Privacy Policy

This policy explains what personal data bluwarden.com ("we", "us") collects when you visit this website or contact us, why, who else handles it, how long we keep it, and what rights you have. It describes what the site's code actually does.

1. Who is responsible

bluwarden.com is responsible (the "controller") for the personal data described here. You can reach us at [email protected].

2. The short version

• This site sets no cookies and uses no third-party analytics, advertising or tracking pixels. Fonts are served from our own server.
• The only personal data we collect directly is what you send through the contact form or the free-scan request form, together with your IP address.
• Cloudflare sits in front of the site to deliver and protect it, and runs the spam check on our forms.
• We count article views without IP addresses, cookies or user-agent strings.

3. The contact and free-scan forms

What we collect: your name, email address and message, the time you sent it, and your IP address. If you request a free scan, we also receive the domain you want scanned and your confirmation that you own it or are authorised to have it tested; the message is optional there.

Why: to reply to you, to carry out a free scan you asked for and, if you want, to discuss a service with you (steps before a contract, Article 6(1)(b) GDPR), and because we have a legitimate interest in answering enquiries, checking that a scan request is authorised and keeping the forms free of abuse (Article 6(1)(f) GDPR).

What happens to it: your message, including your IP address, is emailed to our team's mailbox. If that email cannot be delivered, the submission is written to our server log instead so it is not lost. Your IP address is also used to limit how many messages can be sent from one address in a short time; for that it is held in memory for 10 minutes.

The free scan itself: once we have confirmed you are authorised, we scan only systems that are reachable from the public internet under the domain you gave us. The scan does not use your name or email address. Its results describe your systems; we send them to you and do not publish or share them. If part of the scan uses an AI service to review your website's public responses, only those responses are sent to it, never your contact details.

4. Spam protection (Cloudflare Turnstile)

When you send the contact form or the free-scan form, a Cloudflare Turnstile check runs in your browser. It sends technical signals from your browser and device, along with your IP address, to Cloudflare so it can tell people from bots. Our server then sends your IP address to Cloudflare once more to verify the result. We only receive whether the check passed. Legal basis: our legitimate interest in keeping the form free of spam (Article 6(1)(f) GDPR). Cloudflare's own processing is described in Cloudflare's privacy policy.

5. Visiting the site

Every request to this site passes through Cloudflare, which processes your IP address and request details (such as the page requested and your browser information) to deliver the site and protect it from attacks. Cloudflare may set strictly necessary security cookies, such as __cf_bm, when it needs to tell automated traffic from people. Legal basis: our legitimate interest in running a secure, working website (Article 6(1)(f) GDPR).

6. Article statistics

When an article is opened, our server records which article it was, the browser family (for example Firefox), the operating system (for example Android) and the device type (desktop, mobile or tablet). For search engines and other crawlers it records the crawler's name instead. We may also count a few site events the same way: page views, contact form submissions, and the address of pages that could not be found. No IP address, cookie, full user-agent string or other identifier is recorded, so these statistics cannot be linked to you. They are stored in our own analytics panel.

7. Who handles your data

• Cloudflare, Inc. (United States): content delivery, security and the spam check on our forms.
• Hostinger International Ltd (European Union): hosts our web server and the mailbox that receives form messages.

We do not sell or rent personal data, and we do not share it with anyone else unless the law requires us to.

8. Transfers outside the EU

Cloudflare may process data in the United States and other countries outside the European Economic Area. These transfers rely on safeguards recognised under EU law, such as the European Commission's Standard Contractual Clauses.

9. How long we keep it

• Contact form and free-scan request emails: up to 12 months after your enquiry, then deleted. If your enquiry becomes a client engagement, the terms of that agreement apply instead.
• Server log entries (only written if an email could not be delivered): up to 30 days.
• Rate-limiting data: 10 minutes, in memory only.
• Article statistics: kept without a set end date; they contain no personal data.
• Data processed by Cloudflare: according to Cloudflare's own retention periods.

10. Your rights

Under the GDPR you can ask us to give you a copy of your personal data, correct it, delete it, or restrict how we use it. You can object to processing based on our legitimate interests, and ask for the data you gave us in a common, machine-readable format. Email [email protected] and we will respond within one month.

You also have the right to complain to the data protection authority in the EU country where you live or work, or where you believe the problem happened.

11. Cookies

This site does not set cookies and does not store anything in your browser. The only cookies you may receive are Cloudflare's strictly necessary security cookies described in section 5.

12. Changes

If we change how the site handles personal data, we will update this page and the date at the top.

13. Contact

Questions about this policy or your data? Email [email protected].