Privacy Policy

PrivBeacon ("we", "us", "our") is the product name for the privacy compliance platform at https://privbeacon.com. The service is owned and operated by Vassbrekke AS, a company registered in Norway. This Privacy Policy describes how we collect, use, store, share, and protect personal information when you use our website, APIs, plugins, on-prem agent, and related services (the "Services").

Controller: Vassbrekke AS Address: Stolevegen, 5514 Haugesund, Norway Country: Norway

Privacy & data protection contact: privacy@privbeacon.com (We have not appointed a separate formal DPO; privacy requests go to the same contact.) Support: support@privbeacon.com

We act in different roles depending on the data:

Data controller — for account registration, authentication, billing, product usage, free public scans you run on our site, marketing conversion tags (with consent), security logs, and our own website operations.

Data processor — when you use PrivBeacon features that store personal data about your end users or other third parties on your instructions — in particular the in-product DSAR request tracker (requester emails and notes), site monitoring configurations (alert emails), and scan workspaces tied to your organization. In those cases you are the controller of that third-party data and must have a lawful basis to collect and process it; we process it only to provide the Services.

Independent operator on scanned websites — when our scanner fetches a public URL (or a URL you authorize), we process technical content of that site to produce a compliance report. You must only scan sites you own or are authorized to test.

We process personal data on the following lawful bases (GDPR / UK GDPR):

• Consent — non-essential cookies and similar technologies (including Google Ads conversion measurement when you opt into marketing cookies); optional marketing communications where we ask separately.
• Contract — creating and securing your account; providing scans, dashboards, reports, badges, APIs, plugins, billing, and support you request.
• Legitimate interests — securing the Services, rate limiting and fraud/abuse prevention, selecting display and checkout currency from country (derived locally from IP), debugging, improving reliability and product quality, and limited self-certification of our own site — balanced against your rights.
• Legal obligation — retaining or disclosing information when required by applicable law, regulation, or valid legal process.

We use essential cookies for authentication, security, and remembering your cookie choices. Optional analytics and marketing categories appear in our consent banner. Non-essential technologies load only after you opt in (ePrivacy / GDPR).

Our banner offers Accept All, Reject all non-essential (refuse optional cookies as easily as accept), and Manage Preferences with granular category choices.

Today, the only optional third-party tag we ship on privbeacon.com is the Google Ads conversion tag, gated behind the marketing category. Rejecting marketing cookies (or rejecting all non-essential cookies) prevents that tag from loading. We do not sell personal information. See our Cookie Policy for category examples and how to change preferences.

AI features may generate compliance report summaries and privacy policy drafts from scan metadata (for example site URL or name, score, tracker vendor names, and gap labels). Issue detection and scoring are rule-based and do not use a language model. Free public scans do not call an AI provider.

Production (privbeacon.com): authenticated scans send that scan metadata to xAI (Grok) in the United States unless you turn AI features off. We request that xAI does not store the prompt or response. We do not use OpenAI or a self-hosted Ollama instance for PrivBeacon production AI features.

You can turn AI features off at any time in Dashboard → Settings. When AI is off, we use template reports and policy drafts only and do not send scan metadata to xAI.

If the xAI request fails, we fall back to template-based text without calling another model provider. Do not submit secrets or unnecessary personal data into free-text fields when using AI-assisted features.

Free public scans (no account): we process the URL you submit and your IP address (rate limiting / abuse prevention), fetch the target site, and return findings. A shareable report is stored as a random token for 14 days, then deleted. Tokens are unguessable and not indexed. Results are not attached to an account unless you later sign up and re-scan.

Authenticated scans: we store scan results and generated artifacts in your account for the retention periods below. You may delete scans from the dashboard (subject to product features).

Authorization: you must only scan websites you own or have permission to test. Scanning may contact third-party domains referenced by the target site as part of detection.

Plugins & agent: WordPress/Shopify embeds and the on-prem agent communicate with our APIs using credentials you configure; they process site identifiers and scan-related data needed to show badges or sync results.

Public badge / verify pages: if you enable certification, badge status and limited site compliance metadata may be publicly accessible via badge and verify URLs.

We share personal information only as described in this policy:

• Subprocessors and infrastructure providers listed below, under contracts and (where required) transfer safeguards.
• Stripe for payments; Google/Microsoft/GitHub if you use OAuth; Google Ads if you consent to marketing cookies; xAI for AI report summaries and policy drafts on authenticated scans; email providers if transactional mail is enabled.
• Endpoints you configure (alert email, webhooks) — you control those recipients.
• Public badge/verify data you choose to publish.
• Legal and safety — if required by law, legal process, or to protect rights, security, and integrity of the Services or users.
• Business transfers — in connection with a merger, acquisition, or asset sale, with notice where required.

