1. Controller
Jonas Klein, c/o Impressumservice Dein-Impressum, Stettiner Str. 41, 35410 Hungen, Deutschland. Email: hallo@deckproof.dev.
2. What Deckproof does
On your request Deckproof checks a website address you enter. Our server fetches the publicly reachable pages of that address the way any browser does and evaluates the responses. No forms are submitted, nothing is written, no logins are attempted.
3. What we process
Scans: the address you enter, the result (grade, list of findings, technical evidence such as response headers or the names of reachable files, the list of requests made) and your IP address. The IP address is used only to prevent abuse (limiting scans per connection). Fetched page content is discarded after evaluation.
Public report pages: only if you tick "list this grade publicly on deckproof.dev" when scanning, the grade of the checked address can be viewed at an address like deckproof.dev/B/example.com together with the names of the findings. Evidence, samples and fixes never appear there. Using "Share" creates an additional link with a random identifier.
Accounts: if you sign in, we store your email address, the time of sign-in and the scans you ran while signed in. Sign-in links are sent by email; there is no password. Watched sites (Pro and Agency) and your agency branding (name, logo, website, accent colour) are stored with your account. For a watched site we also read, once a day, when its TLS certificate and its domain registration expire: from the certificate the site presents and from the public registry (RDAP); this concerns the site, not a person. Client links an agency creates (the site, an optional "prepared for" name, the language, how often the link was opened and when last) are stored with the agency's account, expire after 90 days and are deleted with the account; opening one stores no IP address and sets no cookie.
Purchases: payment is handled by Paddle.com Market Ltd (London, UK) as merchant of record. Paddle processes your name, email, billing country, payment method and the transaction under its own privacy notice. We receive the transaction ID, the product bought, your email and the checked site address, and store them to grant and prove access. We never see card details.
Cancellation and withdrawal: if you cancel with the "Cancel contracts here" button, we store what you enter in the form (type of cancellation, the reason in the case of a cancellation for cause, which contract, name, email address, optionally address and receipt number, the date you want the contract to end), together with the date, time and IP address of receipt and the wording of the confirmation we sent you. We need this to identify you, carry out the cancellation and prove the receipt that § 312k(4) of the German Civil Code requires us to confirm. Only the email address is mandatory; everything else just helps us find your contract. The same holds for a withdrawal through the "Withdraw from contract" button, where § 356a(2) of the German Civil Code makes your name, something identifying the contract and the email address for the acknowledgement mandatory, and expressly not a reason.
Free weekly check: if you ask us to watch a site, we store the email address you entered, the site address, the language, the time and IP address of the request and, after you click the link in the confirmation mail, the time and IP address of that confirmation. We keep both moments as proof that you asked for the mails. We re-check the site about once a week and write to you only when the grade drops. We never pass the address on and never use it for anything else. One click on the unsubscribe link in every mail ends it.
CRA list: if you join the list on the page /de/cra, we store your email address (company addresses only, no free mail), the product type you picked from a fixed choice, the language, the time and IP address of the request and, after you click the link in the confirmation mail, the time and IP address of that confirmation. We write to you only about news on that page and its signals; every mail carries an unsubscribe link. We do not store the result of a CRA test on that page, and we take no personal data from the pages checked (for example no names from an imprint).
Server logs: our hosting provider processes technically necessary connection data (IP address, time, requested address, browser identifier) to deliver the pages and keep them secure.
Local storage: the site remembers settings (motion on or off, whether the mascot is hidden) in your browser's local storage. This data never leaves your browser. No cookies are set for advertising or analytics. One httpOnly cookie holds your report unlock after a purchase.
4. Legal bases
Running the scan, showing the report, providing your account and processing purchases serve the performance of your request or contract (Art. 6(1)(b) GDPR). The free weekly check, the CRA list and their mails rest on your consent (Art. 6(1)(a) GDPR), which you give in the double opt-in and can withdraw at any time with the link in every mail. Storing the IP address against abuse, the server logs and the audience measurement below rest on our legitimate interest in a secure and improving service (Art. 6(1)(f) GDPR). A cancellation is processed to perform the contract (Art. 6(1)(b) GDPR) and to meet our duties under § 312k(4) and § 356a(3) of the German Civil Code (Art. 6(1)(c) GDPR). The public report page of a checked address rests on our legitimate interest in showing a check result in a form that can be followed and verified (Art. 6(1)(f) GDPR). Whoever runs a checked website can ask for its removal by email at any time; every public report page says so, and the grade expires after 30 days anyway. We do not read content out of an open database on a checked website. We ask how many rows a table releases to an anonymous request and read the column names from the published schema, so no personal data of third parties is fetched, stored or shown. Should a check nevertheless touch personal data of third parties, that rests on our legitimate interest in finding and closing open security holes (Art. 6(1)(f) GDPR, recital 49); we cannot notify the people concerned because we cannot identify them (Art. 14(5)(b) GDPR), and this paragraph is the public information provided instead.
