Privacy policy

OrderLeak SAS, whose details appear in the legal notice, is the controller of the processing described below.

Contact for any question or to exercise your rights: support@orderleak.com.

Account: email address, name if you provide one, profile picture if you sign in with Google, a hash of your password (never the password itself), interface language, role, credit balance, creation and update dates.

Sign-in: a session token; where you sign in with Google, the access and identity tokens Google issues.

Purchases: amount, currency, number of credits, status, Stripe session and payment identifiers, the email address and language given at a no-account checkout, the addresses of the pages requested before payment, any trading figures entered, and the report access token.

Credits: a complete, append-only history of every movement (purchase, consumption, restoration, adjustment) with its reason and the resulting balance.

Audits: title, language, status, page addresses, full-page screenshots and the image bands derived from them, facts measured on the markup, accessibility measurements, Chrome UX Report performance data, the findings produced by the model and, where you supplied them, your monthly traffic, conversion rate, average order value and sector.

Shares: the link token, expiry date, any revocation, and the number and date of views.

Technical logs: for each call to a provider, the provider, the operation, its duration, the model used, token volumes, cost, response code, any error, and the call parameters including the address of the audited page.

Reviews: the rating you give a report or your order, your answers to the questions that follow it, any comment, whether you agree to be quoted, where the review was given, and, on our side, whether it was handled or published. We also record when an invitation to review was shown to you or dismissed, with no data beyond the report or order concerned.

Email preferences: the date you switched reminders off, if you did.

Operational alerts: technical or payment incidents, which may contain an account identifier and an audit identifier.

Contact form: your email address, the reason you selected and your message, forwarded to our inbox. These messages are not stored in the Service's database.

IP address: used transiently, in memory and for at most one hour, to rate-limit the no-account audit form and the contact form. It is not written to the database. Web server logs are our host's responsibility.

• Creating and managing your account and authenticating you — performance of the contract (art. 6(1)(b) GDPR).
• Running the audit, producing and delivering the report, managing your credits — performance of the contract.
• Collecting payment and handling refunds — performance of the contract.
• Sending you service emails: confirmation, report ready, credit balance exhausted — performance of the contract.
• Drawing up and keeping accounting records — legal obligation (art. 6(1)(c) GDPR; art. L123-22 of the French Commercial Code).
• Securing the Service, preventing abuse and fraud, rate-limiting requests, monitoring incidents and tracking operating costs — legitimate interest (art. 6(1)(f) GDPR).
• Improving the Service from technical and aggregated data — legitimate interest.
• Asking for your review of a report or an order, including by a single reminder email, and measuring how well those requests work — legitimate interest. Answering is optional, and you can switch reminders off at any time from the link in every reminder or from your settings.
• Suggesting, a month after an audit whose findings you started fixing, that you verify the effect of those fixes with a new audit — legitimate interest. This reminder is sent at most once per audit and can be switched off like every reminder.
• Publishing an excerpt of your review on our site, with your first name and the name of the audited site — consent (art. 6(1)(a) GDPR), collected through a separate checkbox. You can withdraw it at any time by editing your review, which removes the excerpt from the site.
• Telling you about an offer better suited to your usage when we observe that you audit several distinct sites — legitimate interest, on the terms of article L34-5 of the French Post and Electronic Communications Code (offering an analogous service to an existing customer). You may object at any time.
• Setting the cookies strictly necessary for the site to work — exempt from consent (art. 82 of the French Data Protection Act).

We neither sell nor rent your data. We run no targeted advertising and no profiling that produces legal effects concerning you. The report analyses web pages: it is not an automated decision about you within the meaning of article 22 GDPR.

For each page and each device we send our analysis provider: the page address, the screenshots and the image bands derived from them, the facts measured on the page's code (title, heading and button labels, trust signals found in the copy, third-party script hostnames, accessibility measurements), Chrome UX Report performance data where it exists, and the language the report should be written in. A second, synthesis call receives the findings the first call produced.

We do not send your name, your email address, your payment identifiers, or the trading figures you entrusted to us: those are used only to compute euro amounts, which happens on our own servers.

If an audited page displays personal data, that data will appear in the screenshot and will therefore be sent. That is why our terms require you to audit public pages only.

We use the following providers, each bound by a contract governing the processing and acting only on our instructions:

• Anthropic PBC (United States) — analysing the screenshots and producing the findings. Transfer outside the European Union framed by the European Commission's standard contractual clauses.
• Screenshot provider, ScreenshotOne — loading the pages you submit and producing the captures.
• Stripe — collecting payments and issuing refunds. Stripe acts as a processor for executing the payment and as an independent controller for its own fraud and anti-money-laundering obligations. Transfers to the United States framed by standard contractual clauses.
• Resend — delivering transactional email, including the report attached as a PDF for a no-account purchase, reminders (review requests, empty credit balance), and forwarding contact form messages. Transfer outside the European Union framed by standard contractual clauses.
• Google — Chrome UX Report: we send the audited page address and the device type to obtain aggregated performance measurements from that page's visitors. No data about you is sent. This call only happens when the feature is enabled.
• Google — sign-in with a Google account, only if that option is enabled and you choose to use it: your identifier, email address, name and profile picture are then received from Google.

