Privacy policy

Draft for legal review. Controller: Kerbcut. We process account data (email, name, company, password hash) to provide the service (Art. 6(1)(b) GDPR), order and payment status from Stripe (we never see or store card numbers), and the scan results of the public pages you ask us to test. Page snippets are stored with email addresses and phone numbers masked. Scan results are kept for 12 months, invoices for the legal retention period. Processors: hosting provider, Stripe (payments), Postmark (email). You can access, export (Account → Download my data), correct or delete your data, and complain to your data protection authority (in Portugal: CNPD). We do not use advertising cookies; the only cookie is the login session.