Privacy Policy

Version of 23 October 2026

1. Who is the controller

The controller of your personal data is Radosław Fedorczuk, trading as ENSOMEDIA Radosław Fedorczuk, ul. Chorwacka 33/42, 51-107 Wrocław, Poland, tax number (NIP) 8952195742, EU VAT number PL8952195742, business register number (REGON) 381626230, entered in the Polish Central Register and Information on Economic Activity (CEIDG). Below we call ourselves "ENSOMEDIA" or "we".

This policy covers the ShieldWave service at shieldwave.io (website, browser app, free tools and API) and the connections of the WordPress plugin "Ensomedia Security powered by shieldwave.io" to ShieldWave. We process data under Regulation (EU) 2016/679 (GDPR) and Polish law.

Contact for anything about personal data:

• E-mail: support@shieldwave.io

We have not appointed a data protection officer. The GDPR does not require one of us: our core activity is checking websites, not regular monitoring of people or large-scale processing of special categories of data.

2. Summary

Legal bases in the table: contract is Article 6(1)(b) GDPR, legal obligation Article 6(1)(c), legitimate interest Article 6(1)(f), consent Article 6(1)(a).

3. Customers and account users

3.1 What we store

• your user name and a bcrypt hash of your password (we do not know the password);
• your e-mail address, required at sign-up: we send notifications, messages about the contract and password reset links to it;
• your first and last name if you add them; your language, plan and settings;
• login sessions (24 hours) and password reset links (1 hour);
• API keys, only as a hash, with the prefix, name and date of last use;
• sites, schedules, notification rules, webhook addresses and secrets;
• for reports with your logo: agency name, logo and contact e-mail;
• team invitations (teams of up to 10 people): the invitee's e-mail address, for 7 days;
• usage events: the kind of event (for example sign-up, check, purchase), account identifier, domain, IP address and browser identification; the sign-up event also holds the user name and e-mail.

Our own systems do not store a company name, time zone, device identifiers, card data or domain registration (WHOIS) data.

3.2 Why and on what basis

The account, checks, reports, monitoring, team, API and webhooks are how we perform our contract with you (Article 6(1)(b) GDPR). Usage events serve our legitimate interest in seeing which features are used and what fails, so that we can improve the service (Article 6(1)(f)). Security and evidence: section 13. A user name, a password and an e-mail address are required; without them you cannot open an account.

3.3 People invited to a team

If a customer invited you to their team, your e-mail address came from them. We use it only for the invitation and your access to their account. The basis is our legitimate interest and that of the customer who invites you: the team's work in their account (Article 6(1)(f) GDPR).

3.4 How long

We keep account data until you delete the account in your profile. Deletion takes effect at once; backups and our providers' logs roll off within 30 days. Only billing data (section 4), the deletion record (section 13) and evidence (section 16) remain. Usage events are deleted after 12 months or together with the account.

4. Payments and invoices

Stripe handles payments on its own pages; we never see or store card numbers. Stripe collects the payment and invoice details, such as your address and VAT number. We pass Stripe your e-mail, user name and account identifier to link the payment to your account.

We store your Stripe customer and subscription identifiers, plan, the end dates of the billing period and trial, and for one-off purchases the session and payment identifiers, amount, currency and the reports you may access, as well as payment events such as renewals and cancellations.

Stripe Payments Europe, Limited handles payments for us and acts as a separate controller for fraud prevention and its own legal duties, as its privacy policy explains.

We issue invoices to businesses, and to consumers on request. Our accounting office receives them, and where the law requires it they go to the Polish national e-invoice system (KSeF).

The legal bases are the contract (Article 6(1)(b)) and our tax and accounting duties (Article 6(1)(c)) under the Polish Tax Ordinance and VAT Act. Section 16 gives the retention periods.

