Privacy Policy

This Privacy Policy explains how Talivio Technology OÜ (registry code 16991406, Ahtri tn 12, Kesklinna linnaosa, Tallinn, Harju maakond, 15551, Estonia — "Talivio", "we") processes personal data in connection with the PrivaScan privacy-scanning service. We are the data controller for the data described below. For privacy questions, contact [email protected].

1. Data we collect

• Scan input: the URL you submit to the scanner.
• Account data: name, email address and a hashed password.
• Billing data: your subscription plan and payment status. Card details are handled by Stripe and never touch our servers (see section 6).
• Site and monitoring data: the sites you add, verification records, and the scan findings derived from them over time (see section 3 for what a finding contains).
• Reports: the PDF reports you generate, including their verification reference and checksum.
• Technical data: IP address, browser information and server logs, used for security, rate limiting and to operate the service.

2. How we use it and our legal bases (GDPR)

We process your data on the following legal bases under Article 6(1) GDPR:

• To perform our contract with you — running scans, monitoring, generating reports, your account and billing (Article 6(1)(b)).
• To comply with legal obligations, such as accounting and tax law (Article 6(1)(c)).
• For our legitimate interests in keeping the service secure, preventing abuse (including rate limiting and SSRF protection) and improving it (Article 6(1)(f)).

We do not use your data for advertising and we do not sell it.

3. Data collected from scanned websites

The scanner loads the target page in a headless browser and records technical signals: network requests, the trackers and consent tools they reveal, cookie names and attributes, web-storage keys, and the countries tracker hosts resolve to. This data describes the scanned website's behaviour; it is not directed at profiling individuals.

• Anonymous scans (no account): the result is shown to you and is not stored. We do not retain the page content or the findings of anonymous one-off scans after the result is produced.
• Scans of sites in your account: findings are stored with the site so you can track changes over time, receive monitoring alerts and generate reports. We do not store full copies of scanned pages; the expert-review feature stores page captures of the reviewed pages while the review is open.
• If a scanned page happens to expose personal data (for example in a cookie value), it is processed only as part of the technical finding. The operator of the scanned website remains responsible for that site's own processing.

4. On-demand scans of third-party sites

If you submit a site you do not operate, you — not PrivaScan — decide to test it, and you must be authorised to do so (see our Terms of Service). We act on your instruction when loading the page.

5. Public verification and badges

Report verification pages (/verify) and status badges are public by design: anyone with the reference link or badge token can see the report checksum or the site's scan status. Do not share these links if you do not want the underlying result to be visible.

6. Who we share it with

We do not sell personal data. We share it only with the recipients needed to deliver the service, in two roles:

Processors (act on our behalf, on our instructions)

• Google (Gemini API), which we use to generate the written narrative of reports from scan findings and, for the AI pre-check feature, to evaluate captured pages. We use the paid Gemini API tier: under Google's terms and the Google Cloud Data Processing Addendum, prompts and outputs are not used to train or improve Google's models. Scan findings describe the scanned website, not your account.
• Our hosting provider and our own mail infrastructure, which store data and deliver transactional messages on our behalf. Both are located within the EU.
• IP-geolocation lookup: to classify cross-border transfers we resolve tracker host names (not your personal data and not your account data) against an IP-geolocation service, so we can tell which countries a scanned site's trackers resolve to.

Independent controllers (act on their own account)

• Stripe, our payment provider, which processes subscription and one-off payments and acts as an independent (separate) controller for the payment data it needs. We do not sign a controller-processor data processing agreement with Stripe for the payment flow; Stripe's own privacy terms govern that processing.

7. Where your data is held and transfers

We host the service within the European Union and we do not transfer your personal data outside the EEA ourselves. Some recipients may process data outside the EEA under appropriate safeguards:

• Google (Gemini): transfers to the United States rely on Google's certification under the EU-US Data Privacy Framework, backed by the EU standard contractual clauses in Google's Cloud Data Processing Addendum as an additional safeguard.
• Stripe: as an independent controller, Stripe applies its own transfer mechanisms (adequacy, the EU standard contractual clauses or the Data Privacy Framework) as described in its privacy policy.

8. Data processing agreement

When you scan a site, the pages we load on your instruction may contain third-party personal data (for example in a cookie value). For that content we act as your processor. We will, on request, enter into a GDPR Article 28 data processing agreement with business customers; our standard DPA is available from [email protected].

9. How long we keep it

• Anonymous scan results: not stored (see section 3).
• Account, site and scan data: kept while your account is active and deleted or anonymised within 90 days after your account is closed, unless a longer period is legally required (for example invoicing records under accounting law).
• Generated reports: kept while your account is active so their verification links keep working; deleted with the account.
• Server logs: kept for up to 12 months for security purposes.

10. Your rights

Under the GDPR you can request access to your data, correction, erasure, portability, restriction of processing, and object to processing based on legitimate interests. To exercise a right, email [email protected]. You may also lodge a complaint with a supervisory authority — for us that is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), but you may contact the authority in your own country.

11. Cookies we use ourselves

A privacy scanner should hold itself to the standard it measures. On our own site we use only first-party cookies:

• a session cookie that keeps you signed in,
• a CSRF cookie that protects forms against abuse,
• a persistent "remember me" cookie, only if you choose that option at sign-in, and
• a persistent language cookie, only if you switch the interface language.

We do not use analytics, advertising or any third-party cookies, and no trackers load before — or after — you interact with the site.

12. Security

Passwords are hashed, traffic is served over TLS, and access to production systems is restricted. Report integrity is verifiable via SHA-256 checksums. No system is perfectly secure, but we take measures appropriate to the risk.

13. Changes

We may update this policy; the date at the top shows when it last changed. Material changes will be communicated where appropriate.