DRAFT — pending legal review. Not yet in force. Last updated 2026-10-14.
Privacy Policy
Controller: the operator of Greenlight Scan (see our Terms for operator details). Contact: hello@greenlightscan.com. We follow the GDPR as implemented in the Norwegian Personal Data Act (personopplysningsloven).
What we process and why
- Account & contact data (email) — to deliver reports and receipts. Legal basis: contract (Art. 6(1)(b)).
- Scan targets and results (URL, findings with redacted evidence, verification tokens) — to provide the service and re-scans. Basis: contract.
- Payment data — handled by Stripe; we receive only payment status and billing country. Basis: contract and legal obligation (bookkeeping, Bokføringsloven: 5 years).
- Technical logs (IP, user agent) — security and abuse prevention. Basis: legitimate interest (Art. 6(1)(f)). Kept 30 days.
Data from scanned sites
We design scans to avoid collecting personal data from your users: database checks return row counts only, secrets are redacted (first/last characters only), and response bodies are not stored. Repository scans run in temporary storage deleted after the scan; we keep only redacted findings.
Automated processing and AI
Reports are generated automatically, including by AI models from third-party providers (via OpenRouter: Google Gemini and DeepSeek). Only redacted findings and relevant code excerpts are sent to these providers, under data-processing agreements. No decisions with legal effect on you are made (Art. 22).
Processors
Vercel (hosting), Supabase (database), Stripe (payments), Resend (email), OpenRouter (AI model routing) and its model providers. Some are located outside the EEA; transfers rely on the EU–US Data Privacy Framework and/or Standard Contractual Clauses.
Retention
Scan reports: 12 months after the last re-scan, then deleted. Account data: until you delete your account. Accounting records: as required by law.
Your rights
You can request access, rectification, erasure, restriction, portability and object to processing by emailing us. You may complain to Datatilsynet (datatilsynet.no).
Cookies
We use only strictly necessary cookies. If we add analytics, we will ask for consent first.