5 Handoff certificates. A user who has proved control of a domain may publish a handoff certificate for it. Anyone with the link can see it. It shows the domain, the optional "prepared for" name the user entered, the dates of the scan, ownership proof and certificate, the grade, the number of checks passed, counts of open findings by severity and the categories involved, and the scope of the checks. It never shows finding details, evidence, the scan report or the issuer's email address. The certificate stays available, marked as expired, revoked or replaced as applicable, until the user who issued it asks us to delete it. Do not enter personal data in the "prepared for" field unless you have the right to publish it.
4. Who we share data with
4.1 We use the service providers below to run Secure Vibes. Where they act as our processors, they may use the data only on our instructions and under a data processing agreement. Some (such as Nomod and Google) are independent controllers for parts of their processing, under their own privacy policies.
| Provider | Purpose | Data shared | Location |
|---|---|---|---|
| Contabo | Hosting our servers and database | All data we store (Section 2) | EU (Germany) |
| Nomod (Nomod Payments) | Payment processing | Payment details you enter on Nomod's checkout page, and the name, email and phone number it may ask for there, amount, currency | United Arab Emirates and the countries its card processors use |
| Cloudflare | Delivering the website securely (HTTPS, protection against attacks) | IP address, request details (pages and files requested, browser type) | USA, EU and other countries |
| Sign in with Google (only if you choose it) | The sign-in request; Google tells us your account identifier, email, name and profile picture | USA and other countries | |
| Resend | Sending sign-in and service emails | Email address, email content (sign-in link) | USA |
| OpenRouter, routing to Meta (Muse model) | Polishing report text, fix prompts and video scripts | Findings text and report context; no secrets and no account data | USA |
| TypeSafe (Jev model) | Classifying findings (for example real secret vs placeholder, real exposed file vs error page) | Redacted snippets, short response samples and HTTP headers from scanned sites; no account data | USA |
| Google (Gemini) | Text-to-speech for the report video | The video script (plain-language summary of findings) | USA and other countries |
| Google Fonts | Delivering the fonts used on our pages | Your IP address and browser details, when your browser loads the font files | USA and other countries |
| Public data sources: crt.sh, rdap.org, Google Public DNS, and the Cloudflare, Quad9, CleanBrowsing and AdGuard DNS resolvers | Looking up public information during scans (certificates, domain registration, DNS, blocklists) | The scanned domain name only; never your account data | Various |
4.2 Locations are indicative and based on the providers' published information. [Confirm each provider's processing locations and data processing agreements before publishing.]
4.3 We may also share data with professional advisers (such as lawyers and accountants) under confidentiality obligations, and with a buyer or successor if our business is sold or reorganized, in which case this policy continues to apply to your data.
5. Abuse reports and legal disclosures
Because Secure Vibes is a security tool, we keep a record of who authorized each scan. If a scan is reported as unauthorized, that record may be shared.
5.1 Website owners. If the owner or operator of a system reports that it was scanned without permission, we may, where the law allows, disclose to them the identity of the requesting account (including its email address), the relevant consent records and the scans performed, so they can protect their rights. Our legal basis is legitimate interests (preventing abuse and allowing the owner to establish, exercise or defend legal claims).
5.2 Authorities. We may disclose personal data to law enforcement, regulators or courts where required by law or valid legal process, or where we believe in good faith that disclosure is necessary to prevent harm, investigate unlawful activity, or protect our rights or those of others. Our legal basis is legal obligation or legitimate interests.
6. International transfers
6.1 Our servers are in the EU (Germany). Some providers in Section 4 process data in other countries, including the United States, that may not offer the same level of protection as your home country.
6.2 When we transfer personal data out of the EU/EEA, the UK or the UAE, we rely on an appropriate safeguard, such as an adequacy decision (including the EU-U.S. Data Privacy Framework where the provider is certified), the European Commission's Standard Contractual Clauses or the UK equivalent, or another mechanism permitted under the GDPR or the PDPL (including its rules on cross-border transfers). You can ask us for more information about these safeguards using the contact details below.
