At inspectify.eu (referred to as "we", "us", or "our"), we are committed to protecting your privacy and ensuring the security of your personal data. This Privacy Policy explains how we collect, use, store, and share your personal data when you visit our website, use our free website and IP analysis tools, or contact us.
We process your personal data in strict compliance with the General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) and other applicable European data protection regulations.
1Who We Are
The data controller responsible for the processing of personal data through this Website is:
If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please feel free to reach out to us at the contact email above.
2Personal Data We Process, Purposes, and Legal Bases
Under the GDPR, we must have a valid legal basis to process your personal data. We collect and process your data only for specific, explicit, and legitimate purposes:
A. Free Website & IP Scanner
Legitimate Interest (Art. 6(1)(f) GDPR)To ensure full transparency under the GDPR, we strictly distinguish between public technical target data and visitor telemetry:
- Target Infrastructure Data (Public Information): The domain name, hostname, or target server IP address entered into the scanner, along with publicly observable technical metrics (SSL/TLS certificates, HTTP security headers, DNSSEC records, and server location). This constitutes public technical routing data, not personal data of the visitor.
- Visitor / Request Data (Personal Data under GDPR): The IP address and browser user-agent of the user requesting the scan. This data is processed ephemerally at our network edge (CDN/WAF) solely for DDoS mitigation, abuse prevention, and rate limiting. It is never linked to or permanently stored within public scan reports.
- Target IP Caching: If an IP address is scanned directly, the target IP and its scan results are cached for 1 month to avoid redundant network queries.
- Domain Caching: Scanned domain names and basic WHOIS/DNS results are cached for 6 hours. If the security check is enabled, the resolving target server IP is cached for 1 month.
- Purposes: Generating real-time technical analysis, optimizing caching performance, and protecting our infrastructure against automated abuse.
- Legal Basis:Legitimate Interest (Article 6(1)(f) GDPR). Maintaining platform availability, network security, and delivering requested technical reports.
B. Contact Form
When you get in touch with us through our contact form, we collect the information you voluntarily provide:
- Data Processed: Your full name, email address, selected subject (e.g., questions, general inquiry, collaboration, other), your message, your IP address, and your browser's user agent.
- Purposes: To respond to your inquiry, manage collaborations, and protect our contact form against automated spam and malicious traffic.
- Legal Bases:
- Performance of a Contract / Pre-contractual Steps (Article 6(1)(b) GDPR): Applicable when your message relates to a business inquiry, partnership, or collaboration proposal.
- Legitimate Interest (Article 6(1)(f) GDPR): For answering general inquiries and ensuring the technical security of our communication channels.
C. Website Analytics
Legitimate Interest (Art. 6(1)(f) GDPR)We monitor the performance and speed of inspectify.eu to ensure a smooth user experience:
- Data Processed: Core Web Vitals, page load times, visitor numbers, and page views.
- Purposes: Improving website responsiveness, load speeds, and monitoring overall site traffic.
- Privacy Protection: We use a privacy-first, cookie-free analytics service. It does not track or profile individual visitors, nor does it collect persistent identifiers or store tracking cookies.
- Legal Basis:Legitimate Interest (Article 6(1)(f) GDPR). It is in our legitimate interest to measure website performance and technical efficiency.
3Cookies and Tracking
We believe in a privacy-first web experience:
We do not use non-essential cookies, analytical cookies, or tracking pixels that profile you or monitor your behavior across other websites.
We may only use essential, functional cookies if strictly necessary to maintain the basic operation or security of the Website. Because we do not use tracking cookies, no cookie consent banner is required, and your browsing remains entirely private.
4Sharing and Disclosing Personal Data
We do not share, sell, or disclose your personal data to third parties, unless it is strictly necessary for the operation of our services, to fulfill a contract with you, or to comply with a legal obligation.
To deliver our services, we share data only with trusted technical infrastructure providers who act as our data processors (sub-processors) to host and secure our systems:
Cloud Infrastructure Host
Providing cloud hosting, database, and encryption services. All servers and cached data are located entirely within the European Economic Area (EEA) in Frankfurt, Germany.
CDN & Security Provider
Providing content delivery network (CDN) services, network rate limiting, spam prevention, and privacy-first analytics to optimize and protect our website.
AI Integration Partner
To generate the plain-language "Audit Summary" section of your website scan, technical vulnerabilities (excluding visitor IP addresses or personal form details) are temporarily processed via an enterprise artificial intelligence provider. No identifying personal data of visitors or users is shared.
Zero Model Training: Processed under enterprise Zero Data Retention (ZDR) terms. Data is never used to train AI models.
All of our service providers are contractually bound by strict Data Processing Agreements (DPAs) under Article 28 of the GDPR to protect your data and are prohibited from using your data for any other purposes.
