Privacy Policy

Effective November 1, 2026. Questions: [email protected].

This policy explains what Falken's Maze Website Security Scanner ("we", "us") collects when you use Falken's Maze, why, and what you can do about it. We collect as little as we need to run the service, and we don't sell personal information.

What we collect

Free report card: the domain you scan, your IP address (to enforce scan limits) and, if you give one, your email address.
Accounts: your name, email address, company name if given, a hashed password, two-factor sign-in secrets if you turn it on (stored encrypted), and when you agreed to our terms.
Domains and scans: the domains you add, their verification status, and every scan's results. Results describe the domain's public configuration (DNS records, certificates, HTTP headers and similar), not its visitors.
The Plugin Recon WordPress plugin, if you install it: your site's address, its WordPress and PHP versions, whether automatic core updates are on, each installed plugin's folder name, name, version and whether it's active and auto-updating, each installed theme's folder name, name, version, parent theme and whether it's in use and auto-updating, and whether PHP errors are shown to visitors and the file editor is on. It never sends users, content, passwords or files. We keep only the latest report and delete it when you disconnect the plugin. Exactly what it sends, and why.
Technical data: a session cookie that keeps you signed in and protects forms, and server logs (IP address, pages requested, errors) kept for security and troubleshooting.
Analytics, only if you allow it: on our public pages (not the customer portal), Google Analytics records which pages are viewed, roughly where from (country and city), the browser and device type, and the site that linked to us, using its own cookies (_ga). Report addresses are sent without their ID, and pages opened from a shared report link or an email aren't recorded. Google doesn't store IP addresses for Google Analytics 4, and we've turned off its advertising features. Nothing is sent to Google unless you press "Allow" in the cookie banner; "Cookie settings" at the bottom of each page changes your choice and removes the cookies.
Billing: when paid plans are bought, a payment provider handles card details; we receive the plan, payment status and billing contact, never full card numbers.

How we use it

To run scans, show reports, and send the emails the service depends on: verification, password resets, "your scan is ready" and monitoring alerts.
If you gave an email address on the free report card, to follow up about your report and our plans. You can ask us to stop at any time.
To prevent abuse (rate limits, bot checks) and keep the service secure.
To understand, in aggregate, how the service is used and improve it.

Where laws like the GDPR apply, we rely on performing our contract with you (accounts and scans), our legitimate interests (security, abuse prevention, following up on a free report you asked for), and your consent where we ask for it.

Who else handles it

We share data only with the services that help us run Falken's Maze, under their own privacy terms:

our web host, which stores the database and backups;
a cloud storage provider, which stores copies of our database backups away from our server;
a cloud storage provider, which stores the logos customers upload for their reports;
our email provider, which delivers the service's emails;
Cloudflare, which answers our DNS queries for the domains being scanned and, where enabled, runs the Turnstile bot check on our forms;
public data sources queried by domain name during scans, such as certificate transparency logs (crt.sh), domain registries' RDAP services (for registration expiry dates) and the WordPress.org API. (We also download the Wordfence Intelligence vulnerability database once a day, but send Wordfence nothing about you or your sites: versions are looked up in our own copy.)
Google, which runs Google Analytics on our public pages (see "Analytics" above);
a payment provider, once paid plans are bought.

We may also disclose information when the law requires it, or to protect the service, our users or the public from harm.

How long we keep it

Accounts and their scan history: while the account is open. Closing your account in the portal deletes them straight away, except billing records our payment provider must keep by law.
Sign-ups that never confirm their email address: deleted after about a week.
Free report card scans: deleted after 90 days.
Free report card scans where you left your email address (to unlock the report): deleted after 365 days. Ask and we'll delete yours sooner.
Records of changes our staff make to accounts and logins, and of staff opening your portal (read-only) to help with a support request (who did what, and when), kept for security: deleted after 730 days.
Database backups: about 30 days, then deleted.

Your choices and rights

You can see and change your account details in the portal, download everything we hold about your account, and close your account, all under "Your data". Email [email protected] to get a copy of your data, correct it, delete it or your account, or object to how we use it. Depending on where you live, you may also be able to complain to your data protection authority.

Security

Connections are encrypted, passwords are hashed, two-factor secrets are encrypted, and staff must use two-factor sign-in. No system is perfectly secure; if a breach affects your data, we'll tell you as the law requires.

Children

The service is for businesses and professionals and isn't meant for anyone under 16.

Changes

We'll post updates here with a new effective date, and email account holders about significant changes.

Contact

Falken's Maze Website Security Scanner · [email protected]