7. How long we keep data
7.1 We keep personal data only as long as we need it for the purposes above, then delete or anonymize it.
| Data | How long |
|---|---|
| Account data | While your account is active, plus 12 months after your last activity or account closure. |
| Sign-in tokens | Single use; expire after 20 minutes. |
| Sessions | Up to 30 days, or until you sign out. |
| Scan reports, fix prompts and videos | 90 days after the scan. |
| Domain-verification records | While your account is active, plus 12 months. |
| Consent records and terms acceptance records | 3 years after the scan or acceptance, even if you close your account, unless a longer period is needed for an ongoing investigation, dispute or legal request. |
| Payment records | As long as tax and accounting law requires (typically 5 to 10 years, depending on the country). |
| Rate-limit data (IP addresses in memory) | Only in memory, cleared within the rate-limit window (at most a day) or when the server restarts. |
| Website statistics (no personal data) | Up to 24 months, then deleted. |
| Server error logs | A short period, as needed to diagnose problems. |
| Correspondence and privacy requests | As long as needed to handle the matter, plus up to 3 years to show how we handled it. |
8. How we protect data
8.1 We use technical and organizational measures appropriate to the risk, including:
- encryption in transit (HTTPS) for our website and API;
- passwordless sign-in; sign-in and session tokens are random and stored only as one-way hashes;
- session cookies that are
HttpOnly,SameSite=LaxandSecureover HTTPS; - IP addresses stored only as one-way hashes;
- redaction of any secrets found during scans, and no storage of database row contents;
- access controls so that each report, prompt and video is visible only to the account that requested it;
- sharing only the minimum data with AI providers (no secrets and no account data); and
- a scanner that only reaches public addresses, with safeguards checked on every network hop.
8.2 No system is completely secure. If we become aware of a personal data breach that affects you, we will notify you and the relevant authorities where the law requires.
9. Your rights
9.1 Depending on where you live, you have some or all of the following rights:
- Access
- Get a copy of the personal data we hold about you and information about how we use it.
- Rectification
- Have inaccurate or incomplete data corrected.
- Erasure
- Have your data deleted, where there is no overriding reason for us to keep it.
- Restriction
- Ask us to limit how we use your data, for example while we check a complaint.
- Portability
- Receive data you gave us in a structured, machine-readable format, or have it sent to another provider.
- Objection
- Object to processing based on legitimate interests. We will stop unless we have compelling legitimate grounds or need the data for legal claims.
- Withdraw consent
- Where we rely on consent, withdraw it at any time, without affecting earlier processing.
- Complaint
- Complain to a supervisory authority (see Section 14).
About consent records. If you ask us to delete your data, we will delete your account and scan reports, but we will keep consent and terms acceptance records for their retention period (Section 7). We need them to protect scanned-site owners and to establish, exercise or defend legal claims, which the law allows.
9.2 How to exercise your rights. Email [DPO / PRIVACY CONTACT] or [email protected] from the email address on your account. We may ask for information to confirm your identity. We will reply within one month (extendable by two months for complex requests, as the law allows), and we will not charge a fee unless a request is clearly unfounded or excessive.
11. Automated processing and AI
11.1 We use automated checks and AI models to analyze scanned websites and to write report text, fix prompts and video narration. These analyze websites, not people.
11.2 We use automated rules (such as rate limits, blocked email domains and blocked targets) to prevent abuse. We do not make decisions based solely on automated processing that produce legal effects or similarly significantly affect you. If your account is suspended, you can ask for a human review by contacting us.
11.3 We do not use your personal data to train AI models. [Confirm the training and retention settings of each AI provider before publishing.]
12. Children
Secure Vibes is not intended for anyone under 18, and we do not knowingly collect personal data from them. If you believe someone under 18 has given us personal data, contact us and we will delete it.
13. Changes to this policy
This policy shares a version number with our Terms of Service and Acceptable Use Policy. When we change it materially, we publish a new version with a new date, and signed-in users are asked to accept the new version before their next scan. We may make minor clarifications without re-acceptance.
14. Contact and complaints
[COMPANY LEGAL NAME]
[REGISTERED ADDRESS]
Privacy contact: [DPO / PRIVACY CONTACT]
Email: [email protected] [CONTACT EMAIL]
If you are not satisfied with our response, you have the right to complain to a supervisory authority, in particular in the country where you live, work or where an alleged infringement took place. For example: your national data protection authority in the EU/EEA, the Information Commissioner's Office (ICO) in the UK, or the UAE Data Office in the United Arab Emirates. We would appreciate the chance to address your concern first.
Back to top ↑