Privacy policy

Data processed: Email address, name, optionally the organisation name, an Argon2id hash of your password, the time of your last sign-in, and for each session the device class and an HMAC hash of your IP address.

Purpose and legal basis: Provision of the service (Art. 6 Abs. 1 lit. b DSGVO) and protection against abusive sign-ins (Art. 6 Abs. 1 lit. f DSGVO). Sign-in, registration and the password forms are additionally checked by the form protection formconfirmed (section 4).

Retention period: Until the account is deleted. Sessions and rate-limit counters expire automatically.

Cookies: A single technically necessary session cookie (ce_session, HttpOnly, SameSite=Lax). No tracking, no analytics cookies in the dashboard.

Here the website operator is the controller; we act as a processor under Art. 28 DSGVO.

What is stored: your choice per category and service, the time, the configuration version, the language, the domain, a coarse device type ("Firefox/Windows"), a SHA-256 hash of the page URL and an HMAC of your IP address with a rotating key.

What is not stored: your IP address in clear text, your full user agent, your location and any kind of cross-site identifier. There is no profiling.

Purpose: Proof of consent under Art. 7 Abs. 1 DSGVO. Without this record the website operator could not demonstrate that you gave consent.

Retention period: 36 months by default, shorter if configured that way. After that an automatic job deletes the record.

Access and deletion: On the lookup page you can use your consent ID at any time to see what is stored and have it deleted — without an account and without telling us who you are.

The forms for signing in, registering, “forgot password”, setting a new password and the contact form are protected against automated submissions by formconfirmed. formconfirmed is a product of formexposed; the provider is LW IT Solutions Company Lukas Wójcik, Łódź, Poland, and it runs on its servers in the EU (Poland). The banner on our customers’ websites does not include this protection.

Data processed: When you open one of these pages, your browser loads a script from formconfirmed.com and fetches a signed task from there. As with any request, formconfirmed.com receives your IP address, your browser identifier, the address of the page and its language. Your browser solves the task in the background (a proof of work) and sends a single-use token along when you submit. It contains the task, the result of the computation, the time taken to fill in the form, the number of genuine keyboard, pointer and focus events in the form, whether your browser reports itself as automated, and whether a field invisible to humans (a trap) was filled in. Our server presents this token to formconfirmed together with your IP address and the content of the trap field, for registration, “forgot password” and the contact form also the email address entered (not when signing in), and for the contact form the text of your message. formconfirmed compares the IP address with the address range the task was fetched from and checks whether it belongs to a data centre; of the email address only the domain (disposable provider, does it accept mail at all); the text with a simple pre-filter for link collections, typical spam phrases and gibberish — without a language model. Passwords and other fields are not sent.

Purpose and legal basis: Protecting accounts and the contact form against abuse through automated submissions (Art. 6 Abs. 1 lit. f DSGVO). formconfirmed answers “allow”, “flag” or “block”. On “block” the submission is rejected. On “flag”, for sign-in, registration and the password forms Google reCAPTCHA must additionally return a clearly human rating, otherwise the submission is rejected — reCAPTCHA only loads if you have allowed it in the cookie banner; a contact request is delivered but marked as suspected spam on our side. After a rejection you can try again or write to us by email. If our server or your browser cannot reach formconfirmed, or the answer is unclear, this also counts as “flag”: the submission then only goes through after the fallback check by reCAPTCHA, otherwise it is rejected or marked as suspected spam. The result only decides about the individual submission; nobody is assessed beyond that.

Retention period: formconfirmed never stores the full IP address, only a shortened form (IPv4 without the last byte, IPv6 only the first 48 bits) as a hash with a key that changes daily. This value is used to detect repeated submissions and sources that were just blocked on other websites; it is deleted from the counter for repeated requests after about one hour, from used tokens after at most eleven minutes, and from check results after at most one hour. The check results themselves (result, score, reasons, domain of the website) are kept without it for 30 days. The email address and the message text are neither stored nor logged; only the result of the mailbox check for the domain is cached for up to seven days. The web server logs of formconfirmed.com keep the full IP address and the browser identifier for 14 days. A spam suspicion on a contact request stays stored with the request on our side.

Cookies: None. formconfirmed stores nothing in your browser and does not fingerprint your device. In the browser it only does what is necessary to submit the form you are using (§ 25 Abs. 2 Nr. 2 TDDDG, Art. 5(3) of Directive 2002/58/EC). No data is transferred to a third country.

On the same forms (sign-in, registration, “forgot password”, new password, contact), Google reCAPTCHA v3 can additionally check whether a submission comes from a human. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. reCAPTCHA is only loaded if you explicitly allow it among the services in the cookie banner; without this consent your browser does not connect to Google for reCAPTCHA.

Data processed: With your consent, your browser loads a script from www.google.com when you submit. Google processes your IP address, information about your browser and device, the address of the page and your behaviour on the page, and may set and read cookies or similar storage (such as _GRECAPTCHA). Your browser receives a token; our server presents only this token to Google and receives a rating — we do not send Google your IP address or the content of the form.

Purpose and legal basis: Protection against automated submissions. The legal basis is your consent (Art. 6 Abs. 1 lit. a DSGVO, § 25 Abs. 1 TDDDG). You can withdraw it at any time in the cookie settings; reCAPTCHA is then no longer loaded. Without consent formconfirmed decides alone (section 4): if it answers “allow”, the submission goes through; if it answers “flag” or cannot be reached, sign-in, registration and the password forms are rejected and contact requests are marked as suspected spam.

Retention period: For contact requests we store the reCAPTCHA rating (a number between 0 and 1) together with the request. How long Google keeps the data is determined by Google; see the Google privacy policy.

Transfer to third countries: Google may transfer data to the USA. Google LLC is certified under the EU-US Data Privacy Framework, for which an adequacy decision of the European Commission exists (Art. 45 GDPR).

This instance runs on its own infrastructure in the European Union. Data is only transferred to a third country if you allow Google reCAPTCHA (section 5).

No external fonts, no CDN, no analytics tools; the website uses its own CMP. The pages with forms are the exception: there, the script of the form protection comes from formconfirmed.com (section 4) and — only with your consent — the one of Google reCAPTCHA (section 5).