Privacy notice

What we collect when you use Shipwardly, why we collect it, how long we keep it, and the rights you have over it.

Who we are

The controller of your personal data is Shipwardly, run by a self-employed sole trader in the United Kingdom. This notice covers the Shipwardly website, the scanner and its reports, accounts and the emails we send. You can reach us about anything in it at [email protected].

What we collect

Addresses you scan. The web address you submit and the time of the scan.
Scan results. What our scanner found, including the grade and findings. If we find a leaked secret we store only its first 4 and last 4 characters and a one-way hash, never the full value.
A hashed IP address. We do not store your IP address. We store a keyed hash of it, used to limit how often the scanner and the report emails can be used.
Your email address, if you give it. Only when you ask for your full report by email. The next section explains exactly what we keep.
Account details, if you sign up. Your name, email address and security settings, and, if you add them, your company details for invoices.
Team invitations and share links, if you use them. The address an invitation or a shared report was sent to, and the records explained under team access below.
Audit orders, if you book one. What you bought, when, the amount and the answers you give us about your app. The section on audit orders explains how payment works.
Emails you send us, and our replies, kept in our mailbox so we can answer you.
Whether our emails reach you. Brevo tells us when an email to your address was delivered, bounced, was refused or blocked, or was marked as spam. If an address cannot receive our emails, we keep a keyed fingerprint of it (a one-way HMAC, never the address itself), so we stop sending to it and can explain why an account was removed. If an account's address was never confirmed and our emails to it cannot be delivered, we delete the account straight away, as if you had deleted it in Settings. An account with a confirmed address is never deleted automatically: we stop emailing it and ask you in the app to update your address. A spam complaint stops updates from us, but we still send the reports you ask for.
Technical records. While you are signed in, our session store keeps your IP address and browser name with your session. Our server logs record errors with ids and reasons, never your email address or IP address.

When you scan a site, our bot visits that site from our own server. The site sees our server and our bot's name, never your IP address or who asked for the scan.

Your report by email

When you enter your email address on a report to unlock it, we keep:

your email address, encrypted, and a keyed hash of it so that one address is only ever stored once
when you asked, and which version of this notice applied at the time
a keyed hash of your IP address, to stop the form being used to send emails to other people in bulk
which report you first asked about
your separate choice about updates: whether you ticked the box, when you confirmed it by clicking the link we emailed you, and when you unsubscribed

We use your address to unlock the report and send you one copy. That is the service you asked for, so there is no box to tick for it. We never add you to a mailing list because you asked for a report.

Updates from Shipwardly are a separate choice. The box is unticked unless you tick it, and even then we send nothing until you click the confirmation link we email you. Every update has a link to unsubscribe in one click.

Unlocking a report unlocks it for anyone who has its link, not only you, so share the link with care. The form uses a Cloudflare Turnstile check to keep automated scripts out.

Weekly monitoring

Weekly monitoring is off until you turn it on for a site. For a site you have verified, we check your ownership proof and run a verified scan once a week. For a site you have not verified, a Monitor plan runs a passive scan once a week, which reads only what any visitor's browser receives. Either way we keep each scan in your account like any other report, and email the address on your account only when a finding is new or fixed, when monitoring pauses because we could not find your proof, or once if we could not reach the site for several weeks in a row. Every monitoring email has a link that pauses it in one click, and you can turn it off in your account at any time.

Your authorisation declaration

Before a Monitor plan scans a site you have not verified, you confirm that you own it or are authorised to test it. We keep a record of that declaration for as long as the site is in your account: the site, when you confirmed it and a keyed hash of your IP address at the time (never the address itself). If you withdraw it, we stop scanning that site and delete the record.

Reports we emailed you earlier

If you asked for reports by email before you had an account, and your account's email address is confirmed, we show them to you in your account and add them to it only when you choose to. Reports you add are then kept for as long as you have the account, like the rest of your reports.

Team access and invitations

An account holder can invite other people to work in their account as a Manager or a Viewer. To send an invitation we keep the address it was sent to (encrypted), a keyed hash of it so we can match it when the person signs in, the role, who sent it and when, and a one-way hash of the link, never the link itself. An invitation works for 7 days, can be withdrawn at any time, and is kept with the account's records until the account is closed.