5. Checks ordered from an account

5.1 What a check does

A check ordered from an account reads what the site's server returns and asks for addresses where forgotten files are usually found. Only after you confirm control over the domain (a DNS record, a file, a meta tag or a connected plugin) does it also send test inputs to the site's forms and addresses to see whether the site refuses what it should refuse. We also ask public services about the checked domain (certificate logs, public DNS, lists of dangerous sites and, once the domain is confirmed, public cloud storage services), sending them only the domain name or names made from it.

5.2 What we store

We store the result: the domain, the findings with evidence and up to 5,000 characters of the homepage text. It can contain personal data published on the site (section 7). Login details you give for a check behind a login are used only for that check. PDF reports are created when you ask and are not stored.

Once control of the domain is confirmed, we also store a screenshot of the homepage and show it in the report. It shows what the homepage shows to every visitor.

If you create a status badge, its public page shows the domain, grade, score and date of the check. The webhooks and integrations you set up (Slack, Microsoft Teams, Discord, your own address) receive the domain, score, severity and number of problems.

5.3 Who is the controller

If you order checks for your business (as a company, an agency or a sole trader), you decide which sites we check and are the controller of the third-party data in the results, or a processor for your own client. We process that data on your behalf, only to provide the service, under the Data Processing Agreement, which is part of the Terms of Service. You are responsible for your right to check the site and for informing people where that is your duty.

If you use ShieldWave as a consumer, we are the controller of the third-party data in the results and use it only to carry out the check you ordered (legitimate interest, Article 6(1)(f)).

5.4 How long

On the Free plan you see the result for 7 days, and we delete it no later than 90 days after the check. On the Pro and Enterprise plans we keep it for 12 months. A check for which a one-off report was bought is kept for 90 days. Deleting the account also deletes the results.

6. The demonstration check and the free tools

On the home page anyone can run the demonstration check of a domain they type, without an account. The four free tools check the certificate, mail records (SPF, DKIM, DMARC), security headers and cookies set before consent. These checks are shorter: they read what the server returns, and the demonstration check also asks for a list of addresses where forgotten files are usually found. They send no test inputs to forms and use no AI.

Only you see the result, and it is not saved as a check in any account. We keep:

• for the demonstration check, an event with the domain, IP address and browser identification, for 12 months;
• for a free tool, an event with the tool and the domain, without the IP address, for 12 months;
• rate-limit counters per IP address (for example 3 demonstration checks an hour), stored as a hash of the IP address computed with a secret key, not the address itself, in the database, for up to 2 hours;
• free tool results, in memory, for 10 minutes, so that the same domain is not checked again and again;
• the request log entry at our hosting provider, whose address contains the domain, for 30 days.

The legal basis is our legitimate interest in showing how ShieldWave works, answering without an account and protecting the service against abuse (Article 6(1)(f)).

Result by e-mail and the weekly check

Under the result you can type an e-mail address. For this we keep a copy of the result (domain, score and the problems shown) under a random number for 24 hours. We send one e-mail with the result to that address and keep the address with the domain, the score, the types of problems found and a hash of your IP address computed with a secret key (at most 5 e-mails an hour from one connection). The e-mail has a button that turns on a weekly check: once a week we run the same demonstration check of that domain and write only when the score drops or a new problem appears. Every such e-mail has a link that stops it at once.

Without the button we send nothing more and delete the address after 30 days. After the button we keep the data until you stop the weekly check, and 30 days after. The legal basis for the first e-mail is our legitimate interest in answering your request (Article 6(1)(f)); for the weekly check it is your consent given with the button (Article 6(1)(a)), which you withdraw with the link in every e-mail.

7. People whose data appears on checked sites

If your name, e-mail address, WordPress author name or other details are published on a site that someone checks with ShieldWave, they can end up in the check result. The source of this data is that public site.

We do not look for this data on purpose, build no profiles from it and do not contact you. It is part of the report and, for checks ordered from an account, of the excerpt sent for AI analysis (section 10). We keep it as long as the result (section 5.4); the demonstration check and the free tools do not save it.