We measure the site's audience ourselves, with no third-party tool, no cookie, and nothing read from or written to your device. For each public page viewed we record the page (without its parameters), the name of the site you came from, the campaign tags of the link you followed, the country inferred by our host and the device type (desktop, tablet, mobile). To count visitors, a fingerprint of your IP address and browser is computed with a random key that is replaced every day and then erased: it counts you once a day and can never recognise you from one day to the next, and your IP address is not kept. This data is kept for 395 days, on the basis of our legitimate interest in understanding how the site is used. We use no advertising network and no third-party social widget.

We tell you by email, at least thirty days in advance, of any change of processor liable to affect your data. You may object; failing agreement, you may terminate and obtain a refund of unconsumed credits.

Every period below is the one the platform's code actually applies. They are re-evaluated on each run of our purge routine, which is idempotent: data already erased is not erased twice, and data still within its period is left alone.

• Account, audits, reports, findings and credit history: kept for the lifetime of the account. You can delete them yourself at any time.
• Screenshots: 730 days (about 2 years) from the audit, then erased from disk. The report itself is unaffected: every finding carries its own written evidence and the measured facts stay in the database; only the image stops being viewable.
• Share links: the row is kept for 90 days after the link expires or is revoked — which is what keeps a disabled link distinguishable from a link that never existed — then deleted.
• Provider call log: the call parameters, including the audited page's address, and the model's raw response are erased after 90 days. The accounting row that remains (provider, duration, token volumes, cost) is deleted after 400 days.
• Abandoned checkout, meaning one where payment never completed: the email address, the page addresses and any figures entered are erased after 90 days. The now-anonymous row is kept solely to count abandoned baskets.
• Screenshots uploaded with a no-account order whose payment never completes: deleted after 7 days.
• Free preview — the capture and mobile analysis of the home page: deleted after 90 days.
• An account created at a no-account checkout and never used — no password, no linked identity, no paid order, no audit and no credits: erased after 90 days.
• Expired sessions and verification tokens: deleted once their expiry is observed.
• IP addresses used for rate limiting: at most one hour, in memory, never in the database.
• Messages received through the contact form: kept in our mailbox for as long as handling your request requires.
• Reviews: kept for the life of the account, or of the order for a no-account purchase, and deleted with it. A published excerpt is taken off the site as soon as you withdraw consent.
• Invitations to review (shown, dismissed): deleted after 180 days.
• Audience measurement: each page view is deleted after 395 days; the daily key used to count visitors is erased the next day.
• Operational alerts: kept for as long as they are useful for diagnosis; the account and audit identifiers they contain are stripped when the account concerned is erased.

Accounting records: orders that resulted in a payment or a refund are kept under article L123-22 of the French Commercial Code (ten years) and article L102 B of the Book of Tax Procedures (six years). That legal obligation prevails over the right to erasure, as article 17(3)(b) GDPR provides. They are not kept in a form that identifies you: see the next clause.

Deletion, requested from your settings, requires two separate confirmations and runs immediately. It erases:

• your account, your sessions and your linked identities;
• your audits, their pages, their reports and their findings;
• the image files your audits produced, on the disk where they are stored;
• your share links and the history of your credit movements;
• the verification tokens tied to your email address;
• orders that never resulted in a payment.

It keeps, in anonymised form, only orders that were paid or refunded, reduced to the financial fact: amount, currency, number of credits, status, date, what was sold and the transaction reference at our payment provider. Everything that tied you to that row is erased: your account is detached from it, and your email address, language, the page addresses requested, the trading figures entered and the report access token are all removed. Once your account is gone, nothing in our database resolves that row to a person.

In the same operation, the parameters and responses held in the provider call log are emptied, and operational alerts are stripped of the identifiers that concerned you.

Deletion is permanent and cannot be undone. Download your reports, or your data export, before requesting it.

You have the rights of access, rectification, erasure, restriction, objection and portability, the right to withdraw consent where processing rests on it, and the right to give directions on what becomes of your data after your death (art. 85 of the French Data Protection Act).

Two of those rights are exercised directly from your settings, with nothing to write and nothing to wait for:

• Access and portability: one click downloads everything we hold about your account, as a JSON file a machine and a person can both read. That file contains neither your password hash nor the access tokens of your linked identities: those are not facts about you, they are keys, and writing them into a downloaded file would expose them for no reason. The export does state that an identity is linked and with which provider.
• Erasure: you delete your account, on the terms of clause 7 above.

Any other right, and any question, is exercised at support@orderleak.com. We answer within one month, extendable by two months for a complex request, and may ask for something that verifies your identity where there is reasonable doubt.

If you believe your rights are not respected, you may lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr, or with the supervisory authority of your country of residence.

• Passwords are stored as a bcrypt hash; we cannot read them.
• Exchanges with the site are encrypted in transit.
• Provider access keys configured from the admin area are encrypted at rest (AES-256-GCM).
• Every route to a report — page, images, PDF — independently re-checks the requester's rights; a share link is an unguessable identifier scoped to a single audit whose expiry and revocation are re-evaluated on every view.
• Submitted addresses are checked before any request, to bar loopback addresses, private networks and cloud metadata endpoints, and redirects are re-validated at every hop.
• Public forms are rate-limited.

No measure guarantees absolute security. In the event of a data breach likely to create a risk to your rights and freedoms, we notify the CNIL within seventy-two hours and, where the risk is high, inform you individually as promptly as possible.

Where an audit covers content for which you are the controller, we act as a processor within the meaning of article 28 GDPR. A data processing agreement is available on request at support@orderleak.com.

Any change is published on this page with a new update date. Substantial changes are notified to you by email.