Everyone in an account can see its sites, surveys, reports and findings, and gets its notifications in the portal. The account holder can see the name and email address of each person in the account; other people in it see names and roles only. When someone leaves or is removed, their access ends at once; what they did in the account, such as marking a finding fixed or asking for a fix quote, stays in the account's records.

The account holder or a Manager can make a link that shows one report to anyone who has it, without signing in, including the full findings and a PDF copy. We keep a one-way hash of the link, who made it, when it expires, whether it has been withdrawn, how many times it was opened and when it was last opened. We do not record who opened it. If you email a link from Shipwardly, we keep the address you sent it to (encrypted) with the link, only to show you where it went. Links are deleted with their report or the account, and can be withdrawn at any time, after which they stop working.

Audit orders and payments

Payments for the audit and for accepted fix quotes are processed by Stripe, which acts as our payment processor and issues your receipt and VAT invoice. You enter your card or bank details on Stripe's own page, so we never see or store them. Stripe tells us whether the payment went through, the amount and the VAT, and keeps the billing details it collects for the invoice.

Monitor plan subscriptions are processed by Stripe in the same way: Stripe takes the monthly payment, issues each invoice and runs the billing page where you change your card, switch plan or cancel. We keep which plan you are on, its status and when it renews or ends, so we know which sites to monitor. We never see your card details.

We keep audit orders as business records, because tax and accounting rules require it, even if you delete your account. Deleting your account removes the account and the personal details in it; the order stays, no longer linked to you, with what we must keep about the sale, and your answers to the audit form are deleted (see Deleting your account).

The answers you give on the audit form are stored encrypted. The form refuses passwords and keys, and we never ask for them.

Why we use it and our lawful bases

To provide the service you asked for (contract). Running your scans and showing your reports, emailing you the report you asked for, your account, team, monitoring, audits, fix work and plans.
To keep Shipwardly safe and fair (legitimate interests). Keyed hashes of IP addresses for rate limits, the Turnstile check on our forms, records of what you asked for and when, the authorisation declarations and opt-outs that keep the scanner to sites it may visit, and our notes about enquiries and customers. We have weighed these against your interests: they use as little as we can, and never your IP address itself.
To meet the law (legal obligation). Keeping orders, payments and VAT records for as long as tax and accounting rules require.
Updates from Shipwardly (consent). Only when you ticked the box and confirmed by email. You can withdraw your consent at any time.

We do not make decisions about you by automated means that have legal or similarly significant effects. A grade on a report describes a website, not a person. Shipwardly is meant for people who build and run websites, not for children.

How long we keep it

Anonymous scans and their results: deleted after 30 days, including reports you asked for by email. The link in the email stops working then.
Your email address and your choices: kept until you ask us to delete them. If you unsubscribe, we keep a note that you did, so we never send you updates again by mistake.
Hashed IP addresses: in our rate limits for an hour, with a scan for as long as the scan is kept, and the most recent one with your email address for as long as we keep it.
Reports saved to your account: kept until you delete them or close your account.
Invitations, team memberships and share links: kept with the account until it is closed; a share link also goes when its report is deleted.
Audit orders: kept as business records for as long as tax and accounting rules require, even after you close your account.
Marketing consent records: kept for as long as you are subscribed, and for a short period afterwards to show we had your consent.
Our log of the emails we send (the address, encrypted, the subject and when, never the content): 90 days.
The fingerprint of an undeliverable address: kept while the address stays undeliverable, and removed when you change the address or our emails reach it again.
Sessions: until they expire, 120 minutes after your last visit, or until you sign out. Password reset links stop working after an hour and are deleted daily.
Server logs: 14 days. Records of background tasks that failed: 30 days.
Backups of our database: kept in rotation for at most 30 days. A backup is only ever used to restore the service, and anything deleted is gone for good once the backups holding it have rotated out.

We do not sell your data or share it for advertising. We use these service providers to run Shipwardly. Each acts on our instructions as a processor, under a contract that limits what it may do with your data.