When a customer orders the check for their business, that customer is the controller (section 5.3). Otherwise we are, and the legal basis is our legitimate interest in carrying out the check someone asked for and in making websites safer (Article 6(1)(f)). We usually have no contact details for you, and finding them would take disproportionate effort and more data, so instead of informing each person we publish this notice (Article 14(5)(b) GDPR).

You have the rights in section 17. If the site is yours, you can also ask us to exclude its domain from all checks: write to support@shieldwave.io from an address at that domain, or show in another way that you control it. We exclude the domain within 2 working days and keep it on our exclusion list. More: The ShieldWave scanner and domain exclusion.

8. Connections of the WordPress plugin

The plugin "Ensomedia Security powered by shieldwave.io" is separate software under the GPL that runs on your site. What it stores in your WordPress database stays on your server, and the cookie it sets stays in the browsers of your site's users. You are the controller of this data. When the plugin pauses logins, its activity log records the IP address, the time and the user name typed (the user name only when that account exists) and keeps them for the period set in the plugin, 90 days by default. After a successful login the plugin sets a cookie whose name starts with shieldwave_kd_ (more in the Cookie Policy). The plugin supports the WordPress tools for exporting and erasing personal data.

8.1 Without extra features

With every scan the plugin fetches checksums and plugin and theme information from WordPress.org, sending the WordPress version, language, folder names and versions; WordPress adds your site's address. These requests go to WordPress.org, not to us.

8.2 Live protection

When a site administrator switches on live protection, the plugin sends us the WordPress version and the folder names and versions of plugins and themes to check them against known vulnerabilities, downloads a signed rule set from us about once an hour (sending only the plugin version), and asks for an AI second opinion on files the scanner could not settle (section 10.2).

8.3 Connection to a ShieldWave account

A site administrator can connect the site to an account in two ways. "Connect with shieldwave.io" opens shieldwave.io/connect with the site's address and an address on the site to return to. After you sign in and confirm, we issue a single-use code, valid for 5 minutes and only for that site's host, and store only its hash with the account and the host. Your browser takes the code back to the site, and the plugin exchanges it, server to server, for a key that works only for this site's connection. We send the plugin the key, the plan and the account's e-mail address or user name; the plugin keeps them in the WordPress database and shows which account the site is connected to. The other way is to paste an API key from your account.

Once connected, the plugin sends the site identifier, domain, site address, plugin, WordPress and PHP versions and multisite status, and then every hour a signal that it is running, with the score and the number of open problems. After each scan, unless an administrator switched this off in the plugin, it sends the results: the score, active theme, language, plugins and themes with versions, and the problems found (title, description, fix, path, address, line, CVE number), including those ignored in WordPress, which are marked as ignored. This applies on every plan. On the Free plan it applies to every site the account connects. From version 1.1.0 the plugin sends problems about administrator accounts with their title and fix only. From version 1.1.10 the same applies to every problem that names user accounts, for example a publicly readable list of users, and the identifier of such a problem is a hash computed with your site's own secret key, so no login name leaves the site. Earlier versions may include a login name in the description.

While the site is connected, the plugin adds a shieldwave-verify meta tag with your account's confirmation code for this domain to the home page. shieldwave.io reads the home page without keeping it and, when it finds the code, confirms that the account controls the domain (section 5.1). The plugin asks for this after connecting and, while the domain is not confirmed, at most every 6 hours. A copy of the site at another address shows no tag.

We also see the IP address of your site's server (request log, 30 days).

8.4 Legal basis and retention

For a connected site we act on behalf of a customer who uses it for their business (section 5.3), or for a consumer under the contract (Article 6(1)(b)). We handle requests without an account (vulnerability lookup, rules, AI second opinion) as controller, in our legitimate interest in answering the site administrator and protecting the service (Article 6(1)(f)).

