EUComply
  • EN
Contents
  1. 1. Who we are
  2. 2. What we collect
  3. 3. How we use your data
  4. 4. Data retention
  5. 5. Your rights (GDPR)
  6. 6. Third-party services
  7. 7. Affiliate links
  8. 8. Security
  9. 8. Changes to this policy

Privacy Policy

1. Who we are

EUComply is a free online compliance scanning service provided by Mahope, Denmark. This privacy policy explains how we collect, use, and protect your data when you use our website and scanning service.

Contact: EUComply

2. What we collect

When you scan a URL:

  • The URL you submit is reduced to its hostname for aggregate scan statistics; the full path and query are not stored by the scan worker
  • The public HTML content of the scanned URL is fetched and processed for that request, not stored
  • Your IP address is used as part of a temporary Cloudflare KV rate-limit key that expires after up to 2 minutes
  • Scan results are returned to your browser and are not stored by the worker. A total scan counter and hostname-level aggregate counters are kept in Cloudflare KV for up to 365 days
  • The scan page stores your six most recent hostnames, scores and timestamps in your browser's local storage so you can re-run or clear them. This history stays in your browser unless you clear it or your browser removes site data

When you use the browser extension:

  • The extension sends the URL of the tab you scan to the same public scan API as this website, and nothing else. It holds no account, sets no identifier and collects no telemetry or usage data.
  • The extension stores the last scan's URL and score in your browser's local storage to draw the toolbar badge. That value never leaves your browser except as the URL of the next scan you start.
  • Its declared browser permissions are the two it uses: activeTab to read the tab you chose to scan, and storage for that badge value. manifest.json is in the public source repository, so what it asks for can be read before you install it.

When you visit the website:

  • Standard web server logs (IP address, browser user-agent, page requested, timestamp) are retained by Cloudflare Pages for up to 30 days
  • We set no cookies ourselves. Cloudflare may set strictly functional cookies for CDN operation
  • Page visits are counted with Plausible Analytics, self-hosted by us in the EU at analytics.holstjensen.eu. Plausible sets no cookies and stores no IP addresses or other personal data: it records the page, referrer, country and browser type as aggregate counts only, and a visitor cannot be recognised across days or across sites

When you use the open monitoring beta:

  • The email address and normalized URL you submit are stored in Cloudflare KV for the monitoring record, together with an unguessable owner token issued at registration. The token stays in your browser's local storage and is required to read the record, change the alert address or delete it, so nobody else can do that on your behalf.
  • The beta keeps an aggregate score and up to 30 days of daily score history. It does not store the full response body from your site.
  • If alert delivery is configured, the monitoring worker sends the email address, URL and score change to Resend for delivery.

When you purchase a product:

  • Card details are handled entirely by Stripe and never reach us. From Stripe we receive your name, email address, country and order details so we can provide the license key or download link.
  • License keys are stored on the Mahope license server with your email address, product and device or site hostname. The WordPress plugin sends the key, hostname and product identifier when it checks Pro status, at most once every 24 hours when the Pro admin view is used.
  • The plugin also checks the public update manifest at eucomplypro.com/update.json.

3. How we use your data

  • To provide the compliance scanning service and, where you opt in, the open monitoring beta
  • To send waitlist updates when you opted in
  • To deliver a purchased license or download and answer support requests
  • We do not sell or rent personal data. Service providers listed below process data only for the purposes described here.

4. Data retention

  • One-off scan URLs and fetched public HTML: not retained by the worker; temporary IP-based rate-limit keys expire after up to 2 minutes, while total and hostname-level aggregate counters expire after up to 365 days
  • Browser-local recent scans: up to six hostnames, scores and timestamps until you clear them or the browser removes site data
  • Open monitoring records: retained until you unregister; aggregate score history is limited to 30 days
  • Email addresses: retained while the relevant service or license is active, or until you request deletion where applicable
  • Server logs: retained according to the relevant hosting provider's configuration, currently stated as 30 days for Cloudflare Pages

5. Your rights (GDPR)

If you are in the EU, you have the right to:

  • Access the personal data we hold about you
  • Request correction or deletion of your data
  • Withdraw consent at any time
  • Lodge a complaint with your national data protection authority

To exercise these rights, contact the site operator. Monitoring registrations, license records, Stripe records, support reports and any local browser preference data are described in the sections above; they are not limited to anonymous scan data.

6. Third-party services

We use:

  • Cloudflare — CDN, hosting and KV storage for the open monitoring beta (privacy policy: cloudflare.com/privacypolicy)
  • Stripe — payment processing (privacy policy: stripe.com/privacy)
  • Mahope tools — license validation and bug reports
  • jsDelivr — serves the BugBottle feedback script
  • Plausible Analytics — cookieless, aggregate visitor statistics, self-hosted in the EU (plausible.io/data-policy)
  • Resend — delivers open-monitoring alerts when configured

BugBottle is loaded by the site shell. If you use the report-a-bug control, the report is sent to the Mahope BugBottle endpoint. The site's JavaScript stores your light or dark theme preference in browser local storage; it does not use advertising or analytics cookies.

Some pages on this site (such as our CMP comparison page) contain affiliate links to third-party services. If you click an affiliate link and make a purchase, we may earn a commission at no extra cost to you. This does not affect our recommendations — we only recommend platforms we've tested and verified independently. Affiliate relationships are disclosed on each page where they appear.

8. Security

We use HTTPS for all connections. The scanning service fetches only public HTML content and does not authenticate or access private data on scanned sites.

8. Changes to this policy

We may update this policy. Material changes will be announced on this page with an updated date.