Privacy Policy

1. Controller & supervisory authority

The controller responsible for data processing on this site (Art. 4 No. 7 GDPR) is Bent Eisheuer. Contact details are in the Imprint. As a solo operator, we are not required to appoint a Data Protection Officer under § 38 BDSG (the threshold of at least 20 people constantly processing personal data is not met).

You have the right to lodge a complaint with a supervisory authority. The authority competent for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18, 91522 Ansbach, Germany
https://www.lda.bayern.de

2. What breach403 does, in brief

breach403 runs an automated, non-destructive external security scan against a website whose ownership you have proven you control, then produces a plain-language report of what the scan found. That core purpose shapes every data flow below. We only scan domains you have verified, and scan results can be security-sensitive by nature, since they describe real exposures on a real website, so they get the strongest protection on this page.

3. The domain, verification, and scan data

What:the domain you submit; the ownership-verification token we issue and its status (DNS TXT record, HTML meta tag, or file upload, whichever you used); the scan's findings (e.g. exposed configuration files, missing security headers, outdated software, misconfigurations) and the plain-language report generated from them.

Why: this is the entire service. We cannot scan a domain without it, and we cannot show you a report without storing the result. Legal basis: Art. 6(1)(b) GDPR (performing the contract you request by starting a scan).

No scan runs without proof of ownership.We re-verify ownership at scan time, not just at submission, and only ever test the domain and its subdomains, never a third party's site. See Terms of Service for the authorization you give us by starting a scan.

Anti-abuse: we also use scan counts (how many scans a site or the platform has run recently) to enforce rate limits and prevent the Service from being used to attack third parties. Legal basis: Art. 6(1)(f) (keeping the Service safe and abuse-free). This does not involve any new data beyond what is already described above.

Authorization record:when you create a site and each time you queue a scan, we record the authorization evidence alongside that event: the exact authorization statement you accepted, the version of our Terms in force, the time, and the IP address and browser user-agent of that request. Legacy scans may carry forward the site's original authorization event rather than a new one. Why: to hold provable, tamper-evident evidence that security-testing of that domain was authorized, which protects both you and us. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest, as a security-testing service, in a verifiable authorization record and in being able to rebut any claim that a scan was unauthorized). It is kept for as long as the site exists, as part of its audit trail.

Protection:scan results are encrypted at rest, access to them is restricted to your account via database-level row security (a query for someone else's scan simply returns nothing, not an error), and any secret our scanner discovers is masked before it is ever displayed or stored in the report. We never re-publish a live credential.

Retention: scan records, findings, and generated reports are automatically deleted 180 days after a scan finishes. The site record and its authorization evidence remain while the associated account or anonymous session exists because they document why testing was authorized. Abandoned anonymous accounts are automatically deleted after 180 days without account, session, verification, or scan activity; this also deletes their remaining site and authorization records. Registered accounts remain until you delete the account or request deletion. Email us at legetdev@gmail.com to request deletion; we will respond within the timeframe in Art. 12(3) GDPR (normally one month).

4. Account data

Anonymous use (the free scan):starting a free scan creates an anonymous session (Supabase Auth's built-in anonymous sign-in), a random session identifier with no email, password, or other personal information attached. It exists so your scan history stays yours across page loads on the same browser. Legal basis: Art. 6(1)(b).

A real account (email + password): creating a real account to save scan history stores your email address and a securely hashed password. We never see or store your password in plain text; this is handled entirely by our authentication provider, Supabase Auth. Legal basis: Art. 6(1)(b).

5. AI-enhanced reports

If you unlock the AI-powered report, the scan's findings (severity, category, affected URL, and a technical description, not your account email or password) are sent to Google's Gemini APIto generate the plain-language summary and per-finding fix prompts. Google processes this data as our processor under its API terms. Per Google's published API terms, data submitted via the paid Gemini API is not used to train Google's models. Google may retain prompts and responses for a limited period for security, abuse prevention, and legal compliance, and may process them in countries identified in its terms. Legal basis: Art. 6(1)(b), this is the feature you are unlocking. If AI processing fails, we fall back to a deterministic, template-based report with no AI involvement. This feature and its checkout are currently unavailable to users.