Brevo sends our emails: reports, account emails, monitoring emails and the updates you asked for. It receives the address and the content of each email, and tells us whether each one was delivered, bounced, was blocked or was marked as spam. Brevo also records when an email is opened and which links in it are clicked (through a small image in the email and links that pass through Brevo before reaching our site). We use this to see whether our emails arrive and are useful, never to build a profile of you. Many email apps let you block images, which stops the open record.
Cloudflare runs our DNS and sits in front of our website to protect it and deliver it quickly, so every request to Shipwardly, including your IP address, passes through it. It also runs the Turnstile check on our forms, which tells people from automated scripts.
Stripe processes payments for audits, fix work and Monitor plans. Online payment is switched off at the moment, so until it is on we send nothing to Stripe.
Our hosting provider runs the server that holds our database. The server is managed through Ploi, a server management service that can reach it to deploy and maintain the site.
Our backup storage provider keeps copies of our database.

Some services we use receive no personal data. To look up known vulnerabilities in the open source libraries a scanned site uses, we send OSV.dev only the names and versions of those libraries, never who asked for the scan or anything else about you. We download the Retire.js list of vulnerable libraries once a week, sending nothing about you. To check a scanned domain's DNSSEC we ask Cloudflare's public DNS resolver about the domain name only.

We may also share data when the law requires it, to protect people or our service from fraud or abuse, or with professional advisers such as our accountant or solicitor, who must keep it confidential.

Data sent outside the UK

Some of these providers handle data outside the UK, for example Brevo in the European Union and Cloudflare and Stripe in the United States and elsewhere. When personal data leaves the UK, we rely on UK adequacy regulations (which cover the European Economic Area, and companies in the United States that have joined the UK Extension to the EU-US Data Privacy Framework), or on safeguards in the provider's contract, such as the ICO's International Data Transfer Agreement or Addendum. Email us if you would like more detail.

Cookies

We use only the cookies the site needs to work, such as the one that keeps you signed in. Our cookie notice lists each one.

Your rights

Under UK GDPR you have the right to:

ask for a copy of the personal data we hold about you
ask us to correct it or delete it
ask us to restrict or stop using it, or object to how we use it
receive it in a portable format
withdraw your consent to marketing at any time, with the unsubscribe link in any update or by emailing us

We answer within one month, and tell you if we need longer for a complex request. There is no charge.

A copy of your data

If you have an account, Settings has a "Download my data" button that gives you a file (JSON) with what we hold about you: your account and company details, your sites and survey history, orders, payments, team memberships, share links you made, notifications, the emails we have sent you and your consent records. It does not include the findings of your surveys, which describe your website rather than you and stay in each report. Without an account, or for anything the file does not cover, email us and we will send you the same file after checking the request comes from you.

Deleting your account

You can delete your account in Settings at any time. We then delete the account, your sites with their verifications and monitoring, your surveys and their findings and share links, your team (members, invitations and your memberships of other accounts), your company details, notifications, email choices, passkeys and sessions. If an audit order refers to one of your surveys, that survey is kept without your name and deleted 30 days later, like an anonymous report, so the audit can still be finished. Audit orders, fix quotes and payments stay as business records, no longer linked to you and without your answers to the audit form or your quote messages. If you have a monitor plan, cancel it in Billing first. The address we email reports to is kept separately until you ask us to erase it.

Asking us to erase your data

Email us to ask for your personal data to be erased. After checking the request comes from you, we delete your account as above, the address we email reports to with its consent record, invitations sent to it, our log of emails sent to it and our internal notes about you. We keep only what tax and accounting rules require: the amounts, VAT and dates of your orders and payments, without your name or address, plus a note that we carried out the erasure. Stripe keeps its own records of your payments as our payment processor.

Contact and complaints

To use any of these rights, or with any question about this notice, email [email protected]. If you are unhappy with our answer, you have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk. We would be grateful for the chance to put things right first.

Changes to this notice

We will update this notice when what we do changes, and show the date of the latest version here. We record which version applied when you gave us your email address for a report.

Last updated: 31 October 2026.