1. Controller
Jonas Klein, c/o Impressumservice Dein-Impressum, Stettiner Str. 41, 35410 Hungen, Deutschland. Email: jonasklein.business@pm.me.
2. What Deckproof does
On your request Deckproof checks a website address you enter. Our server fetches the publicly reachable pages of that address the way any browser does and evaluates the responses. No forms are submitted, nothing is written, no logins are attempted.
3. What we process
Scans: the address you enter, the result (grade, list of findings, technical evidence such as response headers or the names of reachable files, the list of requests made) and your IP address. The IP address is used only to prevent abuse (limiting scans per connection). Fetched page content is discarded after evaluation.
Public report pages: unless you choose "do not list this scan publicly", the grade of the checked address can be viewed at an address like deckproof.dev/B/example.com together with the names of the findings. Evidence, samples and fixes never appear there. Using "Share" creates an additional link with a random identifier.
Accounts: if you sign in, we store your email address, the time of sign-in and the scans you ran while signed in. Sign-in links are sent by email; there is no password. Watched sites (Pro and Agency) and your agency branding (name, logo, website) are stored with your account.
Purchases: payment is handled by Paddle.com Market Ltd (London, UK) as merchant of record. Paddle processes your name, email, billing country, payment method and the transaction under its own privacy notice. We receive the transaction ID, the product bought, your email and the checked site address, and store them to grant and prove access. We never see card details.
Server logs: our hosting provider processes technically necessary connection data (IP address, time, requested address, browser identifier) to deliver the pages and keep them secure.
Local storage: the site remembers settings (motion on or off, whether the mascot is hidden) in your browser's local storage. This data never leaves your browser. No cookies are set for advertising or analytics. One httpOnly cookie holds your report unlock after a purchase.
4. Legal bases
Running the scan, showing the report, providing your account and processing purchases serve the performance of your request or contract (Art. 6(1)(b) GDPR). Storing the IP address against abuse, the server logs and the audience measurement below rest on our legitimate interest in a secure and improving service (Art. 6(1)(f) GDPR). Where a checked website contains personal data of third parties, we process it only to establish whether it is publicly reachable; we show it masked and only to the person who started the scan.
5. Retention
Scan results and the associated IP address are deleted after 90 days; scans in a signed-in account stay until you delete them or the account. Public grades expire after 30 days. Report unlocks expire after 7 days and the record is kept for 3 years for accounting. Server logs are deleted by the hosting provider under its own schedule.
6. Recipients and processors
Hosting: Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA, on the basis of standard contractual clauses; Vercel is certified under the EU-US Data Privacy Framework.
Audience measurement (Vercel Web Analytics): we count page views and single events (for example "scan started") without cookies and without cross-device identifiers. Vercel derives a daily changing hash from IP address and browser data that cannot be traced back to you; the IP address is not stored. No information is stored on or read from your device, so no consent is required.
Database and authentication: Supabase Inc., data centre in Frankfurt am Main (EU). Data processing agreement in place.
Email delivery: Resend Inc. (sign-in links, receipts for report unlocks, grade-drop alerts), EU region. Data processing agreement in place.
Payments: Paddle.com Market Ltd, as described above.
Fonts: served from our own server. No connection to Google Fonts.
7. Your rights
You have the right of access, rectification, erasure, restriction, data portability and objection (Art. 15 to 21 GDPR), and the right to lodge a complaint with a supervisory authority. If your website was scanned and you want the report deleted, write to jonasklein.business@pm.me; we delete the report and, on request, exclude the address from future public listings.
8. Not legal advice
Statements in reports on legal topics are general information with sources, not an assessment of your individual case.
Last updated: 08.09.2026