Privacy Policy

1Who is responsible

The controller within the meaning of the GDPR is CDTechnology, owner Utku Cem Dogan, Markt 36, 60311 Frankfurt am Main, Germany, reachable at cem@cdcapital-group.com. No data protection officer has been appointed, as there is no obligation to do so (Section 38 BDSG).

2Two roles: you and the website being checked

You as a user. When you use Hullwise, we process data about you, for example the address you enter and, if you have an account, your email address. This is what this policy is about.

The website being checked. During a scan, we only read what the site publicly serves to every visitor: response headers, the delivered HTML, the JavaScript files and stylesheets that the site itself includes or lazy-loads from the same domain, configuration files its code fetches itself, the file /.well-known/security.txt, the certificate and public DNS records. We do not search there for individuals. If the HTML or a JavaScript file contains a pattern that looks like a key, we name the type and where it was found and show the value only shortened, the beginning and the last characters, for example sk_live_…9f2A. Only this shortened form appears in the report and the history. We never store the full value. If a public page happens to contain personal data, we process it only transiently while reading it, based on our legitimate interest in a working security check (Art. 6(1)(f) GDPR).

3Where your data is processed

The server functions of Hullwise, meaning scans, the API, the MCP server, sign-in and checkout, run at Vercel in the Frankfurt am Main region (fra1). The database at Supabase is also located in Frankfurt am Main. Vercel delivers static parts of the website through its global network, usually from the location closest to you.

Vercel and Resend are based in the USA; our contracting party at Supabase is Supabase Pte. Ltd. in Singapore. Even though the data is stored in Frankfurt, access from these countries, for example for maintenance and support, cannot be ruled out. How we safeguard this is described in the section on service providers.

4What we process without an account

• The address you enter. We need it to run the scan. Without an account, we store neither the address nor the result.
• Your IP address for the limit. To prevent misuse of the scan, we count scans per IP address. We limit attempts to redeem an access code in the same way. The counters are held in memory only and expire after one hour.
• Technical hosting logs. Like every web server, Vercel logs requests: IP address, time, requested URL, status code and browser identifier. The logs are used for troubleshooting and to defend against attacks. Vercel retains these runtime logs according to its own rules, currently between one hour and one day depending on the plan, and up to 30 days with the “Observability Plus” add-on (source: Vercel documentation “Runtime Logs”, as of August 28, 2026).

5What we store with an account

• Email address for sign-in by email link and for notifications.
• History: checked domain, grade, score, report, time, and whether the scan came through the website, the API, MCP or monitoring. Keys found appear in the report only shortened, never with their full value.
• Monitoring in Business: the domains you have monitored, with the latest grade and the time of the latest check.
• Purchased Single reports: the email address from checkout and, if you have one, your account, the domain, the identifier of the checkout session at Stripe, the time of purchase, the private link and the full report as of the scan (keys found only shortened).
• “Find apps” in Business: the domain and company name you enter, and the addresses found with host, DNS records, reachability and the date of the latest certificate. Details in the next section.
• API keys: only as a SHA-256 hash, together with the name, the beginning of the key and the time of last use. We show you the key itself only once.
• Audit orders: domain, email address, identifier of the checkout session and processing status, plus the agreement on scope and the audit report.
• Plan and customer ID at Stripe, so that we can match your subscription and purchases.

6“Find apps”

With “Find apps” in Business, you search for subdomains of your company that you may not know about. To do this, we query crt.sh with the domain you enter. crt.sh searches the public Certificate Transparency logs, which list every publicly issued certificate. If a separate key for CertSpotter (SSLMate) is configured, that service may be queried with the same domain instead.

For the names found and a few name variants of your company name on known platforms, we read public DNS records and load the start page of each address once. We never load internal addresses. We store the results in your account. We do not pass your email address or any other data about you to crt.sh.

7Report as PDF

If you download a report as a PDF, we generate the file from the same report you are viewing. The PDF contains only content you are allowed to see in the browser, so keys found only in shortened form. We do not create any additional data about you for the PDF itself.

8Public data sources

To classify findings, we query public databases. These services are not processors, because they do not process data on our behalf. We only transmit what is listed in the table, and never your IP address, email address or account data. The requests come from our servers.

9Legal bases

• Scan, account, Single report, Business including “Find apps”, Enterprise and Security Audit: for the performance of the contract with you and for pre-contractual steps, Art. 6(1)(b) GDPR.
• Limits per IP address, hosting logs, protection against misuse and security of the service: legitimate interest in secure and stable operation, Art. 6(1)(f) GDPR.
• Retention of invoices and accounting records: legal obligation, Art. 6(1)(c) GDPR in conjunction with Section 147 of the German Fiscal Code (AO) and Section 257 of the German Commercial Code (HGB).
• Storing and reading cookies and local storage on your device: permitted without consent because it is strictly necessary to provide the service you have expressly requested, Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG). We base the subsequent processing on Art. 6(1)(b) or (f) GDPR.

10Service providers

These service providers help us operate Hullwise.

Vercel, Supabase and Resend process data only on our behalf. Data processing agreements under Art. 28 GDPR are in place with them. Where data is transferred to the USA, we rely on the EU-U.S. Data Privacy Framework if the provider is certified under it (Art. 45 GDPR), and otherwise on the Standard Contractual Clauses of the European Commission (Art. 46(2)(c) GDPR). For Supabase, the Standard Contractual Clauses in the Supabase data processing agreement apply.

Stripe processes payment data partly on our behalf and partly as an independent controller, for example for fraud prevention and its legal obligations as a payment service provider. The Stripe Privacy Policy also applies to this. The checkout is a Stripe page. Stripe is responsible for any cookies it sets there.

11Cookies and local storage

We only store on your device what is strictly necessary for the service. We do not use cookies for analytics or advertising, and we do not include any tracking services. This is why we do not ask for consent.

All cookies apply only to Hullwise itself and are not transmitted to third parties. The Hullwise cookies (sc_…) cannot be read by scripts in the browser.

12How long we store data

• Scan without an account: neither the address nor the result is stored. The counters for limits expire after one hour.
• Hosting logs: according to Vercel's rules, see above.
• Account data, history, monitored domains, “Find apps” results, unlocks and keys: until you have your account deleted. A domain you remove from monitoring is no longer stored there.
• Audit: credentials you give us for the review are deleted once it is complete. We keep the report and correspondence for as long as commercial and tax law requires.
• Invoices and accounting records: for as long as commercial and tax law requires, usually eight or ten years.

13Obligation to provide data and automated decisions

You are not obliged to give us any data. Without an email address, however, you cannot use an account, and without billing details we cannot charge for a paid service. The grade of a scan is an automated assessment of the website checked, not a decision about you within the meaning of Art. 22 GDPR.

14Your rights

You have the following rights:

• Access to your data (Art. 15 GDPR)
• Rectification (Art. 16 GDPR) and erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Lodging a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the authority responsible for us: the Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit), Wiesbaden

To exercise these rights, write to us at cem@cdcapital-group.com.

15Changes

If the way we process data changes, we will update this policy. The date at the top shows the current version. How we check is explained under How we check.