Your data on graiva.com

What we collect

• ▸The website address you ask us to scan, and the report we make of it. A report is public to anyone who has its link.
• ▸A one-way fingerprint (hash) of your IP address, used only to limit how many scans and codes one connection can request. We do not store the IP address itself.
• ▸Your first name and email address, if you ask for the full report. We email a 6-digit code to confirm the address; we store the code only as a hash, for 10 minutes.
• ▸A sign-in cookie (cm_session) after you verify your email, so you can open full reports for 30 days. It is strictly necessary and holds no tracking identifier.
• ▸Your colour and theme choice, kept in your own browser (local storage). It never leaves your device.

What we do not do

• ▸No analytics, advertising pixels, session recording or third-party fonts on graiva.com. Your browser talks only to graiva.com.
• ▸We do not sell or share your personal information, and we do not use it for targeted advertising.
• ▸We send no newsletter unless you ask for one.

Why we use it (legal basis)

• ▸To run the scan and show the report you asked for (performing your request, GDPR Article 6(1)(b)).
• ▸To limit abuse with the IP fingerprint (our legitimate interest in keeping the service available, Article 6(1)(f)).
• ▸To send your code and full report, and to contact you once about your report and how we can help (legitimate interest; you can say no at any time and we stop).

Who receives it

• ▸Hetzner Online GmbH, Germany: hosts our servers and database.
• ▸Amazon Web Services (Amazon SES): sends our emails. Amazon is a US company; transfers rely on the EU-US Data Privacy Framework and standard contractual clauses in its data processing terms.
• ▸Our team at RB DesignTech receives a notice when someone verifies an email, so we can follow up.

How long we keep it

• ▸Verification codes: 10 minutes. Sign-in cookie: 30 days. Rate-limit counters: up to 1 hour.
• ▸Scan reports, your name and email: until you ask us to delete them.
• ▸Database backups: 14 days, then overwritten.

Your rights

• ▸Ask for a copy of your data, to correct it, to delete it, or to stop us contacting you. Email us and we answer within 30 days.
• ▸In the EU and UK you can also object to processing based on legitimate interest, ask for your data in a portable format, and complain to your data protection authority (in the UK, the ICO).
• ▸In California and other US states with privacy laws you have the right to know, delete and correct, and we do not sell or share personal information. We do not treat you differently for using these rights.
• ▸In India, write to the same address as our grievance contact under the Digital Personal Data Protection Act.

Children

• ▸GRAIVA is a service for businesses. It is not meant for anyone under 18, and we do not knowingly collect data from children. If you think a child gave us their details, email us and we delete them.

Websites we scan

• ▸Our crawler reads public pages only: it never logs in, never fills in forms and never touches a site’s visitor data. Site owners can opt out; see About our crawler.

Contact

RB DesignTech, for GRAIVA. Email [email protected] for any request about your data. More about how we scan websites: About our crawler.