Privacy policy
Last updated: 2026-10-11
Version dated 2026-10-11
1. Controller
Raman Navarych, ul. Jerzego Holzera 6 lok. 112, 02-972 Warszawa, Poland
Email for data protection requests: privacy@normaro.eu
We have not appointed a data protection officer because Article 37 GDPR does not require one.
2. Overview
We process personal data only as far as necessary for the website, your account, your orders and the security of the service. We do not sell data, we do not show advertising, and we do not use any analytics or tracking services.
3. Visiting the website and hosting
Each time you open a page, our server processes technically necessary data: IP address, date and time, the requested address, referrer, browser and operating system. We store this data in server logs to detect attacks and fix errors.
- Legal basis: Article 6(1)(f) GDPR (legitimate interests in secure operation).
- Retention period: no longer than 30 days, after which the data is deleted.
- Hosting: Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2. We have a data processing agreement with the hosting provider (Article 28 GDPR). Server location: europe-west1 (Saint-Ghislain, BE). As part of a US group, Google may access data; the EU-US Data Privacy Framework and standard contractual clauses apply to this.
- Database: Neon (Databricks, Inc. / Neon, LLC, USA), data centre in aws-eu-central-1 (Frankfurt am Main, DE). Neon is our processor (Article 28 GDPR). As the provider is based in the USA, any access from there is based on the EU-US Data Privacy Framework and, in addition, standard contractual clauses (Article 46(2)(c) GDPR).
For all transfers to the USA: if the EU-US Data Privacy Framework ceases to apply, the standard contractual clauses remain the basis.
Fonts are stored on our own server. Loading a page does not transfer any data to Google or other font providers.
4. Customer account
For an account we process your email address, the language you chose, optional details (name, company, VAT ID) and the times of sign-up and sign-in.
Sign-in with email and password or with Google is handled by Firebase Authentication, a Google service (processor). Firebase stores your password only as a cryptographic hash; we never see it. Firebase also sends the emails that confirm your address and reset your password. Processing may take place in the USA, based on the EU-US Data Privacy Framework and standard contractual clauses.
- Legal basis: Article 6(1)(b) GDPR (contract for the use of the account).
- Retention period: until the account is deleted. You can delete your account at any time in the account settings.
5. Sign in with Google
If you choose “Sign in with Google”, we receive your name, your email address and a Google identifier from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google processes data in this context as an independent controller under its own privacy policy.
- Legal basis: Article 6(1)(b) GDPR.
6. Check orders
For a check, we process the address of the website, the selected pages and the results. To do this, our system opens the publicly accessible pages, just as a visitor would. If these pages contain personal data of third parties (for example, names in a legal notice), we process that data only for the duration of the check and do not store it separately.
For retrieving and evaluating publicly accessible pages, we are an independent controller, even if you order the check for a client. We do not inform individually the persons whose data appears on checked pages, because for publicly available data that is processed only briefly this would involve a disproportionate effort (Article 14(5)(b) GDPR); this privacy policy is public. The legal basis for this is Article 6(1)(f) GDPR (legitimate interest in performing the check you ordered).
An AI model from Anthropic writes the summary of each report (contracting entity for the EEA: Anthropic Ireland, Limited, Dublin, Ireland; processing is carried out by Anthropic, PBC, San Francisco, USA). For this purpose, we transfer the measurement results and text excerpts from the checked pages, but not your account data. Under its commercial terms, Anthropic stores this data only for a limited time for abuse monitoring and does not use it to train its models. Anthropic is our processor; processing may take place in the USA. The transfer is based on the EU-US Data Privacy Framework, supplemented by standard contractual clauses (Article 46(2)(c) GDPR).
- Legal basis: Article 6(1)(b) GDPR.
- Retention period: reports remain in your account until you delete them or the account.
7. Payment via Paddle
Paddle.com Market Limited, Judd House, 18–29 Mora Street, London EC1V 8BT, United Kingdom, processes orders and payments as our reseller. Paddle processes payment and billing data as an independent controller. We receive from Paddle the name, email address, country, amount, status and identifier of the transaction, but no full card details. The European Commission has adopted an adequacy decision for the United Kingdom.
Paddle's scripts load only when you start the checkout.
Legal basis: Article 6(1)(b) GDPR; retention under Article 6(1)(c) GDPR.
Retention period: order data for 5 years from the end of the calendar year in which the deadline for paying the relevant tax expired (Article 86 § 1 in conjunction with Article 70 § 1 of the Polish Tax Ordinance, Ordynacja podatkowa).
We keep records of orders, payments, refunds and withdrawals for the same period.
8. Emails and messages
We send emails that are part of the service: registration confirmation, password reset, order confirmation, confirmation of a withdrawal and notice that a report is ready. We do not send newsletters. Email delivery service: Brevo (Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris), Google (Firebase Authentication) (processor); the servers are in the EU. Open and click tracking is switched off.
- Legal basis: Article 6(1)(b) GDPR.
If you write to us through the contact form, by email or in your account (question, complaint, withdrawal), we store your email address, your name if you give it, the message and, if you are signed in, the link to your account. To stop the form from being misused in bulk, we also store a hash of your IP address (pseudonymised) and delete it after 30 days.
- Legal basis: Article 6(1)(b) GDPR if the message concerns a contract; otherwise Article 6(1)(f) GDPR (legitimate interest in answering messages and protecting the form from misuse).
- Storage period: until the matter is settled, then up to 3 years where we need it to defend against claims (Article 118 of the Polish Civil Code, Kodeks cywilny).
9. Cookies
We only set cookies that are necessary for operation: your chosen language, your cookie choices and your login. These do not require consent (Article 5(3) of Directive 2002/58/EC, implemented in Poland by Article 399 of the Electronic Communications Act, Prawo komunikacji elektronicznej).
You can find the list with retention periods in the cookie settings in the footer of every page.
10. Your rights
You have the right of access (Article 15), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and the right to object to processing based on legitimate interests (Article 21 GDPR). Write to privacy@normaro.eu. We reply within one month (Article 12(3) GDPR); to verify your identity, we may ask you to write from the email address of your account.
Right to object: Where we process data on the basis of legitimate interests (Article 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.
You can lodge a complaint with a data protection supervisory authority, in particular in your country of residence or with the authority responsible for us: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, Poland.
11. Obligation to provide data, automated decision-making
The data for the account and the order is necessary for the contract. Without it, we cannot carry out a check. We do not use automated decision-making within the meaning of Article 22 GDPR.
12. Security
All connections are encrypted with TLS. Passwords are managed by Firebase Authentication; we neither see nor store them. Of your session we store only a hash.
Backups: the database can be restored to any point within the last up to 7 days; deleted report files remain recoverable for 7 days and are then removed for good. Deleted data therefore disappears from backups within 7 days at the latest.
13. Users in the United States
We do not sell personal information, do not share it for targeted advertising (“sell” or “share” within the meaning of the California Consumer Privacy Act) and do not profile you in a way that produces legal or similarly significant effects. In our assessment, we are currently not subject to the thresholds of US state privacy laws (for example the CCPA/CPRA in California). Regardless of this, we grant residents of the United States the rights under section 10: access, correction, deletion and data portability. You will not be discriminated against for exercising these rights. An authorised agent may submit requests on your behalf if they prove their authority. Send requests to privacy@normaro.eu.
14. Minors
The Service is intended for persons aged 18 or over. We do not knowingly collect data from minors; if we learn of it, we delete it.
15. Changes to this privacy policy
We update this privacy policy when the Service or the legal situation changes. The current version with its date is on this page; we inform account holders of material changes by email.