Privacy policy

The data controller is [COMPANY NAME TO BE COMPLETED], whose details appear in the legal notice.

Account data: email address, hashed password and the language of the site when you signed up, so that we write to you in that language. The password is never stored in clear and is not accessible to the publisher.

Usage data: the URLs you submit for analysis, the corresponding hostname, the date of each analysis and the report produced. These URLs are usage data: they can reveal which sites interest you.

Billing data: Stripe customer id, history of credit movements. No card data is received or stored by CyberCrush; it is handled directly by Stripe.

Contact data: if you use the contact form, your name, email address, the topic, subject and content of your message, and your account id if you are signed in. These messages are not stored in the service's database: they are sent by email to the team.

Technical data: IP address, used only for rate limiting and abuse prevention.

Providing the service and managing the account: performance of the contract.

Answering requests sent through the contact form: legitimate interest in assisting users and site owners.

Billing and accounting: legal obligation.

Rate limiting, logging of analyses and abuse prevention: legitimate interest in protecting the service and being able to answer a site owner's complaint.

Audience measurement and technical monitoring: legitimate interest.

Scans and reports: kept for as long as the account is active. You can delete a scan at any time from its report page; deletion is immediate and permanent. The matching line of the credit history (target, date) stays attached to the account.

Credit movement history (date, quantity, target of each analysis): kept for as long as the account exists. It serves as the analysis log.

Account: you can delete it at any time from the Account page. Deletion is immediate: account, scans, reports, balances and credit history are erased, the subscription is cancelled and the Stripe customer record deleted. Invoices remain held by Stripe for the legal period.

Messages received through the contact form: kept in the team's mailbox for [DURATION TO BE COMPLETED] after the last exchange.

Emails sent by the service (signup confirmation, password reset, notices of a password change or of an account deletion): a copy stays in the team's sending mailbox for [DURATION TO BE COMPLETED]. It carries your email address, including after the account is deleted.

Technical logs and rate-limit counters: kept for at most thirty days.

Vercel (hosting, United States and European Union), Supabase (database and authentication), Upstash (rate limiting and queue), Stripe (payment), Cloudflare (anti-robot protection), Google (Gmail: delivery of the service's emails, storage of their copy and of contact form messages). Each acts as a processor, except Stripe which is a controller for payment data.

Transfers outside the European Union are covered by the European Commission's standard contractual clauses.

No data is sold or passed on for advertising purposes.

You have rights of access, rectification, erasure, restriction, objection and portability. Deleting a scan or your account is done directly from the interface; the other rights are exercised by email at the address given in the legal notice.

An export of your scans and credit history can be requested the same way.

You may lodge a complaint with the CNIL, 3 place de Fontenoy, 75007 Paris, www.cnil.fr.

The service uses only cookies strictly necessary for it to work: the authentication session cookie, and the cookies set by Cloudflare Turnstile for the anti-robot check.

No advertising or behavioural tracking cookie is set. Accordingly, no prior consent is required.

Data is encrypted in transit (TLS) and at rest. Access to each account's data is isolated at the database level by row-level security policies.

In the event of a data breach likely to create a high risk to your rights, you will be informed as soon as possible.