Privacy policy

1. Controller

The controller for personal data on luentis.com and in the Luentis app is

Muuh AS
Sukkevannslia 4, 4638 Kristiansand, Norway
Email: [email protected]

Send questions about data protection to this address.

2. Overview

Luentis checks publicly available websites for accessibility. We process as little personal data as possible to do so. All data is stored and processed in the EU, in data centres in Frankfurt am Main. We do not sell data and do not use advertising or tracking cookies.

3. Visiting the website

When you open our pages, our hosting provider processes technically necessary data: IP address, date and time, the address requested, browser and operating system. This keeps the service secure and stable (Art. 6(1)(f) GDPR). The logs are kept for at most 30 days.

We only set cookies that are needed to use the service: a session cookie, a cookie that protects against forged form requests (CSRF) and, in the app, cookies for the chosen appearance (light or dark) and the sidebar. These cookies are strictly necessary for the service you ask for, so no consent is needed.

We count page views with Cloudflare Web Analytics, without cookies and without recognising your device.

4. Free scan

When you have a website checked, we store the website's address, the result and the time. The scan only reads publicly available pages. If those pages contain personal data, such as names or photos, short excerpts may appear in the code examples of the result.

The legal basis is our legitimate interest in carrying out the scan you asked for and showing the result (Art. 6(1)(f) GDPR). We delete the results of free scans at the latest twelve months after the scan.

5. Emails after a scan or for the checklist

If you ask for the result of a scan or for our checklist by email, we store your email address, the language, where you asked (scan or checklist), the time and the version of the consent. You first receive an email to confirm the address (double opt-in). Only then do we send the result or the checklist, and at most five further emails with advice on accessibility and on fixing errors, which can also present our services. We note which of these emails we have sent.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with the unsubscribe link in every email. After that we send no more emails. We delete unconfirmed addresses after 30 days.

6. Purchase and account

When you buy a single audit, Link, Stripe's payment service, collects your payment details as the seller. Link and Stripe process this data as independent controllers under their own privacy notices. We receive your name, email address, the amount and a payment reference from them, but no card details.

We use this to create your account and team, carry out the audit and send emails about the purchase, the finished report and any refund. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR).

We keep account data for as long as the account exists. We keep purchase records for five years, as Norwegian bookkeeping rules require (Art. 6(1)(c) GDPR).

7. Manual check and accessibility statement

In the guided manual check we store your answers, comments, the time and who in the team answered. For the draft statement we store what you enter, such as your organisation's name and a contact address. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR). The data is kept for as long as the account exists.

8. Recipients and processors

We use these providers, which process data on our behalf:

Link and Stripe (Stripe Payments Europe, Ltd., Ireland, and the Stripe group) are independent controllers for the payment.

Some of these providers are based in the United States. We store and process the data in the EU. Where data may still be transferred to the United States, we rely on the adequacy decision for the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's standard contractual clauses.

9. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future. Write to us at [email protected].

10. Right to complain

You can complain to a data protection supervisory authority, in particular in the member state where you live, work or where the alleged breach took place. Our supervisory authority is the Norwegian Data Protection Authority (Datatilsynet).

11. No automated decisions

We make no automated decisions within the meaning of Art. 22 GDPR. The score of a scan rates a website, not a person.

12. Changes

We update this privacy policy when Luentis or the law changes. The version published here applies.