Privacy
What we hold, why, and how to get rid of it. There is not much of it, and none of it is sold.
The short version
You can scan a site without telling us who you are. No cookies are set on this site, nothing follows you, and there is no account to make. If you ask for a report by email, we use your address to send it and for nothing else.
What we hold when you run a scan
- The domain you typed. The report we produce is kept for six hours so that scanning the same site again is instant, then it is deleted. Anyone who scans that domain in that window sees the same report, so do not scan anything you would not want a stranger to see.
- Your IP address, but never in readable form. It is turned into a one-way code the moment it arrives and only that code is stored, so that the daily scan limits can be applied. The code cannot be turned back into your address. It is deleted the next day.
- A line in our server log recording that a page was served, which is how any web server works and how we notice something breaking. Logs rotate and are overwritten.
Our lawful basis for all of that is legitimate interests: running the service and stopping it being abused.
What we hold if you ask for the report by email
Your email address, used to send you that report. It is not added to anything unless you tick the newsletter box, which is a separate choice you can untick, and which you can leave at any time with the link in every newsletter. Consent is our lawful basis for the newsletter; performing what you asked for is the basis for the report itself.
We do not sell or share your address, and we do not pass it to anyone outside the company.
The sites we visit
When you scan a site, our scanner fetches its public pages the way any visitor would, and that site's own logs will record the visit. We identify ourselves honestly so its owner can see who called - more about our scanner bot. Only scan sites you own or have permission to check.
Your rights, and how to use them
You can ask what we hold about you, ask for it to be corrected or deleted, ask us to stop using it, and ask for a copy. Email privacy@lightmorphic.com and we will reply within five working days. There is nothing to pay.
If you are not happy with how we handle it you can complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk. We would rather you told us first so we can put it right.
Who holds it
Lightmorphic Ltd, 82A James Carter Road, Mildenhall, IP28 7DE, United Kingdom, registered in England and Wales, company number 17423646. The service runs on our own server in the United Kingdom. Nothing is sent outside it.