Privacy Policy

Scan logs

When you run a scan, we log your IP address, the timestamp, and the URL you submitted. We retain this data for 90 days, after which it is automatically deleted.

Why: Abuse prevention. The scanner makes outbound HTTP requests on your behalf. Logging is necessary to detect misuse, respond to complaints, and comply with our legal obligations.

Legal basis: Legitimate interest (GDPR Art. 6(1)(f)). We have a proportionate interest in preventing the scanner from being used to probe sites without authorisation.

Account data (Pro users)

If you create an account, we store your email address and a hashed version of your password. We never store your password in plain text. If you sign in with Google, we store your email and Google account ID — your Google password is never shared with us.

Why: To provide the service — automated scans, scan history, and email alerts require an account.

Legal basis: Contract (GDPR Art. 6(1)(b)).

Scan history (Pro users)

Pro accounts store the results of automated weekly scans. This data is tied to your account and retained for as long as your account is active. You can delete it at any time from your dashboard.

Legal basis: Contract (GDPR Art. 6(1)(b)).

Scanner email follow-ups

If you submit your email address on the public scanner to receive a copy of your report, we store your email, the URL you scanned, the report contents, the IP that captured the email, and the plugin slugs/versions detected on that site. We use this to send you the report (Day 0), four follow-up nudges over the next two weeks, and an alert if a new vulnerability is later disclosed for one of the plugins we detected on your site.

Why: You explicitly asked to receive a copy of your scan results, and the follow-ups are tightly tied to that report (helping you act on the findings, alerting you to new risks affecting the same site).

Legal basis: Legitimate interest (GDPR Art. 6(1)(f)). Every email contains a one-click unsubscribe link; opting out also stops vulnerability alerts.

Payment data

Payments are processed by Stripe. We do not store your card number or payment details. Stripe may retain payment data in accordance with their own privacy policy.

Marketing attribution (Google Ads click ID)

If you arrived from a Google Ads click, the URL contains a gclid parameter that Google appended. We store that single identifier in a first-party cookie on our own domain for up to 90 days. If you sign up, the identifier is saved alongside your account record so we can periodically upload paid signups to Google Ads (server-side, in batch) for conversion attribution. We do not load any Google JavaScript on this site and Google does not set any cookie on guardingwp.com.

Why: To measure which ad campaigns drive paid signups, without subjecting you to a cookie banner or third-party tracking pixels.

Legal basis: Legitimate interest (GDPR Art. 6(1)(f)). The processing is limited (one short identifier), purpose-bound (attribution only), and uses no cross-site tracking.