We do not sell personal information as defined under the CCPA/CPRA. We do not share personal information for cross-context behavioral advertising except to the limited extent that optional Google Ads conversion measurement (after marketing consent) involves providing identifiers or event data to Google for conversion attribution, as described in Google’s policies. You can opt out by rejecting marketing cookies or contacting us.

Primary application hosting is operated by Vassbrekke AS in Norway / EU. Personal data may also be processed in other countries where our subprocessors operate — including the United States for Stripe, Google (OAuth and, with consent, Ads conversion), Microsoft OAuth, GitHub OAuth, xAI (AI summaries and policy drafts), and any optional Resend usage.

Where required under GDPR/UK GDPR for transfers outside the UK/EEA/Switzerland, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (and UK addenda where applicable), vendor Data Processing Agreements, and transfer impact assessments as needed. You can contact us for more information about transfer mechanisms.

We retain personal data only as long as needed for the purposes above, unless a longer period is required by law:

• Account data — while your account is active, and up to 24 months after closure (or sooner if you validly request deletion and no legal hold applies).
• Scan results and generated artifacts — while associated with an active account; you may delete individual scans in-product. Closed accounts follow the account retention window unless you request earlier deletion.
• Free public scan inputs — processed to produce an immediate response. A shareable findings report (score, named issues, tracker vendors, host) is stored under a random token for 14 days, then deleted. Security logs (e.g. IP-based rate limits) may persist for shorter operational windows (typically up to 30–90 days).
• DSAR tool records you create — until you delete them or your account is closed/deleted under the account schedule (you remain controller of that content).
• Billing records — as required for tax, accounting, and dispute resolution (often longer than account closure).
• Cookie / consent choice — up to 12 months for the consent cookie, or until you clear site data.
• Google Ads / conversion data — subject to Google’s retention; we do not run a separate long-term ad-profile database.
• xAI prompts/responses — we request that xAI does not store conversation history. Generated summaries and drafts we save are retained with your scan/account records as above.

When retention ends, we delete or irreversibly anonymize data where feasible.

We implement technical and organizational measures appropriate to the risk, including TLS encryption in transit, LUKS on the Proxmox host that stores application volumes (guest VMs are not separately encrypted), access-controlled production systems limited to Vassbrekke AS operators, hashed passwords (for email/password accounts), hashed API keys, least-privilege operational access, tenant isolation in the product dashboard, dependency and infrastructure updates, and rate limiting / abuse controls. No method of transmission or storage is 100% secure; if you believe you have found a vulnerability, contact privacy@privbeacon.com or support@privbeacon.com.

GDPR / UK GDPR: access, rectification, erasure, restriction, portability, objection, and withdrawal of consent (where processing is consent-based). You may also lodge a complaint with your local supervisory authority (for example your EU/EEA data protection authority or the UK ICO).

CCPA / CPRA (California) and similar US state laws: right to know/access, delete, correct, and opt out of sale/sharing; non-discrimination for exercising rights. We do not sell personal information. Limited conversion measurement with Google after consent is described under “Sharing” above and can be controlled via cookie preferences.

Other regions (including LGPD, PIPEDA, POPIA, APPI, PDPA, PIPA, Privacy Act (Australia), FADP, and US state laws such as VCDPA, CPA, CTDPA): contact us to exercise access, correction, deletion, or portability rights that apply to you.

How to exercise: submit a request via our DSAR form at https://privbeacon.com/legal/dsar, or email privacy@privbeacon.com with your request type (access, deletion, correction, opt-out, etc.). We will verify your request as required by law and respond within applicable deadlines (for example up to 45 days under CCPA, subject to lawful extensions; without undue delay and within one month under GDPR where applicable). See also our Privacy Choices page.

Account deletion: submit a deletion request via the DSAR form or email privacy@privbeacon.com (or in-product controls when available). We will delete or anonymize personal data we control, subject to legal retention needs. Data you stored as controller (e.g. DSAR requester emails) is deleted with your account or earlier if you remove those records.

PrivBeacon is a business/professional service and is not directed at children. We do not knowingly collect personal information from children under 16 (or under 13 where COPPA applies). If you believe a child has provided us personal data, contact privacy@privbeacon.com and we will take appropriate steps to delete it.

We may update this Privacy Policy from time to time. The “Last updated” date at the top of the policy will change when we do. Material changes will be highlighted on this page and, where appropriate, notified by email or in-product notice. Continued use of the Services after the effective date constitutes acceptance of the updated policy where permitted by law.