Privacy Policy

This policy explains what personal data this website processes, why, for how long, and what your rights are. It covers scanbastion.com only. The ScanBastion service itself is not yet available; a separate policy will cover it before launch.

1. Who is responsible

ScanBastion is operated by C. Kerger, 2476 Winifred Way, San Francisco, CA 94102, United States.

For anything related to your personal data, write to info@scanbastion.com.

2. The short version

• This site sets no cookies. We count visits with Ahrefs Web Analytics, which uses no cookies or local storage either.
• The only data you can give us here is an email address, if you join the early-access list.
• Our web server keeps standard access logs, including IP addresses, for security and troubleshooting.
• The Ahrefs analytics script is the only thing our pages load from a third party: fonts, styles and our own scripts are all served by us.

3. Early-access sign-up

What we collect. When you join the early-access list we store the email address you enter, the time you signed up, the exact wording of the consent you gave, a random token used in the confirmation and unsubscribe links, and the time of each later event on that address (confirmation email sent, address confirmed, unsubscribed).

Why. To email you about ScanBastion early access, and to be able to prove that you asked us to (double opt-in). We do not use the list for anything else and we do not share it.

Legal basis. Your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time by using the unsubscribe link in any email, or by writing to us. Withdrawing consent does not affect the lawfulness of what happened before.

Where it is stored. On the server that runs this website, in a file readable only by the application. Confirmation emails are delivered through our email delivery provider, which necessarily sees the recipient address and the message.

How long. Addresses stay on the list until you unsubscribe or until the early-access list is retired after launch. When you unsubscribe, the address is marked so that it is never emailed again; the record itself is kept as evidence of the consent history. If you would rather have the record deleted entirely, ask us and we will do so unless we are legally required to keep it.

Anti-abuse. To limit automated sign-ups, the application counts sign-up attempts per IP address in memory for up to one hour, and the form contains a hidden field that only automated submissions fill in. Neither is stored beyond that.

4. Server logs

Like almost every website, our web server records each request: the IP address it came from, the time, the address requested, the response code, and the browser's user-agent string and referrer if sent. We use these logs to keep the site running, to detect abuse and to diagnose errors. The legal basis is our legitimate interest in operating a secure website (Art. 6(1)(f) GDPR). Logs are rotated and deleted automatically after 30 days and are not used to profile visitors.

5. Web analytics

To see how many people visit, which pages they read and where they came from, our pages load a script from Ahrefs Web Analytics, provided by Ahrefs Pte. Ltd. in Singapore. When a page opens, and when you follow a link or submit a form, your browser sends Ahrefs the page address, the page title, the referring page, and your screen size and pixel density. Like any web request it also reveals your IP address and browser user-agent to Ahrefs. On confirmation and unsubscribe pages the script reports only /confirm or /unsubscribe, never the link's token. The script sets no cookies and uses no local storage, and we use the figures only in aggregate. The legal basis is our legitimate interest in understanding how the site is used (Art. 6(1)(f) GDPR). Ahrefs is based outside the European Economic Area, so this data may be processed there.

6. What we do not do

We do not set cookies or use local storage for tracking. Apart from the analytics script described above, we do not embed advertising, social-media widgets, web fonts or any other third-party resource; everything else a page needs is served from our own domain. We do not sell or rent personal data. We do not transfer the early-access list outside the service providers named above.

7. Your rights

Under the GDPR and comparable laws you have the right to ask for access to the personal data we hold about you, to have it corrected or deleted, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent you have given. You also have the right to complain to a data-protection supervisory authority, in particular in the country where you live or work. To exercise any of these rights, write to info@scanbastion.com. We may need to confirm that a request really comes from the address concerned, for example by replying to it.

8. Children

This website is intended for professionals and is not directed at children. We do not knowingly collect data from anyone under 16.

9. Changes

We will revise this policy when the service launches and whenever our processing changes. The date at the top of the page shows the current revision.