We keep a connected site's data until you disconnect it. When you disconnect the site in the plugin, or remove it from WordPress sites in your account, we delete the site, its results and the key the one-click connection created for it, and refuse later messages from the plugin about that site. For that we keep only the site identifier and the date of removal, until you connect the site again or delete the account. An API key you pasted stays in your account until you delete it on the API keys page. The confirmation of the domain (section 5.1) stays with the account, as one made in any other way does. Deleting the account deletes all of this. From version 1.1.10, deleting the plugin in WordPress also asks us to disconnect the site, and we then delete its data as described above. The plugin sends this request only when the site is connected with a valid key. It waits at most 5 seconds, and the plugin is deleted even if the request fails. With an earlier version, disconnect the site before deleting the plugin. If the request does not reach us, remove the site in your account or write to us.

8.5 Decoys and notices of new vulnerabilities

From version 1.1.21 a site administrator can turn on decoys in the plugin: login names that no account has, and a path in robots.txt that nothing links to. Both are off by default. While the site is connected and a decoy is on, the plugin sends us which decoys are on and a record of each use of one: its kind (login or path), the time, how the attempt came in (the login form, an application password, XML-RPC or robots.txt), whether the address was locked out and, if it was not, why. Instead of the visitor's IP address the record carries a 16-character code that the plugin computes from the address with a secret key that never leaves your site. We cannot recover the IP address from the code: it only tells attempts from the same address on that site apart, and the dashboard shows those addresses as letters. We never receive the IP address, the login name typed, the browser identification or the address requested. With decoys off, the plugin sends no records. An attempt from the last 24 hours also creates a notice in the app. We keep the records 90 days and do not accept records older than 30 days; disconnecting or removing the site, or deleting the account, deletes them sooner. For these records we act as described in section 8.4.

When a newly published vulnerability affects a version of a plugin, theme or WordPress that a connected site reported, we tell the account through its notification settings and record which site, vulnerability, component and version the notice was about, so that the same notice is not sent twice. The record is deleted with the site.

9. People we wrote to earlier from the getshieldwave.com domain

We do not send marketing by e-mail without your prior consent. If before 29 September 2026 you received a message from radek@getshieldwave.com, we took your work e-mail address, and sometimes your name and company name, from your company's public website or a public register (CEIDG, KRS). We keep the address, the correspondence and the date sent for 12 months from sending, and if you object, only the address on a do-not-contact list so that we do not write again. The legal basis is our legitimate interest in defending against claims and in respecting your objection (Article 6(1)(f) GDPR). You can ask us to erase this data: write to support@shieldwave.io.

10. AI processing

10.1 What AI does

On checks ordered from an account, when the AI service is available, a language model:

• explains the findings and writes the report summary, matched to what the site's business does;
• drafts repair steps;
• reviews the severity of findings and may raise or lower it, and marks and lowers likely false alarms; the scanner's original result is kept and shown;
• describes possible business and legal consequences of findings; this is for information and is not legal advice (point 8.1 of the Terms of Service);
• suggests which tests suit the site's technology;
• translates descriptions of known weaknesses.

While control of the domain is not confirmed, AI only writes the texts of the report: it does not review the severity of findings and does not suggest tests.

A second model checks the AI text against the scan data. In the plugin, only when the site's administrator switched it on, AI gives a second opinion on a file the scanner could not settle.

AI does not chat, makes no decisions about people, and never edits, quarantines, deletes or blocks anything. The demonstration check and the free tools use no AI. We mark AI-written text with the label "AI".

10.2 What we send to the AI provider

From checks ordered from an account: the domain, technical findings (type, severity, address, headers, up to 500 characters of evidence per finding) and an excerpt of the homepage (up to 3,000 characters with the title, description, headings and footer). This excerpt can contain names or contact details published on the site.

From the plugin: an excerpt of the file up to 6,000 characters, the file's fingerprints (sha256, md5), size, the folder name of the component, rule identifiers, the site's language setting, the plugin version and a salted hash of the site identifier. From version 1.1.10 the plugin removes from the excerpt the site's address, e-mail addresses, IPv4 and IPv6 addresses, the server paths of WordPress and of home folders, every DB_ constant and the arguments of database connections, constants and values named like a password, key, salt, secret or token (when they are 6 characters or longer), and long random tokens. Other web addresses stay. If the removal fails, nothing is sent. Earlier versions removed only passwords, keys, e-mail addresses and the site's host name.