6. Where the scan actually runs

The scan itself executes inside a short-lived, isolated sandbox (Vercel Sandbox). At the time of writing, that compute step runs in the United States (Vercel's iad1 region) even though all stored data, your account, your scan history, and the findings themselves, is stored in the EU (Supabase, Frankfurt/eu-central-1). In practice, this means the domain name you submit and the scan's traffic transit through US infrastructure for the duration of the scan (normally several minutes and bounded by a 16-minute sandbox timeout), before the results are stored back in the EU. See §7 for the transfer safeguard this relies on. We are evaluating an EU-native scan host and will update this section if that changes.

7. Hosting, infrastructure & international transfers

We use the following processors to run this service. Where a processor is headquartered outside the EU/EEA, transfers rely on the EU-US Data Privacy Framework (where the provider is certified) and/or the European Commission's Standard Contractual Clauses as an additional safeguard.

• Vercel Inc. (USA): hosts this website and application, and runs the scan-execution sandbox described in §6. Processes IP address and request metadata as part of normal web hosting. Legal basis: Art. 6(1)(f) (operating the service).
• Supabase, Inc.: database, authentication, and file storage. Data is stored in the EU (Frankfurt, eu-central-1). Legal basis: Art. 6(1)(b)/(f).
• Google LLC (USA): the Gemini API described in §5, used only for accounts that have unlocked the AI report. Legal basis: Art. 6(1)(b).
• Cloudflare, Inc. (USA): provides DNS-over-HTTPS responses used to inspect public DNS records during a scan. The submitted domain and DNS query are sent to this service. Legal basis: Art. 6(1)(b).

The scanner also contacts the verified website itself and public internet discovery, DNS, certificate, and registration sources used by the ProjectDiscovery tools. Those operators can receive the submitted domain, scanner IP address, request time, and normal protocol metadata. This is necessary to map and inspect the external surface you asked us to scan (Art. 6(1)(b)).

8. Payment (Lemon Squeezy)

Checkout is currently unavailable. If sales are enabled, AI-scan credits will be purchased through Lemon Squeezy, which acts as the merchant of record. When you buy credits, Lemon Squeezy collects and processes your payment details, billing address, and email directly. We never see or store your card details, and Lemon Squeezy is a separate, independent data controller for that payment data, not our processor. We receive only the confirmation that a purchase succeeded (via a cryptographically signed webhook) and the number of credits it grants, which we store against your account (payment_events: order ID, account, credits granted, and timestamp), kept for German statutory bookkeeping retention, currently 8 years under § 147 AO / § 257 HGB. See Lemon Squeezy's own privacy policy for how they handle your payment data.

9. Analytics and marketing

We do not use analytics, advertising, marketing pixels, session replay, or cross-site tracking. Vercel Web Analytics and Speed Insights are not loaded by this application.

10. Cookies

The only cookies this site sets are strictly necessary session cookies from our authentication provider (Supabase), which keep you signed in between page loads. These are required for the service to function (you could not stay signed in without them) and do not require consent under § 25 Abs. 2 Nr. 2 TDDDG. We do not use advertising or cross-site tracking cookies.

11. Automated decision-making

We do not use your data for automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR). The AI-generated report is a description of your own scan results, not a decision made about you.

12. Your rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you (Art. 15).
• Have inaccurate data corrected (Art. 16).
• Have your data deleted (Art. 17). Email us to request account deletion.
• Restrict processing in certain circumstances (Art. 18).
• Receive your data in a portable format (Art. 20).
• Object to processing based on legitimate interest (Art. 21).
• Withdraw consent at any time, where processing is based on consent (Art. 7(3)).
• Lodge a complaint with a supervisory authority (Art. 77). See §1 for the one competent for us.

To exercise any of these, contact us at legetdev@gmail.com.

13. Changes to this policy

If our data processing changes, whether a new processor or a new feature that collects new data, we will update this page and the date at the top. Material changes will be reflected here before they take effect.