Privacy notice

This notice covers vibe-scan.net and the VibeScan scanning service, operated by Britannic AI Ltd (company number 16879653), registered office 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ, the data controller for the personal data described below. See the scanner identification page if you are here because you saw VibeScan traffic in your own logs, or the terms of use for the rules on using the service.

What we process today

vibe-scan.net is hosted on Fly.io in the United States. Fly.io logs standard web-request metadata (IP address, timestamp, user agent) for every request to this site, as any hosting provider does, and is the processor of that data under the Fly.io privacy policy. We also use Cloudflare for two things, both under the same Cloudflare privacy policy: the scan submission form and the email-capture form both use Cloudflare Turnstile to tell real visitors apart from bots. Cloudflare processes your IP address and the challenge outcome as part of that check, and Cloudflare Web Analytics is enabled for this site, meaning Cloudflare is configured to inject a script on our pages that counts visits and measures page performance. It's designed by Cloudflare not to use cookies or other client-side storage and not to track you across sites. If you unlock a report or sign up for updates, we use Resend to send you the confirmation and report emails; Resend processes your email address and the message content for that purpose, under the Resend privacy/GDPR page. Because our hosting is US-based, your data may be transferred and processed outside the UK/EEA. Each of the processors named on this page states that it relies on its own transfer safeguards (Data Privacy Framework certification or Standard Contractual Clauses, depending on the processor). See their policies linked above; we have not yet independently confirmed each certification's current status with the relevant registries.

When you submit a URL to be scanned, and if you request the full report, we process the categories of data listed below.

Running your scan: The URL you submit, the security findings we detect, and standard web-request metadata (IP address, timestamp, user agent) for the request that submitted it.; Legal basis: Legitimate interest: you actively initiate this and it's the core service you asked for.; Retention: Kept until you ask us to delete it. There is no automatic deletion job today. Email [email protected] to request deletion.
Unlocking and emailing you the full report: If you request the full report, we store your full name, email address, and the IP address and timestamp of the request. We send a confirmation link to that address, which expires after 7 days. Once we have carried out the necessary verifications, we email the report to that address. If verification involves checking your site, we keep a record of the verification token and the method used.; Legal basis: Legitimate interest: delivering content you're actively requesting.; Retention: Kept until you ask us to delete it. There is no automatic deletion job today. Email [email protected] to request deletion.
Optional product updates: An optional checkbox lets you also consent to occasional security tips and product updates. If you tick it, we record that consent, including the exact wording you were shown and when.; Legal basis: Consent: genuinely opt-in, separate from report delivery. You can withdraw it at any time by unsubscribing; see "Your rights" below.; Retention: If you unsubscribe, we stop sending to you but keep a record that you withdrew (with a timestamp) as evidence we honored it, and that record is not deleted automatically. Email [email protected] to request deletion.
Per-domain scan throttling: A per-target-domain counter (3 scans/hour, 10/day) to stop any one site being scanned too often.; Legal basis: Legitimate interest: protecting the service from abuse.; Retention: The hourly and daily counters share the same storage as the email-capture rate limiting below, and have no automatic expiry today -- a known gap, not an oversight. They record only a domain and a request count per time window, never scan content or findings.
Email-capture abuse prevention: To stop the email-capture form on scan results pages being used to flood a mailbox or spam this endpoint, we count attempts by IP address (stored as-is, not hashed) and by a hashed version of the email address you enter, each on an hourly and daily basis.; Legal basis: Legitimate interest: protecting the service from abuse.; Retention: These counters have no automatic expiry today. We're aware of this and it's tracked as a real gap, not an oversight.
Aggregate service statistics: For every completed scan, we keep a record of the target's domain, kept indefinitely for aggregate reporting (for example, how many sites we've scanned). The record has fields reserved for finding types, severities, detected tech stack, and unlock/consent status, but our code does not populate them yet -- those fields are empty on every row today. This record does not include the target site's content, the visitor's IP address, or any email address.; Legal basis: Legitimate interest: understanding and improving what the service detects.; Retention: Kept indefinitely -- there is no automatic deletion job for this data today.

Cookies

When you submit a scan, we set one cookie (vs_owner_…) for up to 30 days. It proves you submitted that scan, so if the link is shared, only you see the results page. It does not track you across other sites and we don't use it for advertising.

If the report form shows an error, we briefly keep the name and email you typed in a cookie (vs_capture_draft_…) for up to 5 minutes so you don't have to retype them.

Your rights

Under UK GDPR, you have the right to: access the data we hold about you; have it corrected if it's wrong; have it deleted; restrict or object to certain processing; and receive a copy in a portable format. Where we rely on your consent (the marketing updates checkbox above), you can withdraw that consent at any time by unsubscribing. This doesn't affect the lawfulness of anything already sent before you withdrew it.

To exercise any of these rights, email [email protected]. We aim to respond within 30 days. Today this is handled manually, no automated self-service flow exists yet.

If you're not satisfied with how we've handled your data or your request, you have the right to lodge a complaint with the UK's supervisory authority, the Information Commissioner's Office, at ico.org.uk/make-a-complaint.

Last updated: 2026-09-26