We never send account data, passwords or payment data. From version 1.1.10, for the second opinion the plugin never reads files whose names start with wp-config or .env, the files .htpasswd, .user.ini, php.ini and auth.json, backup copies, database dumps (.sql), log files or .ini files. Earlier versions never sent wp-config.php or .env.

10.3 Provider and retention

Our AI provider is Groq; the contracting party for customers in the EEA is Groq UK Limited, and the data is processed in the USA (section 15). Our AI provider is contractually barred from using this data to train models. It does not store it, except for up to 30 days when it investigates a reliability problem or suspected abuse.

Our own cache keeps AI answers for up to 1 hour in memory and 24 hours in the database. Verdicts on plugin files are kept by file fingerprint without a time limit and reused for the same file on other sites; we store the fingerprint and the verdict, with no site name. We also record that a file with that fingerprint appeared on a site identified by a salted hash; we delete that record after 12 months.

The legal basis is the contract for checks ordered from an account (Article 6(1)(b)), and our legitimate interest for the plugin's second opinion without an account and for third-party data in excerpts (Article 6(1)(f)). When a business customer or a sole trader with consumer rights orders the check, we process third-party data in excerpts on its behalf (section 5.3). More: AI in ShieldWave.

11. E-mail

11.1 E-mail we send

From noreply@shieldwave.io we send to the account's e-mail address: a welcome after sign-up, notice that a check has finished and what weaknesses it found, monitoring and uptime alerts, purchase confirmations, reports you ask for and password reset links. The legal basis is the contract (Article 6(1)(b)). Our mail provider, Hostido.pl Gałązka Spółka jawna, sends them (section 14). To the address typed under the demonstration check's result we send that result and, only after the button in that e-mail, a weekly note when the site's result gets worse (section 6).

We have no newsletter, and we will ask for your consent before sending you any marketing. Our e-mails contain no pixels or links that measure opens and clicks.

11.2 When you write to us

When you write to support@shieldwave.io, we process your address and message to answer you. The legal basis is the contract (Article 6(1)(b)), for complaints also a legal obligation (Article 6(1)(c)), and otherwise our legitimate interest in answering and keeping evidence (Article 6(1)(f)).

The same applies when you ask us to fix the problems of a demonstration check with the form under its result. The request reaches support@shieldwave.io as an e-mail with the address, the name and the message you give and the result of that check (domain, score, problems found). We use it only to answer this request. The legal basis is your consent given with the box in the form (Article 6(1)(a)) and steps taken at your request before a contract (Article 6(1)(b)). We keep it like other correspondence (section 16); you withdraw the consent by writing to support@shieldwave.io.

11.3 Ordering a site cleanup

When you order the cleanup of a hacked site in the dashboard, we store the domain, the description of the problem you give, the account e-mail and your consent to access the site, to prepare a quote and do the work. The legal basis is the contract and steps taken before entering into it (Article 6(1)(b)). We keep the request until the account is deleted. If the work was done, the contract and billing documents are kept like other contract evidence and invoices (section 16).

12. Website, cookies and analytics

Requests to the site go straight to our hosting provider, Google Cloud. Cloudflare only answers DNS queries for our domain and does not see the requests; before we route traffic through Cloudflare to protect the site, which would let it see every request with the IP address, we will update this policy. The request log at our hosting provider records the IP address, time, page address, browser identification and the address of the referring page; we keep it for 30 days. The legal basis is our legitimate interest in running and protecting the site (Article 6(1)(f)).

With your consent, Google advertising features and Meta Pixel measure our ads, page views and purchases. Meta receives browser and click identifiers, page addresses and purchase value/currency; not scan domains or results. You can withdraw consent in Cookie settings. Google Tag Manager and Google Analytics 4 require analytics consent; Meta Pixel requires both analytics and marketing consent. Necessary cookies do not depend on these optional choices.

