Privacy Policy

This policy explains what personal data Magekwik processes and why, under the UK GDPR and the Privacy and Electronic Communications Regulations (PECR). We keep it deliberately concrete: the same honesty we hold our reports to.

1. What we collect

• The URL you submit and the scan results derived from it. A report is private to whoever ran the scan: it lives at /r/{id}?t={token}, and the token is the key. We store only a hash of that token, so we cannot reconstruct your link, and anyone without it gets a 404. There is no public list of scanned stores.
• Your IP address, used transiently for rate-limiting and abuse prevention, and recorded against an email confirmation as proof of consent.
• Your email address, only if you sign in, ask us to email a report, or sign up for change-detection monitoring. All three are double opt-in: we send one confirmation or sign-in link and nothing further until you click it. There is no password. We never collect one.
• A domain verification record, if you choose to prove you control a domain: the host, the token you publish, which of the three proofs we found it in, and when. The token is meant to be public (it goes in your DNS, your homepage or a file), so it is not a secret.
• Billing details, if you subscribe to Pro. Stripe takes the payment and holds your card; we never see it. We keep the Stripe customer and subscription references, your plan and its status, and the brand and last four digits of the card, which Stripe sends us.
• Care plan details, if Pro comes with a Magekwik Care plan. magekwik.com sends us your name, email address, the store's address, the plan's contract and order numbers, and its Stripe customer and subscription references, so we can switch Pro on and check with Stripe that the plan is paid. We send magekwik.com back whether your Scanner account is set up, whether Pro is on and until when, whether the store is verified, the latest test's grade, score and date, and whether uptime checks are up. Report contents, findings and API keys are not shared.
• Monitoring data, on Pro. The URLs you ask us to check and, every minute, what each check saw: status code, response time and any error. Also the alert channels you add (a Slack, Microsoft Teams or webhook address, stored encrypted) and your API keys, stored only as a hash.
• Live script reports (Pro). If a store owner points their store's Content Security Policy Report URI at us, their visitors' browsers send us reports of scripts and connections the store did not expect. A report contains page and script addresses, not personal details. From each report we keep the page address and the address of the script that triggered the report, both without their query string or fragment, and only the origin (scheme, host and port) of the blocked script or connection, never its path or query. We use each visitor's IP address only to compute a keyed hash that tells visitors apart (an IPv6 address counts by its /64 network), never store the address itself, and delete the hash after 24 hours. The same keyed hash, not the address, is what our rate limits count by, and those rate-limit entries are deleted within a day. Reports are kept as per-origin summaries for 90 days after an origin was last reported.
• Google Analytics, only if you allow it: the public pages you view, how you reached them, your rough location and device, and a cookie ID. Reports, your account and sign-in are never included, and we send page addresses without their query strings.

We do not run advertising trackers, and we do not sell or share personal data with third parties for their own marketing.

2. Lawful basis

• Running a scan & abuse prevention: legitimate interests (operating and protecting the service).
• Signing you in: performance of the service you asked for; the link only reaches an address you typed yourself.
• Pro: billing, uptime checks, alerts and the API: performance of the contract you entered by subscribing; keeping billing records: legal obligation.
• Emailing a report & monitoring alerts: consent, captured via double opt-in and revocable at any time.
• Google Analytics: consent, given in the notice on your first visit and revocable at any time.

3. Email & your consent trail

When you request a report by email we store the address, a one-time confirmation token, the time and IP of the request, and the lawful basis (consent). The report itself is only sent after you confirm. Monitoring alerts work the same way. You can withdraw consent at any time using the unsubscribe link in any monitoring email, or by contacting us.

4. Cookies (PECR)

Magekwik sets only what is strictly necessary to operate the site (for example, the session and CSRF-protection cookie). These are exempt from the consent requirement under PECR because they are essential to a service you actively requested. We set no advertising cookies.

Google Analytics cookies (_ga and _ga_*, kept for up to two years) are set only if you choose Allow, and your choice is remembered in your browser. To change it, use Cookie settings at the foot of any public page. Choosing No thanks removes those cookies.

5. Retention

• Google Analytics data: kept by Google for 14 months.
• Anonymous scan reports: deleted automatically after 30 days unless you save them. Holding a stranger's security posture indefinitely, because nobody got round to deleting it, is not a neutral default.
• Saved reports: kept until you delete them. Every report has a Delete this report button, available to anyone holding the link: the same people who can read it. Deleting is immediate and permanent, and the link then works for nobody.
• Sign-in links: single-use, expire within minutes, and stored only as a hash. Requesting a new one invalidates the last.
• Domain verifications: expire after 90 days and must be redone. Domains change hands, and a permanent grant would still be handing a previous owner detail about someone else's store.
• Uptime results: each per-minute result is deleted after 90 days. The incident log (when an outage started, ended and why) stays while the check exists.
• Alert channels, API keys and checks: until you delete them; deleting one is immediate.
• Billing records: kept for six years after the payment they record, as UK tax law requires; Stripe keeps its own records under its own obligations.
• Email & consent records: retained while a monitor is active or a report request is outstanding, and for a reasonable period afterwards as a record of consent, then deleted.

6. Who can see a report

A report is private to whoever ran the scan, and how much of it you see depends on what you have proved:

• Anyone with the link: the grade, the findings, and the fixes. Response bodies, infrastructure addresses, email addresses, key fragments and discovered paths are withheld, because a link travels.
• Signed in: the same view, plus PDF export, sending a report to a developer, and keeping reports in one place.
• Verified owner of the domain: everything, including the raw evidence, and the deeper checks we will not run on a store nobody has proved is theirs.

Redaction happens on our servers before anything is sent, so it applies equally to the web page, the printable version, the PDF, the JSON API and the emailed copy.

7. Your rights

Under the UK GDPR you have the right to access, rectify, erase, restrict, and port your personal data, and to object to processing based on legitimate interests. To exercise any of these, contact support@magekwik.com. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

8. Processors

These are the only third parties that personal data reaches, each acting as our processor under contract and only on our instructions:

• Brevo (Sendinblue SAS, France): SMTP delivery of confirmation, report, and monitoring-alert emails. Receives the recipient address and the message itself.
• Hetzner Online GmbH (Falkenstein, Germany): hosting. The application, its database, and its logs run on Hetzner infrastructure inside the EU.
• Stripe (Stripe Payments Europe Ltd, Ireland): Pro payments only. Receives your email address and the card details you type into its checkout, which never pass through us. Stripe is also a controller in its own right for fraud prevention and its legal obligations, under its own privacy policy.
• Google (Google Ireland Limited): Google Analytics, only if you allow it. Receives the data named in section 1 and your IP address, and may process it in the United States.

magekwik.com and this scanner are both run by 4KTechnologies Ltd (company no. 14234800, trading as Magekwik), so the Care plan details above pass between two of our own services, not to a third party.

If you add a Slack, Microsoft Teams or webhook channel, alerts go to the address you gave us. That service is your choice and acts for you, not for us.

For live script reports, the store owner is the controller of their visitors' data and Magekwik processes it on their behalf.

We use no advertising, session-recording, or content-delivery third party. The site loads its own fonts and scripts from its own origin, and Google's analytics script is the one exception: it loads only after you choose Allow, so until then browsing discloses your IP address to nobody but us. Scans themselves are outbound requests from our servers to the store you named. Your browser never contacts the scanned site on our behalf.

9. Contact

Data protection enquiries: support@magekwik.com.