Draft for the owner to review with a solicitor before going live. This is not legal advice and it is not a finished contract.

Privacy policy

This draft explains how Owen Harrison, sole trader handles personal data for LeakSweep. It is written for UK GDPR. Have it reviewed before launch. Contact hello@leaksweep.app.

Who we are

The controller is Owen Harrison, sole trader. The contact address for privacy is hello@leaksweep.app. Postal address: 54 Stephenson Grove, Rainhill, L35 9AA

What we collect from you

• The email address you type for a report, a receipt, monitoring, or the newsletter.
• The URL you ask us to scan, the ownership token, and the fact that you ticked the authorisation box.
• Payment status from Stripe. Card numbers are handled by Stripe, not stored here.
• Feedback notes, and emails people send to the product addresses.
• A page path for a first-party page view, with no cookie and no advertising profile. If you turn on Plausible, that service has its own notice.

What we do not keep from the scanned app

We do not store personal data of your end users. Database rows, document fields, and Realtime Database keys are discarded. Secret values are redacted to a short prefix and suffix. Reports store the finding title, a redacted evidence line, a status code, or a count.

Why we use it

Contract: to run the scan you asked for, send the report, and take payment. Legitimate interests: to keep the service reliable, prevent unauthorised scans, and see which pages are used. Consent: the newsletter, which is double opt-in and separate from a scan.

Who else sees it

Hosting (Netlify), the database (Neon), email (Resend), and payments (Stripe), if those accounts are connected. Optional analytics (Plausible), error tracking (Sentry), and newsletter sync (beehiiv) only run when their environment variables are set. We do not sell personal data.

How long

Scan reports are kept so you can reopen them and so monitoring can tell what is new. You can ask us to delete a report by emailing hello@leaksweep.app. Newsletter addresses are kept until you unsubscribe. Server logs follow the host’s normal retention.

Your rights

You can ask for access, correction, deletion, restriction, or a copy of the personal data we hold about you, and you can object to legitimate-interest uses. You can complain to the Information Commissioner’s Office. We will respond within one month.

International transfers

Some processors store data outside the UK. Before launch, the owner should record the transfer tool each processor offers (for example the UK extension to the EU-US Data Privacy Framework, or the International Data Transfer Addendum).