International Data Transfers
While our primary cloud infrastructure is hosted in Frankfurt, Germany (EEA), some of our technical service providers (such as our CDN and AI Integration partners) are headquartered in the United States. To ensure an adequate level of data protection when transferring data outside the European Economic Area (EEA), we rely on appropriate safeguards under GDPR Articles 45 and 46. This includes verifying that these sub-processors participate in the EU-U.S. Data Privacy Framework (adequacy decision) or have signed the European Commission’s Standard Contractual Clauses (SCCs).
5Data Security and Protection
We take the security of your personal data extremely seriously and have implemented appropriate technical and organizational measures under Articles 24 and 32 of the GDPR to ensure a level of security appropriate to the risk. These measures protect your data from accidental or unlawful loss, alteration, unauthorized disclosure, or access:
All communication between your device and our website is encrypted using SSL/TLS technology, ensuring data transmitted is secure against interception.
Form submissions are safeguarded using strong AES-256 encryption at rest. Rate-limiting identifiers and abuse logs utilize keyed pseudonymization (HMAC) or ephemeral in-memory counters, protecting visitor privacy without compromising defensive operations.
An advanced WAF actively shields our systems against common web-based vulnerabilities such as SQL injections, cross-site scripting (XSS), and targeted attacks.
Scan frequencies per IP per hour are strictly controlled. Flagged IP addresses are temporarily stored for a few seconds up to several hours to block automated abuse and protect availability.
We ensure that all our systems, servers, and dependencies are regularly updated with the latest security patches, software updates, and vulnerability hotfixes.
6Data Retention and Provision Requirements
In accordance with the GDPR's storage limitation principle (Article 5(1)(e)), we do not keep personal data for longer than necessary:
| Data Category | Maximum Retention Period | Action on Expiry |
|---|---|---|
| Contact Form Submissions | Max. 3 Months | Permanently deleted once message is resolved |
| IP Scans & Cached Results | Max. 1 Month | Automatically purged from cache database |
| Domain Scans & Basic Results | 6 Hours | Re-evaluated on next live query |
| Security Rate Limiting Logs | Few seconds up to several hours | Flushed automatically after block expires |
| Anonymized Technical Metrics | Aggregated indefinitely | Cannot be linked to any natural person |
Provision of Personal Data (Inquiry Handling)
There is no statutory obligation for you to provide any personal data to us. However, if you wish to use our contact form, providing your name, email address, and message is necessary to handle and respond to your inquiry, based on our legitimate interest (Article 6(1)(f) GDPR) or pre-contractual steps (Article 6(1)(b) GDPR). Failure to provide this information means we will be unable to process or respond to your message.
7Artificial Intelligence Transparency
- The Audit Summary displayed in your scan results is generated automatically using artificial intelligence (large language models).
- This summary is designed to translate complex technical audit metrics into plain language to help you quickly assess security baselines.
- Training Exclusion & Zero Retention: Data sent to our enterprise AI partner is processed under strict Zero Data Retention (ZDR) terms. Your queries and technical scan results are never used to train, retrain, or improve artificial intelligence foundation models.
- These automated summaries are for informational purposes only, do not constitute formal legal or professional cybersecurity certification, and should be verified independently.
8Automated Individual Decision-Making and Profiling
Under Article 22 of the GDPR, you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you:
- We do not use automated decision-making or profiling on this Website.
- No automated processes are used to make decisions that carry legal consequences or significantly impact your rights, freedoms, or access to our services.
9Your Data Subject Rights under the GDPR
As a European resident, you possess the following rights under Articles 15 to 21 of the GDPR regarding your personal data:
Right of Access (Art. 15)
You have the right to request a copy of the personal data we hold about you.
Right to Rectification (Art. 16)
You have the right to request that we correct any inaccurate personal data.
Right to Erasure (Art. 17)
You have the right to request deletion of your personal data ("Right to be Forgotten").
Right to Restriction (Art. 18)
You have the right to restrict how we process your data under certain conditions.
Right to Data Portability (Art. 20)
Receive your provided data in a structured, commonly used machine-readable format.
Right to Object (Art. 21)
Object to processing based on legitimate interests at any time.
Right to Lodge a Complaint (Article 13(2)(d) GDPR)
You have the right to file a complaint with a national Data Protection Authority if you believe our processing violates the GDPR. In the Netherlands, this is the Autoriteit Persoonsgegevens (AP):
Visit Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl)How to Exercise Your Rights
To exercise any of your data protection rights, please contact us by sending an email to [email protected]. We will respond to your request without undue delay and at the latest within one month (Article 12(3) GDPR).
10Changes to this Privacy Policy
We may update our Privacy Policy from time to time to reflect changes in our technology, legal obligations, or service features. Any updates will be posted on this page with an updated "Last Updated" date. We encourage you to review this policy periodically.