Privacy Policy

Last updated September 28, 2026

Legal Risk Scanner ("we") operates the Legal Risk Scanner website and service. This policy explains what personal data we collect, why, and the choices you have. We are the data controller for the processing described here. Contact: support@example.com, (set COMPANY_ADDRESS to your postal address).

What we collect and why

• Website URLs you scan. We fetch publicly accessible pages of the site you enter, analyse them, and store the URL, the findings and short excerpts of page source as evidence. Legal basis: performance of a contract (delivering the scan you requested) and our legitimate interest in operating the service. Anonymous scans are kept for 90 days; scans attached to an account are kept while the account exists.
• Email templates you paste. Stored with the check result so you can revisit it. If they contain personal data of other people, do not paste them: use a template with merge tags instead.
• Account data. Email address, a salted hash of your password (never the password itself), your date of birth (used only to confirm you are 18 or older; it is not displayed and not used for anything else), the time you accepted our terms, and your IP address and browser identifier at signup (kept as evidence of consent). Legal basis: contract.
• Billing. Payments are processed by our payment provider (Stripe, via the Viski Payments platform). We receive an identifier and the entitlements you hold; we never see or store card numbers. Legal basis: contract and legal obligation (tax records).
• Site ownership. The verification token you place in DNS or a meta tag, and the time verification succeeded.
• Server logs. IP address, request path, user agent and timestamps, kept for up to 30 days for security and abuse prevention. Legal basis: legitimate interest.

Cookies

We set one strictly necessary cookie, lrs_session, when you log in, and a short-lived lrs_age_blocked cookie if a signup attempt is refused because of age. We use localStorage to remember that you dismissed the cookie notice. We do not use analytics cookies, advertising pixels, fingerprinting or session-replay recording of any kind. Fonts are served from our own servers with a system font stack; no font requests are made to third parties.

Emails we send

Transactional emails (account notices, receipts, scan reports you asked for) are sent as part of the service. Monitoring alert emails are sent only to accounts with active monitoring and include a one-click unsubscribe link and our postal address. Optional product-update emails are sent only if you ticked the box at signup, and every one carries an unsubscribe link.

Who we share data with

• Our hosting and database provider (Viski), which stores data on our behalf.
• Our payment processor for purchases.
• Our email delivery provider for the emails described above.
• Authorities when legally required.

We do not sell personal data and do not share it for cross-context behavioural advertising.

Scanning other people's websites

The scanner only reads pages that are already public, identifies itself with a user agent that names this service, fetches at most a handful of pages per scan, and never submits forms or logs in. If you operate a website and want us to stop scanning it, email us and we will block your domain.

Children

The service is not directed to children and accounts are limited to people aged 18 or over. If we learn that we hold data from a child under 13 we delete it promptly.

Your rights

Depending on where you live you may have the right to access, correct, delete or export your data, to object to or restrict processing, to withdraw consent, and to complain to a supervisory authority. Email support@example.com and we will respond within 30 days. California residents: we do not sell or share personal information as defined by the CCPA, and we do not discriminate against you for exercising your rights.

International transfers

Data may be processed in the United States and the European Union. Where data leaves the EEA or UK we rely on standard contractual clauses or an adequacy decision.

Changes

We will post changes here and update the date above. Material changes are announced by email to account holders.