Privacy Policy

Laskyr stores the URL you submit, the findings from that scan, and the HTML we fetched to produce them. The fetched HTML is kept for up to 90 days and then deleted. The findings are kept. An email address is stored only if you submit one. Credentials for a paid job are sealed and deleted when the job closes. Scanning a URL is not consent to marketing email.

What does a scan store?

When you run a read-only scan, we store the URL, the findings we report, and the HTML the scanner fetched to reach those findings. We need the HTML for the life of the report so we can show what the public page returned. We delete that fetched HTML within 90 days. We keep the findings after the HTML is gone, so the report still has a record of what was observed and so that, once a group of cleanups is large enough to publish, we can compute statistics that do not include customer domains. Until that bar is met, we do not publish aggregate counts. The statistics page says so.

We do not require an account to scan. If you type an email address so we can send the report, we store that email and use it for the report. We do not add you to a marketing list because you scanned a URL. We do not sell scan data.

What does a paid job store?

Emergency Cleanup needs access to the site. You send that access through the intake form after you confirm you are authorized, as described on the authorization page. Those credentials are sealed. They are used for that job. They are deleted when the job closes. Protection uses the same external read-only checks as the free scan. It does not need us to keep your SFTP or wp-admin password after the cleanup job is closed, and we do not keep it for monitoring.

We store the site URL, the incident report, and the email we use to reach you about that job. Payment card numbers are handled by Stripe, not typed into a Laskyr page for us to store.

Who processes the data?

Three processors handle data for us. Stripe processes payments. The email provider configured in the app sends messages such as a report or a job update. We do not name a different provider here, because the app is configured with one, and swapping it should not silently change this policy's meaning. The host is the company that runs the server this application lives on. We do not add advertising networks, and we do not use a scan as a reason to build a marketing audience.

How do you ask for deletion?

<a id="delete"></a>

Email daniel@daniellasek.com, or use this section at /legal/privacy#delete. Name the URL, the email address, or both. We will delete the fetched HTML we still hold, the findings tied to that scan or that email, and the email address itself. If a paid job is still open, we delete the sealed credentials when the job closes, or sooner if you withdraw authorization and we have stopped work. We may keep a billing record of a completed paid job, such as the amount, the date, and the site URL on the invoice, because that is the record of the sale. Stripe keeps payment data under Stripe's own policy. We cannot delete Stripe's copy from this inbox. Contact Stripe if you need that.

A deletion request is not a refund. Refund rules are on the refund page. Questions about these practices can go to the same address, daniel@daniellasek.com.

This is a practical draft for launch review by a lawyer, not a substitute for legal advice.