Meta Platforms Ireland Limited: Meta Privacy Policy, Meta Cookies. Cookies _fbp and _fbc: up to 90 days. Advanced Matching and Conversions API are disabled. The pixel also requires analytics consent because only that consent loads the container. Withdrawing marketing consent stops the pixel and clears its cookies.

We also count page views, without cookies. On every page view of this website your browser sends us a short message: the address of the page (without the part after "?"), the address of the referring site, the utm_source, utm_medium and utm_campaign values from the page address, and whether a Google Ads click identifier was in the address (not the identifier itself). From the browser identification we work out only the type of device (phone, tablet or computer), and the country from a header of our hosting provider, when it supplies one; we then discard the browser identification. The result is added to a daily total. We store no IP address, no browser identification and no identifier of a person, we set no cookie and write nothing to your browser, so we cannot tell the visits of one person apart or recognise a returning visitor. Views by automated programs are not counted, and the operator's own views are counted separately. The message reaches us like any request, so the request log at our hosting provider (above) also holds its IP address for 30 days. The daily totals are kept for 13 months. The legal basis is our legitimate interest in knowing which pages and campaigns are visited (Article 6(1)(f)). You can object (section 17.3), and blocking the request in your browser stops the counting.

Details, including the list of cookies and browser storage: Cookie Policy.

13. Security and abuse logs

13.1 What we record

• an account event log (for example sign-up, changes to the account) with IP addresses;
• the request log at our hosting provider;
• rate-limit counters per IP address and per account, in server memory;
• your statement that you have the right to check a site: account, domain, time, where it was given, IP address and browser identification;
• a record of account deletion (user identifier and user name, IP address, date);
• the list of domains excluded from checks, and the exclusion requests.

The legal basis is our legitimate interest (Article 6(1)(f)) in protecting the service, our customers and checked sites against abuse, such as checking other people's sites without permission, getting around limits or attacks on the service; in showing that we acted lawfully and under the contract; and in establishing, pursuing or defending legal claims.

13.2 How we protect data

Connections are encrypted (TLS, HSTS); passwords are stored as bcrypt hashes and API keys as hashes; the session cookie is HttpOnly, Secure and SameSite=Strict. We protect forms against forged requests, limit requests per IP address and per account, and block the scanner's requests to internal addresses. The service runs in the EU at Google Cloud, with the provider's encryption at rest, access control and secret manager; requests reach it through Google's front-end infrastructure (Google Front End), which filters network attacks. We keep an account event log, delete data automatically by the retention rules, and only the owner of the business can access the production systems.

14. Recipients

Recipients you choose also receive data: Slack, Microsoft Teams, Discord and your own webhook address (section 5.2). WordPress.org is contacted by your site with the plugin, not by us (section 8.1).

The current list with details: Subprocessors and recipients. Before we start passing data to a new provider, we add it to that list.

15. Transfers outside the EEA

Cloudflare, Groq, Stripe and Google group companies may process data in the USA. For these transfers we rely on:

• the EU-US Data Privacy Framework (Commission Decision (EU) 2023/1795) for companies that take part in it; Cloudflare also applies standard contractual clauses;
• standard contractual clauses adopted by Commission Decision (EU) 2021/914 for the other companies, including Groq.

We will send you a copy of these safeguards on request: write to support@shieldwave.io.

16. How long we keep data

17. Your rights

17.1 What rights you have

You have the right of access to your data and to a copy (Article 15 GDPR), to rectification (Article 16), to erasure (Article 17), to restriction of processing (Article 18), to portability of data you gave us under a contract or consent (Article 20) and to object (Article 21, section 17.3). You can withdraw consent at any time; this does not affect processing before the withdrawal (Article 7(3)).

17.2 How to use them

In your profile you can correct your data, download your account data as JSON (profile, checks, monitored domains, notifications) and delete the account. For anything else, write to support@shieldwave.io. We answer within one month; in a complex case we may extend this by two months and will tell you why. We may ask you to confirm that the data concerns you, for example by writing from the account's address.

