Scanning…
// Data Protection & GDPR

Privacy Policy

Last updated: September 6, 2026 · Established in Luxembourg (Europe/Luxembourg).

1. Data Controller

The WebGuardian service (available at webguardian.cloud) is operated from Luxembourg. As the data controller, WebGuardian is committed to ensuring a high standard of data privacy in strict compliance with the General Data Protection Regulation (EU Regulation 2016/679 - GDPR) and the regulations of the National Commission for Data Protection (CNPD Luxembourg).

2. Technical Architecture & Dual Database Processing

To ensure production performance, monetization integrity (Stripe compliance), and tamper-proof verification, WebGuardian implements a partitioned data architecture using two distinct database engines:

  • 1. Production Database (MariaDB / MySQL): Hosted on our secured European cloud infrastructure (Hostinger). It stores real-time scan diagnostic results, enforces rate-limiting policies, detects security threats, and powers the public metrics API (/api/v1/public/metrics).
  • 2. Local Audit & Historical Reconciliation Database (SQLite 3 WAL): Used for log processing, periodic reconciliation against raw server access logs, and generating cryptographically sealed monthly audit trails (SHA-256).

3. Data Collected & Pseudonymization Measures

WebGuardian adheres to data minimization principles (Art. 5.1.c GDPR). Only technical indicators necessary for web security diagnostics are collected:

  • Target Domain / Host Analyzed: The public hostname submitted for diagnostic testing (e.g. example.com). Public server configurations are assessed (HTTP response headers, TLS version, cookie security flags).
  • Requester IP Address (Salted Cryptographic Hash): Under our SecOps design, no raw user IP addresses are ever stored in our SQL database tables. All IP addresses are instantly converted into an irreversible fingerprint via a salted HMAC-SHA256 hash (client_ip_hash). This prevents brute-force abuse and enforces rate limits without enabling direct personal identification.
  • Technical Execution Metadata: High-precision start and completion timestamps (Europe/Luxembourg timezone), duration in milliseconds, HTTP response codes, security grade, and aggregated vulnerability counts by severity.

4. Purposes & Legal Grounds for Processing

Data processing activities are conducted under the following legal bases:

  • Diagnostic Service Delivery: Performance of the contract / request initiated by the user (Art. 6.1.b GDPR).
  • Infrastructure Defense & Anti-Abuse: Legitimate interest (Art. 6.1.f GDPR) in protecting systems against DDoS attacks, scan flooding, and artificial metrics inflation.
  • Public Cybersecurity Telemetry: Legitimate interest (Art. 6.1.f) in publishing anonymized benchmark indicators reflecting web security configurations across the web (e.g. CSP and HSTS adoption rates).

5. Data Retention Periods

  • Diagnostic Scan Records: Retained to allow historical comparison and continuous security surveillance for subscribed domains.
  • Rate Limiting Records: Event records expire and are disregarded past their active sliding monitoring windows (10 minutes per IP, 60 seconds per domain).
  • Physical Server Access Logs: Retained for a maximum of 12 months in accordance with European legal logging obligations, then purged following monthly reconciliation cycles.

6. Data Recipients & Zero-Sale Guarantee

Strict Privacy Commitment: WebGuardian never sells, rents, monetizes, or shares scan data, traffic indicators, or IP hashes with ad networks, data brokers, or marketing intermediaries.

Technical infrastructure is hosted within the European Union by Hostinger International Ltd., bound by standard data protection agreements aligned with EU GDPR requirements.

7. Exercising Your Rights (GDPR & CNPD)

Under Articles 15 through 21 of the GDPR, you have the right to access, rectify, delete, restrict, and object to the processing of your data.

For any inquiries regarding data protection or to request the exclusion of a domain name from public aggregated metrics, please contact us through our Secure Contact Form →.

If you believe your data protection rights have been infringed, you may lodge a complaint with the Luxembourg supervisory authority:
National Commission for Data Protection (CNPD)
15, Boulevard du Jazz, L-4370 Belvaux, Luxembourg — Website: cnpd.public.lu

8. Cookie Policy & Legal Consent Exemption

Strict « Privacy by Design » Commitment: WebGuardian uses zero advertising trackers, zero third-party cookies, and no behavioral profiling or analytics scripts.

The only cookie placed on your browser is a strictly technical session cookie configured with maximum security flags: HttpOnly (inaccessible to JavaScript), Secure (transmitted exclusively over encrypted HTTPS), and SameSite=Lax (cross-site leak prevention).

Legal Exemption from Consent (ePrivacy Directive & CNPD):
Pursuant to Article 5(3) of the European ePrivacy Directive (Directive 2002/58/EC as amended) and the guidelines issued by the European Data Protection Board (EDPB) and CNPD Luxembourg, this cookie is strictly necessary to ensure service security (generating and verifying CSRF anti-forgery tokens for form submissions). It is therefore legally exempt from prior cookie consent banners.

Encryption & Purge of Contact Inquiries:
If the SMTP transmission pipeline is momentarily unreachable, contact messages are immediately sealed under strong encryption via libsodium secretbox (256-bit key). As soon as delivery to the administrator succeeds, the encrypted queued copy is permanently deleted. If delivery fails after 3 automated attempts, records are retained for a maximum of 14 days before automatic permanent disposal (Art. 5.1.e GDPR).

Back to Home