Privacy policy

HARWAY Experience GmbH
Ericusspitze 4
20457 Hamburg
Germany
Email: info@harwayexperience.com

We process personal data that you actively provide to us or that is technically required to provide LaunchCheck. This includes:

• the address (URL) you enter and the result of the check;
• your email address if you buy the Quick Check, join the waitlist or send a review request;
• payment data via Stripe;
• technical access data (IP address, user agent, timestamp);
• aggregated usage data from Vercel Web Analytics;
• measurement events with the check ID, without address, email address, IP address and user agent.

When you have an address checked, our server retrieves the publicly accessible pages of that address and loads them in a browser without a user account, without logging in and without entering anything into forms. We check what is visible from the outside, such as security headers, publicly accessible files, keys delivered in the code, loaded services, imprint and privacy policy. We never store keys we find in plain text, only shortened (e.g. sk_live_••••3f9a) and as a non-reversible hash. We do not store the page text.

When checking the imprint and the privacy policy, we read the information provided by the operator of the checked site. We only store whether information is present, not the information itself.

During the passive check we briefly read the page's responses in memory and only store whether fields such as email occur. For the Supabase check we store table names and the result (readable without signing in or not), no content, for 90 days.

Before the check you confirm that you operate the address or are authorized to have it checked. The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in carrying out the requested check and preventing abuse).

To protect against abuse we limit the number of checks per address and per IP address. For this we store your IP address only as a non-reversible hash (HMAC with a secret key) and delete it after 48 hours. This also applies to review requests and the waitlist. A check of the same address within 3 minutes may show the existing result.

You pay for the Quick Check (€19 incl. VAT, one-time) via Stripe. Stripe (Stripe Payments Europe, Ltd., Ireland) processes payment, invoicing, device and fraud prevention data as an independent controller; for details see the Stripe privacy policy. After payment, Stripe sends us your email address, the amount and the payment reference.

We send you the link to the report by email (Resend) and store the report under a link that cannot be guessed. The legal basis is Art. 6(1)(b) GDPR, and for retaining records Art. 6(1)(c) GDPR. Stripe issues the invoice; records are kept at Stripe and sevDesk (sevDesk GmbH, Germany).

For exact locations you confirm your domain (DNS record or file); we store the domain, the time and the proof.

For a review request we store your details (email address, domain, language, message) and notify our team by email. The legal basis is Art. 6(1)(b) GDPR.

If you tell us on the results page why you are not unlocking the report, we store your answer together with the check. We do not store your IP address and do not set cookies.

To protect against abuse we also store a non-reversible hash of your IP address with a review request and with a waitlist entry and delete it after 48 hours. The waitlist for monitoring uses double opt-in: we send you a confirmation email and only store the address permanently after you confirm. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future by email to info@harwayexperience.com.

LaunchCheck is provided via Vercel (Frankfurt region). On every request Vercel processes technical access data (IP address, user agent, URL, referrer, time) and server logs for delivery, attack detection and performance. The legal basis is Art. 6(1)(f) GDPR.

For audience measurement we use Vercel Web Analytics: the script sets no cookies and builds no personal profiles; we only store the path, the day and the number of views. In addition we count checks, purchases and requests as events in our database, only with the event name, the time, the check ID and a shortened origin value (UTM), without address, email address, IP address or user agent. The check ID can be linked to a purchase or a request for as long as these are stored. The legal basis is Art. 6(1)(f) GDPR (data-minimizing audience measurement, to understand whether and how LaunchCheck is used).

If you open our home page via a link with a campaign tag (for example from an ad), we count this visit together with the campaign tag. We do not set a cookie, store nothing on your device and store neither your IP address nor browser details. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in evaluating our advertising).

We do not set any cookies and do not use browser storage such as localStorage or sessionStorage. The language is determined only by the address of the page.

Recipients of the data are HARWAY Experience and the service providers named in this policy, as far as necessary for operation, payment or invoicing. We have concluded contracts under Art. 28 GDPR with our processors.

For the short summary in the paid report we use Claude, an AI model by Anthropic PBC (USA). We transmit only technical finding codes with title and level, the detected technology stack and the number of checks that could not be run: no address (URL) of your site, no locations of findings, no keys and no personal data. The legal basis is our legitimate interest in an understandable report (Art. 6(1)(f) GDPR). We have a data processing agreement with Anthropic; Anthropic is not certified under the Data Privacy Framework, the transfer to the US relies on standard contractual clauses. Anthropic does not use data sent via the API for training. If the service is unavailable, the report shows the rule-based introduction. The text is labelled in the report as “Summary generated automatically”.

Transfers to third countries

• Vercel Inc. (USA), hosting and web analytics: EU-U.S. Data Privacy Framework.
• Resend (Plus Five Five, Inc., USA), email delivery: EU-U.S. Data Privacy Framework, additionally standard contractual clauses in the data processing agreement.
• Stripe, payment processing as an independent controller: EU-U.S. Data Privacy Framework for transfers within Stripe to the USA.
• Supabase, database: the contracting party is Supabase Pte. Ltd. (Singapore), the database is located in the EU region Frankfurt; the basis is standard contractual clauses in the data processing agreement.
• Anthropic PBC (USA), summary in the paid report: standard contractual clauses in the data processing agreement; not certified under the Data Privacy Framework.
• sevDesk GmbH (Germany), invoicing: no transfer to a third country.

• Check without purchase, including findings: 90 days.
• Failed checks: 30 days.
• Paid report: the link is valid for 12 months, after which it shows “expired” and the findings are deleted.
• Email address from a purchase: when the link expires (12 months).
• Payment reference and amount: 24 months, the email address has been deleted by then; invoices according to the statutory periods at Stripe and sevDesk.
• IP hash for abuse limiting: 48 hours (for checks, review requests and the waitlist).
• Domain confirmation: until it expires, at most 12 months.
• Waitlist: unconfirmed 14 days, confirmed until withdrawal, at most 24 months.
• Review requests: 12 months.
• Measurement events: 24 months.
• Server logs at Vercel: according to Vercel's retention periods.

You have the right of access, rectification, erasure, restriction of processing and data portability (Art. 15 to 20 GDPR).

You can withdraw consent at any time with effect for the future. You also have the right to lodge a complaint with a data protection supervisory authority.

Contact: info@harwayexperience.com

Right to object (Art. 21 GDPR)

Where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Send your objection informally to info@harwayexperience.com.

Status of this policy

This privacy policy reflects the current state of LaunchCheck, including Vercel, Vercel Web Analytics, Supabase, Resend, Stripe and sevDesk.