Legal
Privacy policy
What personal data Trustpect collects, why, how long we keep it and the rights you have over it. We collect as little as the service needs.
Last updated: 15 October 2026
01
Who we are
Trustpect provides website security checks, findings with evidence and retests of fixes. This policy covers trustpect.com, the free site check and the Trustpect application. Trustpect is the controller for account, contact and service-security data. For personal data processed in scans on your behalf, we act on your instructions as a processor.
The service is intended for adults, not children. Do not submit children's personal data. If you believe a child has provided personal data, contact us so we can assess and delete data that should not be held.
This policy takes effect on the day this site is published; the date shown at the top is updated at that time.
02
What we collect
- Account data: your name, email address, organisation, role and sign-in records.
- Targets, proofs and permissions: domain names and exact origins you register; ownership verification method, challenge hashes, verification attempts and proof dates; permission scope, expiry and who gave or revoked it.
- Scan data: request and response metadata, short evidence excerpts with secrets masked, findings and their history, technology fingerprints, coverage and budget records.
- Signed-in scans: usernames, passwords, session cookies or tokens you supply, stored in an encrypted vault. Plaintext is used only in memory for authorised sign-in tests and scans. You can delete the stored credentials at any time by revoking the profile.
- Free check: the domain you enter, the result and a one-way hash of your connection's IP address for daily limits. The hash is not treated as anonymous data.
- Messages to us: your name if supplied, your email address, the topic, message and language.
- Service records: request times, safe error records and audit events needed to operate and secure the service.
We do not retain or export raw page captures, network archives or browser storage state. Do not put passwords or other secrets in contact messages. This website does not collect payment card numbers.
03
How we use it
- To manage your account, verify targets and record permissions.
- To run the checks, authorised scans and retests you request, and provide findings and reports.
- To detect changes or relevant vulnerability advisories and select checks within your existing permissions.
- To answer messages, prevent abuse, enforce limits and maintain service security.
- To meet applicable legal obligations.
Credentials never enter logs, reports or AI inputs. We use personal data for the purposes described here, not for advertising.
04
Legal bases
Where Turkey's Personal Data Protection Law (KVKK) or the EU General Data Protection Regulation (GDPR) applies, we rely on the legal basis appropriate to each purpose.
- Contract performance: account management and the checks, scans and reports you request.
- Legitimate interests: service security, abuse prevention and daily limits, where these interests do not override your fundamental rights and freedoms.
- Legal obligations: records and disclosures required by applicable law.
- Explicit consent: where legally required, requested separately for the specific processing. You may withdraw it without affecting processing that was lawful before withdrawal.
Permission to scan a target is separate from consent to process personal data. Accepting this policy does not grant scanning permission or replace any required explicit consent.
06
How long we keep it
- Account data and associated target and permission records: while the account is open, then deleted within 30 days of account deletion.
- Masked evidence and reports: for the retention period shown in your account for your plan, plus 90 days. Account deletion brings this period forward to no later than 30 days after deletion.
- Free check results: cached for 24 hours. IP hashes used for limits: 7 days.
- Scan credentials: until you revoke, replace or let them expire. Revocation deletes the stored credential; replacing it deletes the old value.
- Contact messages and service records: only as long as needed to handle the request or the relevant security purpose.
Where law requires particular records to be kept longer, we limit retention to those records and that legal purpose.
07
How we protect it
Scan credentials are encrypted with a separate key derived for each organisation. Access is restricted to authorised operations, and each organisation's data is isolated from others. Scan traffic stays within the approved target, permission, time window and budget. Evidence is masked, and target content is escaped in reports. No security measure can eliminate every risk. Our security page explains these controls.
08
Your rights
Under applicable law, you may ask whether we process your data, request access and information about its use and recipients, and seek correction or deletion. You may ask for correction or deletion to be communicated to recipients. You may also have rights to restrict processing, obtain a portable copy, object to processing or an adverse decision based solely on automated analysis, withdraw consent and seek compensation for unlawful processing.
Send your request as described under Contact. We may need to verify your identity. Requests are answered within the applicable legal period. You may complain to the competent data protection authority; these rights apply subject to the conditions of the relevant law.
10
International transfers
The country of processing depends on the hosting arrangements used for the service. Before transferring personal data internationally, we must establish a valid transfer basis under the law that applies, including any required adequacy decision or appropriate safeguards. We do not treat your use of the service as consent to international transfers. You can request information about processing locations and applicable safeguards as described under Contact.
11
Changes to this policy
We will update the date at the top when this policy changes. Significant changes will be communicated to account holders before they take effect. If a change requires your explicit consent, we will ask for it separately.
12
Contact
Trustpect currently works with invited users. For questions, rights requests or concerns about a child's data, use the contact you received with your invitation. Include enough information to identify your request, but do not send passwords, tokens or unmasked scan evidence.