Your security data should remain under your control.

1. Controller and contact

Nordis Global OÜ, registry code 14282456, Narva mnt 5-74, 10117 Tallinn, Estonia, is the controller for ScanMyHost account and product data. ScanMyHost is a NordTracer product.

Privacy and data-rights requests: [email protected].

2. Data we process

• Account data: email address, authentication state, language, plan, notification and marketing preferences.
• Authorized scope data: verified domains, selected hosts and paths, ownership evidence, schedules and authorization attestations.
• Security data: scan configuration, bounded technical evidence, findings, reports, remediation and retest history.
• Operational security data: limited sign-in, audit, IP and device/network signals used to prevent abuse and protect tenants.
• Commerce data: Stripe customer and transaction references, purchases, subscriptions, credits, refunds, invoice status and amounts. Full payment-card and bank-account numbers are not stored by ScanMyHost.
• Optional integrations: bounded GitHub repository metadata and temporary credentials supplied for an authorized assessment. Temporary credentials are encrypted, purpose-bound and removed after their short-lived use; source files and installation tokens are not retained as report evidence.

3. Purposes and legal bases

• Contract: create and secure the account, verify targets, run requested assessments, produce reports, provide protection monitoring and administer billing.
• Legal obligation: preserve accounting, tax and transaction records and respond to valid authority requests.
• Legitimate interests: prevent fraud and abuse, protect the service and tenants, diagnose failures, keep an auditable security trail and establish or defend legal claims. We limit and periodically delete the data used for these purposes.
• Consent: send optional product and marketing announcements. Consent can be withdrawn from settings or an unsubscribe link without affecting earlier lawful processing.

4. Payments and Stripe

Checkout and payment processing are provided by Stripe. We send Stripe the minimum information needed to create and reconcile a payment, such as a customer reference, email, product or order reference, amount, currency and transaction status.

Stripe may process transaction, identity, device, IP, fraud-prevention and payment-method data as a processor and, for regulated payment, fraud-prevention and legal-compliance purposes, as an independent controller. Stripe states that in most jurisdictions it generally keeps personal data received from business users for five years or more from the end of the business relationship or the last transaction, whichever is later. The exact period depends on the jurisdiction, service, legal duties and fraud or legal-claim needs.

Deleting a ScanMyHost account does not compel Stripe to erase records that Stripe must or may retain under payment, anti-money-laundering, fraud-prevention or other law. Requests concerning Stripe's independent processing can be made directly to Stripe through its Privacy Center.

5. Retention

We apply category-specific limits instead of retaining all account data indefinitely. A legal hold, dispute or binding authority request may temporarily require a longer period; access remains restricted and the record is deleted or anonymized when the ground ends.

6. Account deletion

The account owner can start deletion from ScanMyHost settings and confirm it with a short-lived verification code. We first revoke connected integrations where required, then remove the tenant's targets, scans, reports, schedules, findings, source-assessment metadata and account data.

A pseudonymous, non-reversible tombstone containing no email, IP address or target is kept for 30 days to prevent deletion races and scrub delayed jobs. Minimum invoice, payment, refund and accounting evidence may remain in a restricted financial record for the statutory period. Stripe may separately retain its own records as explained above.

7. Service providers and transfers

We disclose data only as needed to operate the service, including payment processing (Stripe), transactional email delivery, network and application protection, infrastructure hosting, and optional integrations chosen by the customer. Providers receive only the data needed for their role and are subject to contractual and security controls.

Cloudflare Turnstile protects public forms from automated abuse and processes limited device, network and interaction signals, including IP address, to determine whether a request is legitimate. It does not receive the contents entered into the contact form.

Some providers may process data outside the EEA. Where required, transfers rely on an adequacy decision, applicable Data Privacy Framework participation or Standard Contractual Clauses and supplementary safeguards.

8. Your rights

Depending on applicable law, you may request access, correction, deletion, restriction, objection and portability, or withdraw consent. Some deletion requests are limited where retention is required by law or necessary to establish, exercise or defend legal claims. We may verify identity before acting on a request.

You may complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or the supervisory authority where you live or work.

9. Security and changes

We use tenant isolation, least-privilege access, encryption, bounded evidence, short-lived credentials, audit controls and automated retention jobs. No internet service can promise absolute security; if a breach creates a legally reportable risk, we will notify affected people and authorities as required.

We will update the effective date when this notice changes. Material changes will be communicated through the service or email where appropriate.