What we keep, and why.

Livecheck, established in Portugal, decides why this data is collected and is the controller for it. Write to hello@livecheck.net about anything on this page.

If you create an account: your name, your email address, and your password, which is stored only as a hash and cannot be read back. Each sign-in also records the IP address and browser the session came from, so a session can be recognised and ended.

If you run a scan without an account: a salted, one-way hash of your IP address. It cannot be turned back into an address, it is not linked to a name, and it exists for one purpose: counting free scans so one visitor cannot queue thousands and starve everyone else.

If you ask for the free checklist: your email address, the site you gave us, and which link you arrived from.

If you buy a rescue: your contact email, the site URL, the repository address if you supply one, and whatever you tell us stopped working. Card details never reach us — Stripe collects and holds those, and we keep only the identifiers Stripe gives us to recognise your payment.

About the sites you scan: the results of the checklist, screenshots taken during it, and the page content needed to reach those results. This is what the product is; it is kept against your account so you can read the report later.

To provide what you asked for — running the checklist, showing the report, issuing a certificate, delivering a rescue. This is performance of our agreement with you.

To stop abuse — the hashed IP address, and nothing more than that. This is our legitimate interest in the service staying available, weighed against a hash that identifies nobody.

To keep records we are required to keep — payment and invoicing records, for as long as tax law requires.

To send you the free checklist — because you asked for it. You can withdraw that at any time and it costs you nothing else.

We use other companies to run this service. They process data on our instructions and for no purpose of their own:

• Stripe — payments. They collect card details directly; we never see them.
• Supabase — the database, hosted in Ireland.
• Vercel — serves this website.
• Railway — runs the checklist.
• Google — when a scan runs, the address of the site being scanned is sent to Google’s PageSpeed Insights API to measure loading speed. The URL is a public web address; no account details go with it.

Some of these are in the United States. Transfers there rely on the European Commission’s adequacy decision for the EU–US Data Privacy Framework or on standard contractual clauses. We do not sell anything to anyone, and there is no advertising network on this site.

Account details and scan history stay while your account exists. Delete the account and they go with it.

Hashed IP addresses are kept for the current and previous calendar month, because that is the window the free quota counts over.

Payment records are kept for as long as accounting law requires, which is longer than we would otherwise keep anything and is not ours to shorten.

A published certificate stays public until it expires or is withdrawn. That is the point of it — a badge that vanished on request would not be proof of anything. It carries the domain and the result, not your name.

You can ask for a copy of what we hold, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, ask for it in a portable form, and object to processing based on legitimate interest. Ask at hello@livecheck.net and you will get an answer within one month.

If we get it wrong, you can complain to the Comissão Nacional de Proteção de Dados (CNPD), or to the authority where you live.

One cookie, and it holds your sign-in session. Nothing on this site tracks you, profiles you, or reports your behaviour to anyone else, so there is no banner to click through.