If your data is in the results of a check that a customer ordered for their business, we pass your request to that customer as the controller and help them to carry it out.

17.3 Right to object

You may object at any time, on grounds relating to your particular situation, to the processing of your data based on our legitimate interest (Article 6(1)(f) GDPR). We will then stop, unless we show compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed to establish, pursue or defend legal claims.

You may object at any time, without giving reasons, to processing of your data for marketing.

17.4 Automated decisions

We make no decisions about you based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR). AI assesses technical problems of websites, not people.

18. Complaint to a supervisory authority

You can lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stanisława Moniuszki 1A, 00-014 Warszawa, Poland, uodo.gov.pl, or with the data protection authority of the EU country where you live or work or where the infringement took place. You can write to us first; we will try to resolve the matter.

19. People outside the European Union

We are established in Poland and apply the GDPR to everyone, wherever they live. We have no representative outside the European Union. If the law of your country gives you further rights, write to us and we will answer.

20. Age

You must be at least 18 years old to open a ShieldWave account. We do not knowingly collect data about children. If we learn that a younger person opened an account, we will delete it.

21. Changes to this policy

We change this policy when the service, our providers or the law change, and publish each version on this page with its date and an entry in the change history. Before changes to how we process customers' data take effect, we tell account holders by e-mail. We will send a previous version on request.

When we send or show a notice of a change, by e-mail or as a notice in the app, we record for each account when it was sent or first shown, and when it was closed or accepted, so that we can show that the notice was given. The legal basis is our legitimate interest in proving that we informed you (Article 6(1)(f)). We keep this record until the account is deleted.

22. Change history

• 23 October 2026: the demonstration check's result by e-mail, and the weekly check of the domain after a click in that e-mail (sections 2, 6, 11.1 and 16). It concerns people without an account, not the processing of customers' data, so no notice under section 21 is sent.
• 24 October 2026, addition without a new version: asking us to fix the problems of a demonstration check with the form under its result (section 11.2). It concerns people without an account, not the processing of customers' data, so no notice under section 21 is sent.
• 22 October 2026: on the Free plan the plugin sends results for every connected site (section 8.3); demonstration check rate-limit counters as a hash of the IP address in the database for up to 2 hours (sections 6 and 16); ordering a site cleanup (section 11.3).
• 19 October 2026: WordPress plugin 1.1.21 and the Free plan. Records of decoy use and notices of new vulnerabilities on connected sites (sections 2, 8.5 and 16); on the Free plan the plugin sends results for three sites (section 8.3).
• 20 October 2026, addition without a new version: the anonymous page-view count without cookies (sections 12 and 16). It concerns visitors to the website, not the processing of customers' data, so no notice under section 21 is sent.
• 8 October 2026: WordPress plugin 1.1.10. What the plugin keeps on your server and the cookie it sets after a login (section 8); rules fetched about once an hour (section 8.2); problems that name user accounts are sent without login names (section 8.3); deleting the plugin asks us to disconnect the site (section 8.4); what the plugin removes from excerpts for the AI second opinion and which files it never reads (section 10.2).
• 30 September 2026: connecting the WordPress plugin in one click, and what the plugin sends on each plan, including problems ignored in WordPress (section 8.3); the verification tag the plugin shows on the home page (section 8.3); disconnecting a site deletes its data (sections 8.4 and 16); the record of notices of changes (sections 16 and 21).
• 29 September 2026, correction on the same day: Cloudflare today only answers DNS queries for our domain and does not see requests to the site; we say what changes when traffic goes through it (sections 12, 13.2 and 14). Public cloud storage services are added to the public services asked about a checked domain (sections 5.1 and 14).
• 29 September 2026: this version replaces the privacy policy of February 2026. It corrects the controller's details, the list of providers, the description of data sent to AI and the retention periods, and adds notices for people who are not our customers.

21 October 2026: Meta Pixel (page views and purchases), marketing consent and renewed consent (version 3).