Trust
Security & data handling
What OptOutLens collects when it scans a website, where that data lives, who processes it, how long we keep it, and how to reach us about a vulnerability.
What a scan collects
A scan visits the public pages of your website the way a visitor’s browser does. We store:
- Measurement data: the third-party hosts each browser run contacted, the cookies that were set, the consent banner and its buttons, and the links and forms we found — with and without Global Privacy Control.
- Screenshots of the scanned pages.
- The text of your public privacy policy and opt-out page, which the report checks.
- What you enter: site URLs, your threshold self-declaration, statements on findings, alert addresses and webhook URL.
What we do not do
- We do not log in to your systems and do not ask for access to your website, CMS or tag manager.
- We do not install code on your site. Domain verification uses a file, meta tag or DNS record that contains a code and runs nothing.
- The scanner appears as an ordinary Chrome browser, without a scanner name in its user agent, so the report shows what visitors see. If your bot protection blocks it, you can let it through with a secret header or a fixed IP address under Settings → Scanner access. We send that header only to your own verified domains.
- We scan a domain only after you verify that you operate it, and we check the proof again before every monitoring scan and at least every 30 days.
- A scan loads pages like a visitor and respects timeouts. It is not a load test or a penetration test.
Where data is hosted and who processes it
OptOutLens is operated by cassida.io GmbH, Berlin, Germany. The service runs on our own server at DigitalOcean in San Francisco. The database and screenshots are stored on that server; the database is not reachable from the internet. These providers process data on our behalf:
| Provider | Purpose | Data it receives |
|---|---|---|
| DigitalOcean | Server hosting in San Francisco, United States | All service data: accounts, scans, reports, screenshots, request logs |
| IONOS | E-mail delivery (sign-in links, alerts, report invitations) through our mail server in Germany | Recipient addresses and message content |
| Stripe | Payments and invoices | Billing details. Card data is entered directly with Stripe; we never receive full card numbers |
| Mistral AI | Analyzing the privacy policy text for full reports | Only the public privacy policy text of the scanned site, no account data |
This site uses no analytics, advertising pixels or other third-party code.
How long we keep data
- Account data: for the life of your account, deleted right away when you delete it.
- Scans and reports: for the life of your account. When you remove a site, its scans, reports and screenshots are deleted right away.
- Screenshots: kept for the 10 newest scans of each site.
- Request logs (IP address, user agent): 30 days.
- Billing records: 7 years from the end of the fiscal year, as tax and accounting law requires.
- Support and privacy request e-mails: 24 months.
- Backups: copies of deleted data are overwritten within 14 days.
The privacy policy lists every category with its sources, purposes and recipients.
Access control
- Customers sign in with a link sent by e-mail, a password or a passkey. Adding a passkey requires a fresh sign-in, and the account owner is told by e-mail.
- Sessions are kept in cookies that scripts cannot read.
- Sign-in attempts are rate-limited per address and per account.
- Our operators use a separate application with its own user accounts. It requires a second factor — a passkey or an authenticator app — on top of the password.
- All pages and the API are served over HTTPS.
Reporting a vulnerability
If you believe you have found a security issue in OptOutLens, e-mail kontakt@cassida.io with a description and the steps to reproduce it. Please do not access other customers’ data, degrade the service or run automated scanners against it while testing.
Our contact is also published in /.well-known/security.txt.
For procurement and security reviews
Available on request:
- A Data Processing Addendum with CCPA service-provider terms, and GDPR Article 28 terms for customers in the EU.
- The current list of subprocessors, with the data each one receives.
Write to kontakt@cassida.io.