Controller: FemProductions GmbH, Wasagasse 31/5, 1090 Wien, Österreich, hello@no451.com.
If you log in with Google we receive your email address, Google's account ID and your first name; no contacts. With an email link we receive your email address. We store your email, your chosen countries, your sites, scans and their results. A login cookie (httpOnly, 30 days) keeps you signed in; we store only a hash of it. Legal basis: contract (Art. 6 (1) (b) GDPR).
We store the address you submit (with signatures in URLs masked), the response headers we received and the check results. Anonymous results are kept for about 30 days and then deleted. Only someone with the result link can see them.
We use Cloudflare Turnstile on the checker and count scans per IP address per day, storing only a salted hash of the IP address. Legal basis: legitimate interest in preventing misuse (Art. 6 (1) (f) GDPR).
Paid plans are processed by Mollie B.V. (Netherlands). We don't receive or store full card numbers. Payment records are kept as required by Austrian tax law (7 years).
The weekly law update email is sent only if you tick the box in Settings (consent, Art. 6 (1) (a) GDPR); you can unsubscribe any time. Emails about your own account and site are part of the service.
Cloudflare (hosting, database, storage, bot protection), Google (login), Mollie (payments), Brevo (emails), Oxylabs (network connections used for scanning; they carry our requests to the sites being checked, not your account data). Where data leaves the EU, it is covered by the EU-US Data Privacy Framework or standard contractual clauses.
We use Cloudflare Web Analytics, which sets no cookies and doesn't track you across sites, to count page views. In our own database we log service events (for example: scan started, scan finished, sign-up, payment status) to run and improve the service and to detect misuse. Events of logged-in users are linked to the account; events without an account contain at most a pseudonymous IP hash (keyed hash with a salt that changes every day, never the IP address itself) and are deleted after 90 days. Legal basis: legitimate interest in operating, securing and improving the service (Art. 6 (1) (f) GDPR). Internal operational alerts (e.g. scanner down, payment failed) are only shown to us internally in our admin area and contain no names or email addresses.
No advertising cookies, no Google Analytics, no cross-site tracking.
You can ask for access, correction, deletion, restriction, portability and object to processing (Art. 15–21 GDPR): hello@no451.com. You can complain to the Austrian Data Protection Authority (dsb.gv.at).
Version 14 October 2026.