5. Retention
Scan results and the associated IP address are deleted after 90 days; scans in a signed-in account stay until you delete them or the account, which you can do at any time in the signed-in area (single scans or the whole account). A scan that is still the current result of an active monitor or weekly check, or of an unexpired public grade or report unlock, is deleted once that ends; its IP address is removed at 90 days regardless. Public grades expire after 30 days. Report unlocks expire after 7 days and the record is kept for 3 years for accounting. Unconfirmed CRA list entries are deleted after 14 days. Watch entries, confirmed CRA list entries and the two consent records are deleted when you unsubscribe, at the latest 3 years after the last mail, since they are our proof of consent. Cancellations, withdrawals and the matching confirmations are kept for 6 years: a cancellation is a received commercial letter under § 257 HGB and it is our record of when a contract ended. Server logs are deleted by the hosting provider under its own schedule.
6. Recipients and processors
Hosting: Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA, on the basis of standard contractual clauses; Vercel is certified under the EU-US Data Privacy Framework.
Audience measurement (Vercel Web Analytics): we count page views and single events (for example "scan started") without cookies and without cross-device identifiers. Vercel derives a daily changing hash from IP address and browser data that cannot be traced back to you; the IP address is not stored. No information is stored on or read from your device, so no consent is required.
Step counters: we also count, on our own servers, how often each step happens: a page opened, a scan started, a paywall shown, a checkout opened. What is stored is one number per day and step. No IP address, no identifier, no cookie and nothing about the individual visit is written down, so these counts cannot be traced to anyone. If the visit came through one of our own tagged links (the utm_source parameter in the address, for example from our TikTok profile), the same step is also counted under that channel. The channel is read from the address you opened and held only in the page's memory; nothing is stored on or read from your device for it.
Database and authentication: Supabase Inc., data centre in Frankfurt am Main (EU). Data processing agreement in place.
Email delivery: Resend Inc. (sign-in links, receipts for report unlocks, grade-drop alerts), EU region. Data processing agreement in place.
Payments: Paddle.com Market Ltd, as described above.
Text generation for reports: Anthropic, PBC, San Francisco, USA. When a report is shown in German, or a fix prompt for an AI builder is requested, the finding texts Deckproof wrote for that scan (titles, explanations, fixes) are sent to Anthropic's API to translate them or to combine them into one prompt. These texts can name the checked site and details found on it (for example a table or file name); they never contain your name, your email address or payment data. Transfers to the USA rest on the standard contractual clauses in Anthropic's data processing addendum; Anthropic does not use this content to train its models. Translations are stored without any link to a scan and deleted after 90 days without use; a fix prompt is deleted together with its scan.
Fonts: served from our own server. No connection to Google Fonts.
6a. Our profiles on other platforms
We run profiles on the following platforms: GitHub, LinkedIn, X, Instagram, YouTube. When you open one of them, that platform processes your data under its own responsibility and its own privacy notice. We have no influence over that.
- GitHub: GitHub B.V., Prins Bernhardplein 200, 1097 JB Amsterdam, the Netherlands. Privacy notice
- LinkedIn: LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. Privacy notice
- X: X Internet Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland. Privacy notice
- Instagram: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Privacy notice
- YouTube: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Privacy notice
For the visitor statistics (“Page Insights”) that LinkedIn provides to us, we are a joint controller with LinkedIn under Art. 26 GDPR. All we see there are aggregate numbers, such as how many people opened the profile and roughly which industries or regions they come from; we cannot identify individuals from it. The legal basis is our legitimate interest in presenting ourselves effectively (Art. 6(1)(f) GDPR). The essence of the arrangement is set out in the Page Insights Joint Controller Addendum.
For the visitor statistics (“Insights”) that Instagram provides to us, we are a joint controller with Instagram under Art. 26 GDPR. All we see there are aggregate numbers, such as how many people opened the profile and roughly which industries or regions they come from; we cannot identify individuals from it. The legal basis is our legitimate interest in presenting ourselves effectively (Art. 6(1)(f) GDPR).
For the visitor statistics (“YouTube Analytics”) that YouTube provides to us, we are a joint controller with YouTube under Art. 26 GDPR. All we see there are aggregate numbers, such as how many people opened the profile and roughly which industries or regions they come from; we cannot identify individuals from it. The legal basis is our legitimate interest in presenting ourselves effectively (Art. 6(1)(f) GDPR).
GitHub gives us aggregate traffic figures for our public repositories (views, unique visitors, referrers). On X we see the view count of our own posts. Neither tells us anything about individual people, and neither gives us a breakdown of who visits the profile.
You can exercise your rights under the GDPR against us and against the platform concerned. For anything that happens inside a platform, that platform is the faster address, because that is where the data sits.
7. Your rights
You have the right of access, rectification, erasure, restriction, data portability and objection (Art. 15 to 21 GDPR), and the right to lodge a complaint with a supervisory authority. If your website was scanned and you want the report deleted, write to hallo@deckproof.dev; we delete the report and, on request, exclude the address from future public listings.
8. Not legal advice
Statements in reports on legal topics are general information with sources, not an assessment of your individual case.
Last updated: 12.10.2026