Privacy
What we collect, why we need it, how long we keep it, and how to have it deleted. Written to be read.
No tracking
No analytics, no advertising pixels, no cookies following you around. Our pages load nothing from anyone else's servers.
Nothing sold
We never sell or rent your details, and we never put you on a mailing list you did not ask for.
Scans stay anonymous
Nothing public shows who ran a scan, and recent scans only ever show a site as n***s.com.
Yours to delete
Ask, and we delete what we hold about you. It costs nothing and you do not have to give a reason.
Who we are
Norval builds, secures and looks after websites for clients around the world. We decide how the information on this site is used, so we are responsible for it. Any question about your data, write to us:
What we collect, and why
When you run the free scan
- The address of the site you scan and what the scan finds, so we can show you the result.
- A scrambled form of your IP address, kept for a few hours, so one person cannot overload the scanner.
- A record that a scan happened, with the grade and the issues found, stored with the site name hidden and nothing that identifies you. This is what the "Just checked" line and the totals on our homepage are made from.
When you ask for the full report
- Your email address, the site and the scan result. We use them to write your report, send you a receipt, and send you a private link to it.
- When the report is opened, the date and how many times. That tells us it reached you. It works without cookies.
When you ask us to watch a site
- Your email address and the site. We check the site once a week and email you once a month, or straight away if something serious changes.
- Nothing is sent until you confirm from the first email, and every email after that has a one click stop link.
When you contact us
- Your name, email, site and message, so we can reply and, if we work together, do the work.
When you are just reading
Nothing about you is collected by the pages themselves. Like every web server, ours writes technical logs that include IP addresses, and those are used only to keep the site running and secure.
Who else sees it
We do not sell, rent or trade your information. A small number of companies handle it for us, only so the service works:
- our hosting provider, which runs the servers this site is on;
- our email provider, which delivers the emails we send you.
When you scan a site, our server also looks up public facts about that site, never about you: where its server is (ipwho.is), whether Google lists it as unsafe (Google Safe Browsing), and the current WordPress release to compare it with (WordPress.org). Those services receive the site's address or its server's IP address, not yours, and nothing about who asked.
We share information when the law requires it. If Norval were ever sold or merged, your information would move with it under the same rules, and we would tell you first.
How long we keep it
- Scrambled IP addresses used to limit scans: a few hours.
- Anonymous scan records: as long as the site runs. They cannot be traced back to you.
- Report requests, reports and messages: until you ask us to delete them, and never more than two years after we last heard from you, unless you become a client.
- Site watch: until you stop it. After that we keep a note that you stopped, so we never email you again by mistake, and delete even that if you ask.
- Client records: as long as the law requires businesses to keep them.
Your rights
Wherever you live, you can ask us to show you what we hold about you, correct it, delete it, stop using it, or give you a copy to take elsewhere. Email us from the address you used. We answer within 30 days, usually much sooner, and it costs nothing. If you are unhappy with how we handled it, you can complain to the data protection authority where you live.
These are the same rights the European and British GDPR and the California CCPA give you, named the way those laws name them, so you can ask for one by name:
- Access. A copy of everything we hold about you.
- Rectification. Anything wrong or incomplete, corrected.
- Erasure. Deleted, with no reason needed.
- Portability. Your details in a file you can take elsewhere.
- Restriction. We hold it but stop using it while something is in dispute.
- Objection. Stop using it for a particular purpose, including anything that looks like marketing.
- Withdrawing consent. Every email we send carries a one click stop link, and stopping never affects anything we did before you asked.
- No selling. There is nothing to opt out of, because we do not sell or share personal information, in the sense the California law means, and never have.
We will never treat you differently for asking. There is no worse service, no higher price, and no need to give a reason.
Keeping it safe
The whole site runs over HTTPS. Report links carry a long random code, are hidden from search engines, and do not open until we send them. Only the people who do the work can see your details.
Children
This site is for businesses and is not meant for anyone under 16. We do not knowingly collect information from children.
Changes to this page
If we change how we use your information, we update this page and the date at the top. If a change affects something you already signed up for, we email you before it applies.
Privacy questions, answered
Can other people see that I scanned my site?
No. Nothing on this site shows who ran a scan. The homepage lists recent scans with the site name hidden, like n***s.com, and nothing that could identify you is stored with them.
Do you keep the address of the site I scanned?
We use the full address to run the scan and, if you ask for the report, to write it. The public record of the scan keeps the site name hidden.
Will you add me to a newsletter or a sales sequence?
No. If you ask for a report you get a receipt, then your report link. We only write again if you reply to us, or if you asked us to watch your site.
Who can open my report link?
Anyone you give it to, so treat it like a private document. The link contains a long random code nobody can guess, search engines are told to ignore it, and it does not work at all until we send it to you. If you want it switched off, email us and we delete the report.
Do you use cookies or track me across the web?
No. We use no analytics, no advertising pixels and no tracking cookies, and our pages load nothing from other companies' servers. If you switch between light and dark, that choice is saved in your own browser and never sent to us.
Why do you keep anything about my IP address?
Only to stop one person running hundreds of scans an hour. We keep a scrambled form of it, never the address itself, and it clears itself within a few hours.
How do I stop the site watch emails?
Every one of those emails has a stop link that works in one click. You can also just reply and ask.
What happens to a login I share for a fix?
You share it only on your private ticket, after ticking an agreement. It is encrypted before it is saved, used only for that job and never sent by email. You can delete it yourself at any time from the ticket. We delete it automatically when the job is marked fixed or closed, or 14 days after you shared it, whichever comes first. We keep a record that you agreed and of when it was deleted, never the login itself.
How do I get my information deleted?
Email us from the address you used and tell us what you want deleted, or just say everything. We confirm when it is done, within 30 days and usually much sooner.
Where is my information stored?
On servers run by our hosting provider. We work with clients around the world, so your information may be handled in a country other than yours. Wherever it is, the rules on this page apply.
Do you scan sites without the owner's permission?
The scanner reads only what is already public, the same things any visitor's browser sees. It does not log in, try passwords or change anything.
Still have a question?
Write to us and the person who handles your data answers, not a form letter.